healer | 640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe
Size

666KB
MD5

bbd6067310f80ada8716a8f0493d837b
SHA1

9e595d10f96791bb2e13bdd9e82886b5316bb6c3
SHA256

640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e
SHA512

600357b882cc94151ff79a4a89c7d53d31fd46dcbcf999243882fd9f90c94dd685db5cfdedff1264ab38ecd599428a72aa6907d42799d299d6895926e8d9be23
SSDEEP

12288:uMruy90NEKkWxWuVpoJRUwm/w88T9bsLSzx8uwrU9ib/wBfKH5qj4Z:Ey5WpoJRdmIH+3uwrFjwtKH4a

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1432-19-0x00000000028C0000-0x00000000028DA000-memory.dmp	healer
behavioral1/memory/1432-21-0x0000000002960000-0x0000000002978000-memory.dmp	healer
behavioral1/memory/1432-29-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-49-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-47-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-45-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-43-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-41-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-39-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-37-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-35-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-33-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-31-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-27-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-25-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-23-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral1/memory/1432-22-0x0000000002960000-0x0000000002972000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro0118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro0118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro0118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro0118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro0118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro0118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro0118.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2304-60-0x00000000026F0000-0x0000000002736000-memory.dmp	family_redline
behavioral1/memory/2304-61-0x00000000028B0000-0x00000000028F4000-memory.dmp	family_redline
behavioral1/memory/2304-73-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-71-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-69-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-67-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-65-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-63-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-62-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-89-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-95-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-93-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-91-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-87-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-85-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-83-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-81-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-79-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-77-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/2304-75-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un289804.exepro0118.exequ8878.exe

pid process

3404 un289804.exe
1432 pro0118.exe
2304 qu8878.exe

pid	process
3404	un289804.exe
1432	pro0118.exe
2304	qu8878.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro0118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro0118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro0118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exeun289804.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un289804.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3932 1432 WerFault.exe pro0118.exe

pid	pid_target	process	target process
3932	1432	WerFault.exe	pro0118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exeun289804.exepro0118.exequ8878.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un289804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro0118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu8878.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro0118.exe

pid process

1432 pro0118.exe
1432 pro0118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro0118.exequ8878.exe

description pid process

Token: SeDebugPrivilege 1432 pro0118.exe
Token: SeDebugPrivilege 2304 qu8878.exe

pid	process
1432	pro0118.exe
1432	pro0118.exe

description	pid	process
Token: SeDebugPrivilege	1432	pro0118.exe
Token: SeDebugPrivilege	2304	qu8878.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exeun289804.exe

description	pid	process	target process
PID 3096 wrote to memory of 3404	3096	640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe	un289804.exe
PID 3096 wrote to memory of 3404	3096	640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe	un289804.exe
PID 3096 wrote to memory of 3404	3096	640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe	un289804.exe
PID 3404 wrote to memory of 1432	3404	un289804.exe	pro0118.exe
PID 3404 wrote to memory of 1432	3404	un289804.exe	pro0118.exe
PID 3404 wrote to memory of 1432	3404	un289804.exe	pro0118.exe
PID 3404 wrote to memory of 2304	3404	un289804.exe	qu8878.exe
PID 3404 wrote to memory of 2304	3404	un289804.exe	qu8878.exe
PID 3404 wrote to memory of 2304	3404	un289804.exe	qu8878.exe

C:\Users\Admin\AppData\Local\Temp\640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe
"C:\Users\Admin\AppData\Local\Temp\640e60ea06134d46cdf36b91a85032d85b28ba9efcb5d6cac4fa9d73d401b60e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un289804.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un289804.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0118.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0118.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 980
4⤵
- Program crash
PID:3932

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8878.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8878.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1432 -ip 1432
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un289804.exe

Filesize
524KB

MD5
19c2c78b22c8b16289e0bc3ea186d850

SHA1
5297857673323e36f521bc65ee4925ea73e65821

SHA256
be3c41b496e157e30cc2e341c85d3891966474a43b865d27045420a8a053c565

SHA512
3f4fe77d53525d7f8007f3665093ebb5d53cffc889a51db9d76c4ae194e6dbae586a29c192c7189aecaa3d20a9e4127c1e574639d306d2ed225f99fb6be9f72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0118.exe

Filesize
294KB

MD5
44c585dfebb8be08bebca5169c793f30

SHA1
df3341287940528d42f26b3e6e057419de435018

SHA256
276bf002c0ff1d5c54f8f7c7abbbc6747eb2a6981599929b25642d4fa9786b97

SHA512
5df9df97239b41edc66c16483ae4207727ae54bb44ae6660072d48a67057e4c5fd12415152e0a149f64b26809bbd0142bb96e498bb15124017a363d55c1410f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8878.exe

Filesize
352KB

MD5
d467645b01f420af0a9ebdc4ef816c4b

SHA1
92daf86940aafe4b950cff66cbc24090be9e94a6

SHA256
f28231209755bf93ddd4fc12cb89378631119c5f450fc850670c0fe901d0c9a1

SHA512
8fd559bcdd0d71c3a17e4de737ce0aa8cd1382086a52824f5b09fc75fa9c1a6a6b552dd594f04f90ec7ccbd04750979964e82df262fd35cc96e56bdff92bb7f2

Download Submit
memory/1432-15-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/1432-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1432-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/1432-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/1432-19-0x00000000028C0000-0x00000000028DA000-memory.dmp

Filesize
104KB

Download
memory/1432-20-0x00000000052B0000-0x0000000005854000-memory.dmp

Filesize
5.6MB

Download
memory/1432-21-0x0000000002960000-0x0000000002978000-memory.dmp

Filesize
96KB

Download
memory/1432-29-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-49-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-47-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-45-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-43-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-41-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-39-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-37-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-35-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-33-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-31-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-27-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-25-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-23-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-22-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/1432-50-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/1432-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1432-54-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/1432-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2304-60-0x00000000026F0000-0x0000000002736000-memory.dmp

Filesize
280KB

Download
memory/2304-61-0x00000000028B0000-0x00000000028F4000-memory.dmp

Filesize
272KB

Download
memory/2304-73-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-71-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-69-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-67-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-65-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-63-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-62-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-89-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-95-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-93-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-91-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-87-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-85-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-83-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-81-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-79-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-77-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-75-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/2304-968-0x0000000005570000-0x0000000005B88000-memory.dmp

Filesize
6.1MB

Download
memory/2304-969-0x0000000005B90000-0x0000000005C9A000-memory.dmp

Filesize
1.0MB

Download
memory/2304-970-0x0000000004F30000-0x0000000004F42000-memory.dmp

Filesize
72KB

Download
memory/2304-971-0x0000000004F50000-0x0000000004F8C000-memory.dmp

Filesize
240KB

Download
memory/2304-972-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download