healer | f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe
Size

658KB
MD5

cfc7f6ed4a23c82d070e1763719ae943
SHA1

43ca74538b19836895773e956beb829059526e85
SHA256

f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3
SHA512

adb309948ae3fd813dd5eb517a8e9a76c0c68d3b32ebbfc4b5e55a617d61e42e6440aaff453aa4344cee2fedb0905c2662ba76baa51111d99fa962f0b634187d
SSDEEP

12288:CMrry90Ef5xo1bWSi/O19ohU/0wuxxjpE0xxRdg92V9Qac+s:1yT0NIOOUyxHHda2Vu

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/468-19-0x0000000002350000-0x000000000236A000-memory.dmp	healer
behavioral1/memory/468-21-0x0000000002400000-0x0000000002418000-memory.dmp	healer
behavioral1/memory/468-45-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-49-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-47-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-43-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-41-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-39-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-37-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-35-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-31-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-29-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-27-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-25-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-23-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-22-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/468-33-0x0000000002400000-0x0000000002412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro9754.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9754.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9754.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9754.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9754.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9754.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9754.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4380-61-0x0000000002390000-0x00000000023D6000-memory.dmp	family_redline
behavioral1/memory/4380-62-0x0000000002530000-0x0000000002574000-memory.dmp	family_redline
behavioral1/memory/4380-66-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-78-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-96-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-94-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-92-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-90-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-86-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-84-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-82-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-80-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-76-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-74-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-72-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-70-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-68-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-88-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-64-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline
behavioral1/memory/4380-63-0x0000000002530000-0x000000000256F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un994138.exepro9754.exequ6138.exe

pid process

1960 un994138.exe
468 pro9754.exe
4380 qu6138.exe

pid	process
1960	un994138.exe
468	pro9754.exe
4380	qu6138.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro9754.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9754.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9754.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exeun994138.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un994138.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3552 468 WerFault.exe pro9754.exe

pid	pid_target	process	target process
3552	468	WerFault.exe	pro9754.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

qu6138.exef4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exeun994138.exepro9754.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu6138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un994138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro9754.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro9754.exe

pid process

468 pro9754.exe
468 pro9754.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro9754.exequ6138.exe

description pid process

Token: SeDebugPrivilege 468 pro9754.exe
Token: SeDebugPrivilege 4380 qu6138.exe

pid	process
468	pro9754.exe
468	pro9754.exe

description	pid	process
Token: SeDebugPrivilege	468	pro9754.exe
Token: SeDebugPrivilege	4380	qu6138.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exeun994138.exe

description	pid	process	target process
PID 3952 wrote to memory of 1960	3952	f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe	un994138.exe
PID 3952 wrote to memory of 1960	3952	f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe	un994138.exe
PID 3952 wrote to memory of 1960	3952	f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe	un994138.exe
PID 1960 wrote to memory of 468	1960	un994138.exe	pro9754.exe
PID 1960 wrote to memory of 468	1960	un994138.exe	pro9754.exe
PID 1960 wrote to memory of 468	1960	un994138.exe	pro9754.exe
PID 1960 wrote to memory of 4380	1960	un994138.exe	qu6138.exe
PID 1960 wrote to memory of 4380	1960	un994138.exe	qu6138.exe
PID 1960 wrote to memory of 4380	1960	un994138.exe	qu6138.exe

C:\Users\Admin\AppData\Local\Temp\f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe
"C:\Users\Admin\AppData\Local\Temp\f4582970b29aef5d2b102cdcddd10e365b6a79020e641ced207ac1da47ca15a3.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un994138.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un994138.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9754.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9754.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 1004
4⤵
- Program crash
PID:3552

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6138.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6138.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 468 -ip 468
1⤵
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un994138.exe

Filesize
516KB

MD5
5928148a6f136744ecc934e045034332

SHA1
4e3aaf4ca7d793e0b71b3030c9192df892938572

SHA256
425be1a0b801d0f8fd42e71fcde3e0c2e1952e668db33d4b4ae3f75f461d90a1

SHA512
b37ce5877bb3fbda8718c026fd3d4b301cae535bb19f4fd4b462f6354a113672d294e2826ffef9f0041b0ccfc8ab08b4c10da776b6c0c302547618fbd5dc4254

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9754.exe

Filesize
236KB

MD5
4e822220361177aca479f6f5b3688fde

SHA1
f48818ab59d8b729a578a9d2344f570a5b345ac9

SHA256
3a0170b8b7abd51d4173c07ef79bad143b535df3ddd327caf11d8dbcf82046fa

SHA512
f29f8768d782865d3543d54ed2af0caefba11fb9cb2f3c0430c484643461d8e2f9e980ec9195e541085a72ac92cf07470e466a3da0a4eb59f6b2d04919aedeee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6138.exe

Filesize
294KB

MD5
a07b96b4a3c476899d6d5433b2f6ea5f

SHA1
2c1a706fcd7addd86587d72f9200c3762f5aa268

SHA256
affd9cee4f7e63e068f432a93f4dd62d20c69aa81a7f0f1386a48407f54738c7

SHA512
fb9ed07e80d04bc24d82b94211f6e136f4701ceb1ba1ec7dd74280ae128dc09bf636f1513f82f0de78f86825853f702d77b9138a2657b1f4e624d04ae87f8a7b

Download Submit
memory/468-15-0x00000000007F0000-0x00000000008F0000-memory.dmp

Filesize
1024KB

Download
memory/468-16-0x0000000000600000-0x000000000062D000-memory.dmp

Filesize
180KB

Download
memory/468-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/468-18-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/468-19-0x0000000002350000-0x000000000236A000-memory.dmp

Filesize
104KB

Download
memory/468-20-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/468-21-0x0000000002400000-0x0000000002418000-memory.dmp

Filesize
96KB

Download
memory/468-45-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-49-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-47-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-43-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-41-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-39-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-37-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-35-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-31-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-29-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-27-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-25-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-23-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-22-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-33-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/468-50-0x00000000007F0000-0x00000000008F0000-memory.dmp

Filesize
1024KB

Download
memory/468-51-0x0000000000600000-0x000000000062D000-memory.dmp

Filesize
180KB

Download
memory/468-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/468-55-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/468-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4380-61-0x0000000002390000-0x00000000023D6000-memory.dmp

Filesize
280KB

Download
memory/4380-62-0x0000000002530000-0x0000000002574000-memory.dmp

Filesize
272KB

Download
memory/4380-66-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-78-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-96-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-94-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-92-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-90-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-86-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-84-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-82-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-80-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-76-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-74-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-72-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-70-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-68-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-88-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-64-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-63-0x0000000002530000-0x000000000256F000-memory.dmp

Filesize
252KB

Download
memory/4380-969-0x0000000005220000-0x0000000005838000-memory.dmp

Filesize
6.1MB

Download
memory/4380-970-0x0000000005840000-0x000000000594A000-memory.dmp

Filesize
1.0MB

Download
memory/4380-971-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/4380-972-0x0000000004C00000-0x0000000004C3C000-memory.dmp

Filesize
240KB

Download
memory/4380-973-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download