healer | 8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe
Size

683KB
MD5

9b6e07b461ce50726db911b46d41168b
SHA1

328c860fca089dcb237f388002aaced4b37e0162
SHA256

8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26
SHA512

9d35dfbdf25b522fa3f8b26ef49c8fe7dac3c713105da4f18c5f4bdddc96939e0bb04edf9320fc775886e5f72d0941bdb15f0d516d7fadaf724f1b3160a25b55
SSDEEP

12288:jMr2y90ERhlodTjudsFE9BOwB6Qqkx8VQLdUr5mUL3GDGiP1:xyzRIRjcHuwB6QXPCmUL2DGC1

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4652-18-0x0000000004850000-0x000000000486A000-memory.dmp	healer
behavioral1/memory/4652-20-0x0000000004E00000-0x0000000004E18000-memory.dmp	healer
behavioral1/memory/4652-32-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-46-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-44-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-42-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-40-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-38-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-36-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-35-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-30-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-26-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-24-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-22-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-48-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-21-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer
behavioral1/memory/4652-28-0x0000000004E00000-0x0000000004E12000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro8249.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro8249.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro8249.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro8249.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro8249.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro8249.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro8249.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2088-60-0x0000000006FA0000-0x0000000006FE6000-memory.dmp	family_redline
behavioral1/memory/2088-61-0x0000000007780000-0x00000000077C4000-memory.dmp	family_redline
behavioral1/memory/2088-83-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-89-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-95-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-93-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-91-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-87-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-85-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-81-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-79-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-77-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-75-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-73-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-71-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-69-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-67-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-65-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-63-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/2088-62-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un407682.exepro8249.exequ4300.exe

pid process

1788 un407682.exe
4652 pro8249.exe
2088 qu4300.exe

pid	process
1788	un407682.exe
4652	pro8249.exe
2088	qu4300.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro8249.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro8249.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro8249.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exeun407682.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un407682.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 4652 WerFault.exe pro8249.exe

pid	pid_target	process	target process
2192	4652	WerFault.exe	pro8249.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exeun407682.exepro8249.exequ4300.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un407682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro8249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu4300.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro8249.exe

pid process

4652 pro8249.exe
4652 pro8249.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro8249.exequ4300.exe

description pid process

Token: SeDebugPrivilege 4652 pro8249.exe
Token: SeDebugPrivilege 2088 qu4300.exe

pid	process
4652	pro8249.exe
4652	pro8249.exe

description	pid	process
Token: SeDebugPrivilege	4652	pro8249.exe
Token: SeDebugPrivilege	2088	qu4300.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exeun407682.exe

description	pid	process	target process
PID 2512 wrote to memory of 1788	2512	8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe	un407682.exe
PID 2512 wrote to memory of 1788	2512	8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe	un407682.exe
PID 2512 wrote to memory of 1788	2512	8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe	un407682.exe
PID 1788 wrote to memory of 4652	1788	un407682.exe	pro8249.exe
PID 1788 wrote to memory of 4652	1788	un407682.exe	pro8249.exe
PID 1788 wrote to memory of 4652	1788	un407682.exe	pro8249.exe
PID 1788 wrote to memory of 2088	1788	un407682.exe	qu4300.exe
PID 1788 wrote to memory of 2088	1788	un407682.exe	qu4300.exe
PID 1788 wrote to memory of 2088	1788	un407682.exe	qu4300.exe

C:\Users\Admin\AppData\Local\Temp\8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe
"C:\Users\Admin\AppData\Local\Temp\8e2f75b00576804ff62a4d322bcf03e953b93956bc22cd24d6873ca886948f26.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un407682.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un407682.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8249.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8249.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1080
4⤵
- Program crash
PID:2192

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4300.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4300.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4652 -ip 4652
1⤵
PID:488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un407682.exe

Filesize
541KB

MD5
4bc16de41c2ecd55d0ca93494987c156

SHA1
9471cebb9a77f233055f953420f4dbee9dc5f22f

SHA256
6fede4a1dd23ba038ab61a7a2bca9e53faa4dc8340a9fd3e4b4bee8e4df2cd96

SHA512
d4c33e8efdb065d524f7549ebeeeeeb07a5bf87bd0dafa5acee6fe5a90dc5fee25ada21cc75886f4c313c97e1029fa5c6bcd89d48a4d0f8d95d3acf9d71a1832

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8249.exe

Filesize
321KB

MD5
b9feaee8d9afbd3255a418fb83e58d24

SHA1
baab5884907c795cded152496a8d6be672edf744

SHA256
a34d63952164b602765df289a173b2fb44db37b4b1501d510a7713d339b3fd26

SHA512
2cf6287f435d0295690e660758f82e44130cea5aa6cd8721bb20ff596792aa21807fca5e45d7e768c095a804fffc519f1712f53ac5fa8f8140657d93489a984a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4300.exe

Filesize
380KB

MD5
7e542c49da25290b523dfc51db6f2c4c

SHA1
1876d9c687153241255980a633c8e6ebd44df849

SHA256
409e35d1a08956a3b927251d1155f086fafb1bd57b66cb08b68b642a80942d49

SHA512
005b0f87150ca4efcccefff17632715f0151caac87d7a898745512edcc460c869303614edadb557071fcaf9d16fa4666d5ae36b768106a711f427cb3b3a5fcb3

Download Submit
memory/2088-73-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-77-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-969-0x0000000007E60000-0x0000000007F6A000-memory.dmp

Filesize
1.0MB

Download
memory/2088-968-0x00000000077C0000-0x0000000007DD8000-memory.dmp

Filesize
6.1MB

Download
memory/2088-62-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-63-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-65-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-67-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-69-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-71-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-971-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

Filesize
240KB

Download
memory/2088-972-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download
memory/2088-75-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-970-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/2088-79-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-81-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-85-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-87-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-91-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-93-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-95-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-89-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-83-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/2088-61-0x0000000007780000-0x00000000077C4000-memory.dmp

Filesize
272KB

Download
memory/2088-60-0x0000000006FA0000-0x0000000006FE6000-memory.dmp

Filesize
280KB

Download
memory/4652-38-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-54-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4652-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4652-51-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4652-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4652-50-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/4652-49-0x0000000002E20000-0x0000000002F20000-memory.dmp

Filesize
1024KB

Download
memory/4652-28-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-21-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-48-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-22-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-24-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-26-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-30-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-35-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-36-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-40-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-42-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-44-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-46-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-32-0x0000000004E00000-0x0000000004E12000-memory.dmp

Filesize
72KB

Download
memory/4652-20-0x0000000004E00000-0x0000000004E18000-memory.dmp

Filesize
96KB

Download
memory/4652-19-0x0000000007430000-0x00000000079D4000-memory.dmp

Filesize
5.6MB

Download
memory/4652-18-0x0000000004850000-0x000000000486A000-memory.dmp

Filesize
104KB

Download
memory/4652-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4652-16-0x0000000002C50000-0x0000000002C7D000-memory.dmp

Filesize
180KB

Download
memory/4652-15-0x0000000002E20000-0x0000000002F20000-memory.dmp

Filesize
1024KB

Download