healer | d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe
Size

697KB
MD5

4591bcc0ebf84eb63d3e34037eefb462
SHA1

dda18f5a9b2a62e9cd05c1131c25f321354b3a34
SHA256

d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5
SHA512

515fb54663a82db319ec3424def80b89be77d63a97bbbfee066acaa87339737de3ce7b400b374b1a7f2c6a2c64d9a9a23702c32aeea532a6a7733db28c2730c8
SSDEEP

12288:DMrby909d0qFzrcmYi3PLe2vJfOvfM7QDbB0Bek5VbewUw:8yidXwB+rfA50Be2abw

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3388-18-0x0000000004880000-0x000000000489A000-memory.dmp	healer
behavioral1/memory/3388-20-0x0000000004DE0000-0x0000000004DF8000-memory.dmp	healer
behavioral1/memory/3388-42-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-48-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-46-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-44-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-40-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-38-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-36-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-34-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-32-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-28-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-26-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-24-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-22-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-21-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer
behavioral1/memory/3388-30-0x0000000004DE0000-0x0000000004DF2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro7846.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro7846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro7846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro7846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro7846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro7846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro7846.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1644-60-0x0000000004C60000-0x0000000004CA6000-memory.dmp	family_redline
behavioral1/memory/1644-61-0x0000000007780000-0x00000000077C4000-memory.dmp	family_redline
behavioral1/memory/1644-65-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-93-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-95-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-91-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-89-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-87-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-85-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-83-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-81-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-79-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-77-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-75-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-73-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-71-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-69-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-67-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-63-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline
behavioral1/memory/1644-62-0x0000000007780000-0x00000000077BF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un377780.exepro7846.exequ3640.exe

pid process

1884 un377780.exe
3388 pro7846.exe
1644 qu3640.exe

pid	process
1884	un377780.exe
3388	pro7846.exe
1644	qu3640.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro7846.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro7846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro7846.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exeun377780.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un377780.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1900 3388 WerFault.exe pro7846.exe

pid	pid_target	process	target process
1900	3388	WerFault.exe	pro7846.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exeun377780.exepro7846.exequ3640.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un377780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro7846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu3640.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro7846.exe

pid process

3388 pro7846.exe
3388 pro7846.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro7846.exequ3640.exe

description pid process

Token: SeDebugPrivilege 3388 pro7846.exe
Token: SeDebugPrivilege 1644 qu3640.exe

pid	process
3388	pro7846.exe
3388	pro7846.exe

description	pid	process
Token: SeDebugPrivilege	3388	pro7846.exe
Token: SeDebugPrivilege	1644	qu3640.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exeun377780.exe

description	pid	process	target process
PID 2384 wrote to memory of 1884	2384	d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe	un377780.exe
PID 2384 wrote to memory of 1884	2384	d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe	un377780.exe
PID 2384 wrote to memory of 1884	2384	d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe	un377780.exe
PID 1884 wrote to memory of 3388	1884	un377780.exe	pro7846.exe
PID 1884 wrote to memory of 3388	1884	un377780.exe	pro7846.exe
PID 1884 wrote to memory of 3388	1884	un377780.exe	pro7846.exe
PID 1884 wrote to memory of 1644	1884	un377780.exe	qu3640.exe
PID 1884 wrote to memory of 1644	1884	un377780.exe	qu3640.exe
PID 1884 wrote to memory of 1644	1884	un377780.exe	qu3640.exe

C:\Users\Admin\AppData\Local\Temp\d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe
"C:\Users\Admin\AppData\Local\Temp\d17554ae2c65160331cbe8c6c07f003ca94285375aa27bc7bbd692ab362f13f5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377780.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377780.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7846.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7846.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1092
4⤵
- Program crash
PID:1900

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3640.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3640.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3388 -ip 3388
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un377780.exe

Filesize
555KB

MD5
581c66e9b307292cc6c54819dca82902

SHA1
70f92c1c252980ce8cf3f51b951b730a071d2b66

SHA256
6c4de901189017c2af06a1f0995354fff7a891a10a04e1f1be7c0c4aef6df6da

SHA512
e3c81d77fb8976b156a2a6955e697bd426565824bc43ef381070eb6d7c7d091b687bca83356552d41b076b3162227a7636fd532939d1bf78d9c697398a7a9b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7846.exe

Filesize
348KB

MD5
09c85ee61521881706c8bdc339362415

SHA1
9d533d06dcbdf60daac0bae34c56c4b42e2f4865

SHA256
d44ab66071a24fd2d13b893ee332fef109e7aa05abd544e1688d56f15070e07c

SHA512
372613e1586582af1c48265477cc002180f4c72f044ad08349d2a9a8bd363721e9c9acc53cc361aaedd4f1438065af8bfa8385cf16e4074a7120c5ab86296208

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3640.exe

Filesize
406KB

MD5
365f9238a4e5ce37deec35f2783a5361

SHA1
b48cbf655a8bfeae8abca7a51eaf67e659ab5a3c

SHA256
acfed9c60e8926358aa983853bdd5a12d5d27fda7fa7b796f7e2974448064781

SHA512
04fcbe6c77e8e1694b2d46401e22881de39120c18c02b41a7c51675ef9b4a26926f549df79ccc44f6ee485b5e96f7cff2d8dc482dfbdfcd7dc8ca3e033dde5f2

Download Submit
memory/1644-75-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-79-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-969-0x0000000007E70000-0x0000000007F7A000-memory.dmp

Filesize
1.0MB

Download
memory/1644-968-0x00000000077D0000-0x0000000007DE8000-memory.dmp

Filesize
6.1MB

Download
memory/1644-62-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-63-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-67-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-69-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-71-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-73-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-971-0x0000000007FD0000-0x000000000800C000-memory.dmp

Filesize
240KB

Download
memory/1644-972-0x0000000008120000-0x000000000816C000-memory.dmp

Filesize
304KB

Download
memory/1644-77-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-970-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

Filesize
72KB

Download
memory/1644-81-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-83-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-85-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-87-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-89-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-91-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-95-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-93-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-65-0x0000000007780000-0x00000000077BF000-memory.dmp

Filesize
252KB

Download
memory/1644-61-0x0000000007780000-0x00000000077C4000-memory.dmp

Filesize
272KB

Download
memory/1644-60-0x0000000004C60000-0x0000000004CA6000-memory.dmp

Filesize
280KB

Download
memory/3388-38-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-54-0x0000000000400000-0x0000000002B84000-memory.dmp

Filesize
39.5MB

Download
memory/3388-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3388-51-0x0000000000400000-0x0000000002B84000-memory.dmp

Filesize
39.5MB

Download
memory/3388-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3388-50-0x0000000002B90000-0x0000000002BBD000-memory.dmp

Filesize
180KB

Download
memory/3388-49-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download
memory/3388-30-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-21-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-22-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-24-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-26-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-28-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-32-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-34-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-36-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-40-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-44-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-46-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-48-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-42-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/3388-20-0x0000000004DE0000-0x0000000004DF8000-memory.dmp

Filesize
96KB

Download
memory/3388-19-0x00000000072A0000-0x0000000007844000-memory.dmp

Filesize
5.6MB

Download
memory/3388-18-0x0000000004880000-0x000000000489A000-memory.dmp

Filesize
104KB

Download
memory/3388-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3388-16-0x0000000002B90000-0x0000000002BBD000-memory.dmp

Filesize
180KB

Download
memory/3388-15-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download