healer | ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe
Size

666KB
MD5

7223b0f7334c5d61cb715f2d3292260e
SHA1

862afae0f3aad181d240415cd7d518ac1415ed9b
SHA256

ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb
SHA512

717fcd5dc219505b0e3653938f7cb0e2dd333c33d64300c2e6abd8fc909e7ba3cb386356f033ee860a68ab563b964733a9622a4b4f71d177609616f5c06791b2
SSDEEP

12288:gMrsy90k3t1vHMiWVO6mdm0KLMeV+rU8l4/wALZy/Q20wMQ4:8yl49l0KLTArrWwALyjnMB

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1836-19-0x00000000026B0000-0x00000000026CA000-memory.dmp	healer
behavioral1/memory/1836-21-0x0000000004DA0000-0x0000000004DB8000-memory.dmp	healer
behavioral1/memory/1836-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-48-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-39-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-28-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-25-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/1836-23-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro8449.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro8449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro8449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro8449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro8449.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro8449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro8449.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4664-61-0x00000000025C0000-0x0000000002606000-memory.dmp	family_redline
behavioral1/memory/4664-62-0x0000000004E00000-0x0000000004E44000-memory.dmp	family_redline
behavioral1/memory/4664-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-94-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-92-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-90-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-88-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-85-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-96-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4664-63-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un843605.exepro8449.exequ4901.exe

pid process

5112 un843605.exe
1836 pro8449.exe
4664 qu4901.exe

pid	process
5112	un843605.exe
1836	pro8449.exe
4664	qu4901.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro8449.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro8449.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro8449.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exeun843605.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un843605.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 1836 WerFault.exe pro8449.exe

pid	pid_target	process	target process
1728	1836	WerFault.exe	pro8449.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exeun843605.exepro8449.exequ4901.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un843605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro8449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu4901.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro8449.exe

pid process

1836 pro8449.exe
1836 pro8449.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro8449.exequ4901.exe

description pid process

Token: SeDebugPrivilege 1836 pro8449.exe
Token: SeDebugPrivilege 4664 qu4901.exe

pid	process
1836	pro8449.exe
1836	pro8449.exe

description	pid	process
Token: SeDebugPrivilege	1836	pro8449.exe
Token: SeDebugPrivilege	4664	qu4901.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exeun843605.exe

description	pid	process	target process
PID 2356 wrote to memory of 5112	2356	ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe	un843605.exe
PID 2356 wrote to memory of 5112	2356	ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe	un843605.exe
PID 2356 wrote to memory of 5112	2356	ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe	un843605.exe
PID 5112 wrote to memory of 1836	5112	un843605.exe	pro8449.exe
PID 5112 wrote to memory of 1836	5112	un843605.exe	pro8449.exe
PID 5112 wrote to memory of 1836	5112	un843605.exe	pro8449.exe
PID 5112 wrote to memory of 4664	5112	un843605.exe	qu4901.exe
PID 5112 wrote to memory of 4664	5112	un843605.exe	qu4901.exe
PID 5112 wrote to memory of 4664	5112	un843605.exe	qu4901.exe

C:\Users\Admin\AppData\Local\Temp\ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe
"C:\Users\Admin\AppData\Local\Temp\ccc3f625054228b68f7cdc6a17385c95810896d97bd9f13ef2743bef02436cfb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un843605.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un843605.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8449.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8449.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1080
4⤵
- Program crash
PID:1728

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4901.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4901.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1836 -ip 1836
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un843605.exe

Filesize
524KB

MD5
a36ea18fd343610551b15074ada6040b

SHA1
500a5ba742a0cd2fe74d502588ec81d9f9351288

SHA256
68d3c3aedd5e7e656b2e7511be6a60bccc88072de728a02c4810b479c23d1468

SHA512
229e0e9b4d14efd92863842635dfbf7fe5f0f2b8729934341a6d3e006e222fe92f8579092994c98c8876e447124d5c3ff343305b98302dcb4f77e0cc46b4e6a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8449.exe

Filesize
294KB

MD5
f74d06a72aa590b60c8790d4718ce207

SHA1
a114e0e7ffcfb437e2f9ec31e811b0c14639eccd

SHA256
a9d3a542da20e6e7b59c4cffba8857c9173687e2486c4b2ee9435cbd1df9d132

SHA512
119c18ad03827c0d88f7a8376704eeb7ccdc163000d6c67a4869c983e6ff6493e35264b6ee8077ae2d683f2cd155a13371c3f4828d5a6cd576e6b8adc160fbb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4901.exe

Filesize
352KB

MD5
c27c27b5cb110adcf5cb44ffbb4ab22d

SHA1
4c8eecdc849ac69b014a33d4698728698e8e5cf0

SHA256
aafa2971e05d73558b8576c616f5f7df599ce83ce53ac61fb4fb26bf91e3ea34

SHA512
7904a0dfc59f1217d8c1b42b1c607311eae88b6e930f0c636dcff34056f67a79b01cc127992a4f3db04ebc3fa554cdf562418dfd35fc21654bd8dc28cbc26597

Download Submit
memory/1836-15-0x0000000000A20000-0x0000000000B20000-memory.dmp

Filesize
1024KB

Download
memory/1836-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1836-16-0x0000000000910000-0x000000000093D000-memory.dmp

Filesize
180KB

Download
memory/1836-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/1836-19-0x00000000026B0000-0x00000000026CA000-memory.dmp

Filesize
104KB

Download
memory/1836-20-0x0000000004F00000-0x00000000054A4000-memory.dmp

Filesize
5.6MB

Download
memory/1836-21-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

Filesize
96KB

Download
memory/1836-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-48-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-39-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-28-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-25-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-23-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/1836-50-0x0000000000A20000-0x0000000000B20000-memory.dmp

Filesize
1024KB

Download
memory/1836-51-0x0000000000910000-0x000000000093D000-memory.dmp

Filesize
180KB

Download
memory/1836-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1836-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1836-55-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4664-61-0x00000000025C0000-0x0000000002606000-memory.dmp

Filesize
280KB

Download
memory/4664-62-0x0000000004E00000-0x0000000004E44000-memory.dmp

Filesize
272KB

Download
memory/4664-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-94-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-92-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-90-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-88-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-85-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-96-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-63-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4664-969-0x00000000054F0000-0x0000000005B08000-memory.dmp

Filesize
6.1MB

Download
memory/4664-970-0x0000000005B10000-0x0000000005C1A000-memory.dmp

Filesize
1.0MB

Download
memory/4664-971-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/4664-972-0x0000000005C40000-0x0000000005C7C000-memory.dmp

Filesize
240KB

Download
memory/4664-973-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download