healer | 716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe
Size

667KB
MD5

55b632931289da38bc103707e304bfe5
SHA1

73116cf29c8c01afc43869455b3e863554e73a82
SHA256

716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7
SHA512

96fafb93288255993c02c2c9ef4af745eb53d43f9ff2981a8bd73f0450b530d7b27c2d800f7ab13a69f07abac49532ee5196c34dd8450ab2f6d5deefeaae7728
SSDEEP

12288:ZMr+y90VYItUkI99+NXfTLrYHOUUkgfqRl5GrUpXZ/w+t5eRZoE+mQ7Ns:Xy+y5QFUu0T5GrEdw+t5kiTmQ7W

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3596-19-0x0000000002400000-0x000000000241A000-memory.dmp	healer
behavioral1/memory/3596-21-0x0000000002710000-0x0000000002728000-memory.dmp	healer
behavioral1/memory/3596-49-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-47-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-45-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-43-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-41-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-39-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-37-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-35-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-33-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-31-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-29-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-27-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-25-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-23-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/3596-22-0x0000000002710000-0x0000000002722000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro9151.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9151.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9151.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9151.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9151.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9151.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9151.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/876-61-0x00000000025B0000-0x00000000025F6000-memory.dmp	family_redline
behavioral1/memory/876-62-0x0000000002880000-0x00000000028C4000-memory.dmp	family_redline
behavioral1/memory/876-66-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-64-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-63-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-76-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-96-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-94-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-92-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-90-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-88-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-86-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-82-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-80-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-79-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-75-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-72-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-70-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-68-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/876-84-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un189719.exepro9151.exequ9313.exe

pid process

3712 un189719.exe
3596 pro9151.exe
876 qu9313.exe

pid	process
3712	un189719.exe
3596	pro9151.exe
876	qu9313.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro9151.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9151.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9151.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exeun189719.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un189719.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

904 3596 WerFault.exe pro9151.exe

pid	pid_target	process	target process
904	3596	WerFault.exe	pro9151.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exeun189719.exepro9151.exequ9313.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un189719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro9151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu9313.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro9151.exe

pid process

3596 pro9151.exe
3596 pro9151.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro9151.exequ9313.exe

description pid process

Token: SeDebugPrivilege 3596 pro9151.exe
Token: SeDebugPrivilege 876 qu9313.exe

pid	process
3596	pro9151.exe
3596	pro9151.exe

description	pid	process
Token: SeDebugPrivilege	3596	pro9151.exe
Token: SeDebugPrivilege	876	qu9313.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exeun189719.exe

description	pid	process	target process
PID 1940 wrote to memory of 3712	1940	716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe	un189719.exe
PID 1940 wrote to memory of 3712	1940	716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe	un189719.exe
PID 1940 wrote to memory of 3712	1940	716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe	un189719.exe
PID 3712 wrote to memory of 3596	3712	un189719.exe	pro9151.exe
PID 3712 wrote to memory of 3596	3712	un189719.exe	pro9151.exe
PID 3712 wrote to memory of 3596	3712	un189719.exe	pro9151.exe
PID 3712 wrote to memory of 876	3712	un189719.exe	qu9313.exe
PID 3712 wrote to memory of 876	3712	un189719.exe	qu9313.exe
PID 3712 wrote to memory of 876	3712	un189719.exe	qu9313.exe

C:\Users\Admin\AppData\Local\Temp\716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe
"C:\Users\Admin\AppData\Local\Temp\716df24d6d9738538e7f1b757f5791e08b05d68e02828d195ec3163dedb3aef7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un189719.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un189719.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9151.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9151.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 1084
4⤵
- Program crash
PID:904

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9313.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9313.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3596 -ip 3596
1⤵
PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un189719.exe

Filesize
525KB

MD5
a92d703a840f2c25ac4266c2352b2c7d

SHA1
3d1010070a151d03a2f0905251abb8de1a7832ee

SHA256
d53f42bdb353b2f63f1a2c6f997e5a3e96ef4d4bb6748402339889c1122fc724

SHA512
d65997cc60898569b49334bd572aed6c454a0e6a1e059f2361faece90aebb81d99f2bc8c033bf733dba75c8e223ceebc49ffe391e053a2a5ea548541373affb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9151.exe

Filesize
294KB

MD5
870da5080150e24a8b8da34d2ecc48da

SHA1
def47b74f557b9fd7276b5ba6cead974533de6b8

SHA256
2610f1752f290700f30b1eda921ac27f8d3a9f87d2087b7080228afcb970ad1b

SHA512
908fb1ab52464682d3d2b9d6b79d69f9eed2ca17b1c9687fa3f58b9463885c9e6923e9fad13ef8f4971ad8a2cc285ddbc1228044c95d142c805792ceb9b34c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9313.exe

Filesize
352KB

MD5
6dee975c4997fe252685bc8f026e9dce

SHA1
8c91302f906fbb2d2d567a279c6d09a19c88d2df

SHA256
87ece2399a4897fbe23a86c21dccef385c917395b2c6393ac192e8cd7c7957e8

SHA512
aa0dd1888c2ab94e4a392376b2dc414102d744ced577beb5e4e8c766515def39a1912342377072e020b7625026be5fbc46ba69911260cacbadeebbdfc96ddbeb

Download Submit
memory/876-80-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-86-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-970-0x0000000004F00000-0x000000000500A000-memory.dmp

Filesize
1.0MB

Download
memory/876-969-0x0000000005670000-0x0000000005C88000-memory.dmp

Filesize
6.1MB

Download
memory/876-84-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-68-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-70-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-72-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-75-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-79-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-972-0x0000000005060000-0x000000000509C000-memory.dmp

Filesize
240KB

Download
memory/876-973-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/876-82-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-971-0x0000000005040000-0x0000000005052000-memory.dmp

Filesize
72KB

Download
memory/876-88-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-90-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-92-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-94-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-96-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-76-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-63-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-64-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-66-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/876-62-0x0000000002880000-0x00000000028C4000-memory.dmp

Filesize
272KB

Download
memory/876-61-0x00000000025B0000-0x00000000025F6000-memory.dmp

Filesize
280KB

Download
memory/3596-41-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-55-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3596-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3596-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3596-51-0x0000000000B90000-0x0000000000BBD000-memory.dmp

Filesize
180KB

Download
memory/3596-50-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/3596-22-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-23-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-25-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-27-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-29-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-31-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-33-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-35-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-37-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-39-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-43-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-45-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-47-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-49-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/3596-21-0x0000000002710000-0x0000000002728000-memory.dmp

Filesize
96KB

Download
memory/3596-20-0x0000000004E00000-0x00000000053A4000-memory.dmp

Filesize
5.6MB

Download
memory/3596-19-0x0000000002400000-0x000000000241A000-memory.dmp

Filesize
104KB

Download
memory/3596-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3596-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3596-15-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/3596-16-0x0000000000B90000-0x0000000000BBD000-memory.dmp

Filesize
180KB

Download