healer | 3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe
Size

689KB
MD5

a8e12f87d80cd8366f17d6e919048a64
SHA1

cf2bdaed3a52a91a6d75e1fcd0526eab01775759
SHA256

3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2
SHA512

34204c5b01249616212ce765547936d9edbffb24e2d59c9cfa534cc6280ef9b1f5fdd8b06cebbf008c1d3f4358aba3c287610cedaefdff150ae9bf20f192c5ab
SSDEEP

12288:9MrMy90YOszwFEEcQEVXvhj2q9MzbOyb65hLuRIYCdPa8JIMyFKwXv4FgcfigOwX:dy9Os4hIjMz3GfaRIZdPa8e6OAgcagOo

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2752-19-0x0000000002860000-0x000000000287A000-memory.dmp	healer
behavioral1/memory/2752-21-0x0000000004DE0000-0x0000000004DF8000-memory.dmp	healer
behavioral1/memory/2752-27-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-47-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-49-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-48-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-45-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-44-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-41-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-39-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-37-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-35-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-33-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-31-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-29-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-25-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-23-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/2752-22-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro2517.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2517.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5020-61-0x00000000038B0000-0x00000000038F6000-memory.dmp	family_redline
behavioral1/memory/5020-62-0x0000000006030000-0x0000000006074000-memory.dmp	family_redline
behavioral1/memory/5020-70-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-72-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-94-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-92-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-91-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-88-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-86-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-84-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-80-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-78-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-76-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-74-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-96-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-82-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-68-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-66-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-64-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/5020-63-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un810854.exepro2517.exequ1006.exe

pid process

2916 un810854.exe
2752 pro2517.exe
5020 qu1006.exe

pid	process
2916	un810854.exe
2752	pro2517.exe
5020	qu1006.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro2517.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2517.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exeun810854.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un810854.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2908 2752 WerFault.exe pro2517.exe

pid	pid_target	process	target process
2908	2752	WerFault.exe	pro2517.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

pro2517.exequ1006.exe3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exeun810854.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro2517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu1006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un810854.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro2517.exe

pid process

2752 pro2517.exe
2752 pro2517.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro2517.exequ1006.exe

description pid process

Token: SeDebugPrivilege 2752 pro2517.exe
Token: SeDebugPrivilege 5020 qu1006.exe

pid	process
2752	pro2517.exe
2752	pro2517.exe

description	pid	process
Token: SeDebugPrivilege	2752	pro2517.exe
Token: SeDebugPrivilege	5020	qu1006.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exeun810854.exe

description	pid	process	target process
PID 3592 wrote to memory of 2916	3592	3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe	un810854.exe
PID 3592 wrote to memory of 2916	3592	3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe	un810854.exe
PID 3592 wrote to memory of 2916	3592	3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe	un810854.exe
PID 2916 wrote to memory of 2752	2916	un810854.exe	pro2517.exe
PID 2916 wrote to memory of 2752	2916	un810854.exe	pro2517.exe
PID 2916 wrote to memory of 2752	2916	un810854.exe	pro2517.exe
PID 2916 wrote to memory of 5020	2916	un810854.exe	qu1006.exe
PID 2916 wrote to memory of 5020	2916	un810854.exe	qu1006.exe
PID 2916 wrote to memory of 5020	2916	un810854.exe	qu1006.exe

C:\Users\Admin\AppData\Local\Temp\3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe
"C:\Users\Admin\AppData\Local\Temp\3252a43a90c444b8eaf8571ff1019e5e42505f8cd23486a0750cdc1ee5f64cd2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un810854.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un810854.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2517.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2517.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 1088
4⤵
- Program crash
PID:2908

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1006.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1006.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2752 -ip 2752
1⤵
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un810854.exe

Filesize
547KB

MD5
5a272b9d1931baa73eff4b1a535aac5a

SHA1
fcdd1cb0b81727fb511d6d5969559b889b20d3c5

SHA256
8bfd383e207174525c0fa4665dc13e7f23c970c68aab62704fb3c7b6bbde6cc4

SHA512
1e691304eb497ce335a86afc0975f4d832ab188bc769966724f4aaf9373ea4bd41b48567fdf42050f69a1164dfb6b6492d8c4347babd9c88f03059198f90b304

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2517.exe

Filesize
291KB

MD5
6418b84b8f681511929e4f4d93af3967

SHA1
7e34fb0f8d46cd1103bde9c3a7c8d24a71976074

SHA256
8eb61892cba55803a2a38ade4f5ff261dfd874235d13ad23f9fc9fb2165b2656

SHA512
b493da292b6f5bf16ace9c8eea3f27196c33bcfdacbd4c7972313132c6be397a50a3cd8282d106f82cd5a0ebbfbebc554a07a990b646a65d33d2e8b002be4d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1006.exe

Filesize
345KB

MD5
0e0441208b0478c2bd669371cb41c072

SHA1
a85d1910e1dca468579b9708ac04dbb740236480

SHA256
005733c20901c3bba53588302682e46dbe4888e0b8d63ab038d96447705f573c

SHA512
f5766561ef665d071e98da8457d6b056d79cb1c97334d9e8453b255649390933926b01f76cc22d9870a7dc93f57ccad0191a3e0510c7b67ff6f9311e8f546585

Download Submit
memory/2752-15-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/2752-16-0x0000000000810000-0x000000000083D000-memory.dmp

Filesize
180KB

Download
memory/2752-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2752-18-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/2752-19-0x0000000002860000-0x000000000287A000-memory.dmp

Filesize
104KB

Download
memory/2752-20-0x0000000004E40000-0x00000000053E4000-memory.dmp

Filesize
5.6MB

Download
memory/2752-21-0x0000000004DE0000-0x0000000004DF8000-memory.dmp

Filesize
96KB

Download
memory/2752-27-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-47-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-49-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-48-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-45-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-44-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-41-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-39-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-37-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-35-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-33-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-31-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-29-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-25-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-23-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-22-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/2752-50-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/2752-51-0x0000000000810000-0x000000000083D000-memory.dmp

Filesize
180KB

Download
memory/2752-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2752-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2752-55-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/5020-61-0x00000000038B0000-0x00000000038F6000-memory.dmp

Filesize
280KB

Download
memory/5020-62-0x0000000006030000-0x0000000006074000-memory.dmp

Filesize
272KB

Download
memory/5020-70-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-72-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-94-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-92-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-91-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-88-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-86-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-84-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-80-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-78-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-76-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-74-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-96-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-82-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-68-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-66-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-64-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-63-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/5020-969-0x00000000066E0000-0x0000000006CF8000-memory.dmp

Filesize
6.1MB

Download
memory/5020-970-0x0000000006D00000-0x0000000006E0A000-memory.dmp

Filesize
1.0MB

Download
memory/5020-971-0x0000000006E40000-0x0000000006E52000-memory.dmp

Filesize
72KB

Download
memory/5020-972-0x0000000006E60000-0x0000000006E9C000-memory.dmp

Filesize
240KB

Download
memory/5020-973-0x0000000006FB0000-0x0000000006FFC000-memory.dmp

Filesize
304KB

Download