healer | 55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe
Size

659KB
MD5

c91752b17d013f81b4429300dfd56020
SHA1

226579ab2ba9ecddf7fb803b1786e697dedf4103
SHA256

55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e
SHA512

954129720cc281d907ff37e93d587033cf7e3548624f788c6d746054e52d191fc80ff04b5e091c7b8f4141a69de643d37eef4adcd0d3b1b78d9473a4fe314d41
SSDEEP

12288:+Mr/y90mAh5A7M5Ga8hfOqXv5NBra1k6H7koZM1xQ/Tt:tysfkaWNfNMHYoMcJ

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1968-19-0x0000000002670000-0x000000000268A000-memory.dmp	healer
behavioral1/memory/1968-21-0x00000000026A0000-0x00000000026B8000-memory.dmp	healer
behavioral1/memory/1968-22-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-39-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-49-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-47-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-45-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-43-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-41-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-37-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-35-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-33-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-32-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-29-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-27-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-25-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer
behavioral1/memory/1968-24-0x00000000026A0000-0x00000000026B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro4544.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro4544.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro4544.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro4544.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro4544.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro4544.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro4544.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2664-61-0x0000000002800000-0x0000000002846000-memory.dmp	family_redline
behavioral1/memory/2664-62-0x0000000004E30000-0x0000000004E74000-memory.dmp	family_redline
behavioral1/memory/2664-68-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-74-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-96-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-95-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-90-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-88-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-86-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-84-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-82-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-80-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-78-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-72-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-71-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-92-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-76-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-66-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-64-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/2664-63-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un248883.exepro4544.exequ8750.exe

pid process

4488 un248883.exe
1968 pro4544.exe
2664 qu8750.exe

pid	process
4488	un248883.exe
1968	pro4544.exe
2664	qu8750.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro4544.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro4544.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro4544.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exeun248883.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un248883.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2824 1968 WerFault.exe pro4544.exe

pid	pid_target	process	target process
2824	1968	WerFault.exe	pro4544.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exeun248883.exepro4544.exequ8750.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un248883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro4544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu8750.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro4544.exe

pid process

1968 pro4544.exe
1968 pro4544.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro4544.exequ8750.exe

description pid process

Token: SeDebugPrivilege 1968 pro4544.exe
Token: SeDebugPrivilege 2664 qu8750.exe

pid	process
1968	pro4544.exe
1968	pro4544.exe

description	pid	process
Token: SeDebugPrivilege	1968	pro4544.exe
Token: SeDebugPrivilege	2664	qu8750.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exeun248883.exe

description	pid	process	target process
PID 4136 wrote to memory of 4488	4136	55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe	un248883.exe
PID 4136 wrote to memory of 4488	4136	55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe	un248883.exe
PID 4136 wrote to memory of 4488	4136	55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe	un248883.exe
PID 4488 wrote to memory of 1968	4488	un248883.exe	pro4544.exe
PID 4488 wrote to memory of 1968	4488	un248883.exe	pro4544.exe
PID 4488 wrote to memory of 1968	4488	un248883.exe	pro4544.exe
PID 4488 wrote to memory of 2664	4488	un248883.exe	qu8750.exe
PID 4488 wrote to memory of 2664	4488	un248883.exe	qu8750.exe
PID 4488 wrote to memory of 2664	4488	un248883.exe	qu8750.exe

C:\Users\Admin\AppData\Local\Temp\55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe
"C:\Users\Admin\AppData\Local\Temp\55bdbb69390cbce5c7fb8c4473e9e448ea30ea9a4879e52895b1a8b69329dd2e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un248883.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un248883.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4544.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4544.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 1084
4⤵
- Program crash
PID:2824

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8750.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8750.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1968 -ip 1968
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un248883.exe

Filesize
518KB

MD5
f4c9f1a4c225b2b7e7fa402679635236

SHA1
ca46a50fd1425bf11eb9905f213dfbb9dd05eca6

SHA256
0626360d79f18c7045f551e31566f2d5c99741e44871f975e97c331070a8fcf1

SHA512
eb0833880acf2f81661a7e578172d11a030c5d7c802b4467430628c1c8ab1417f0389972968be96852a31710e12f44d62956b2414e3bba16911c6291ff62fb87

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4544.exe

Filesize
376KB

MD5
72bf378795acc6d880ce72bffbd2f237

SHA1
cc75bb99a556027ab4dc075aff8f1ee84a21f433

SHA256
7f78d03eca8543b0c8144de87d4972b4d2d3b20b17966bbce1d01f11c6e51b9f

SHA512
6fda5c1a4064ef8a4b468c8f9496325c775188c1cb36c5370240cf5cd00dbf86dbe9493ceeea51c605fe2c4fe157dd38f2e3ad92e9afcfa8cca2dfa8233e2284

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8750.exe

Filesize
434KB

MD5
5ae74d5e7ea5dac7558c6c927e4abc7c

SHA1
ccca76967352aa665c7199e4a619399c6350485b

SHA256
59930b6d9a1e47358ae00d50b573fe2f065dec69039e35eba9c88ed958e9c187

SHA512
b19717ba413359ff57cc456e45ba4af06a74cfffbf5b1e2dfb85ac3bd3faa6883e6c25cf6213bf780cc2b6fcfe8631273428d54d023b145025d956dd9fd41ae7

Download Submit
memory/1968-15-0x0000000000A90000-0x0000000000B90000-memory.dmp

Filesize
1024KB

Download
memory/1968-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1968-16-0x00000000009C0000-0x00000000009ED000-memory.dmp

Filesize
180KB

Download
memory/1968-18-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/1968-19-0x0000000002670000-0x000000000268A000-memory.dmp

Filesize
104KB

Download
memory/1968-20-0x0000000004F50000-0x00000000054F4000-memory.dmp

Filesize
5.6MB

Download
memory/1968-21-0x00000000026A0000-0x00000000026B8000-memory.dmp

Filesize
96KB

Download
memory/1968-22-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-39-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-49-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-47-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-45-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-43-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-41-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-37-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-35-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-33-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-32-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-29-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-27-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-25-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-24-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/1968-50-0x0000000000A90000-0x0000000000B90000-memory.dmp

Filesize
1024KB

Download
memory/1968-51-0x00000000009C0000-0x00000000009ED000-memory.dmp

Filesize
180KB

Download
memory/1968-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1968-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1968-55-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/2664-61-0x0000000002800000-0x0000000002846000-memory.dmp

Filesize
280KB

Download
memory/2664-62-0x0000000004E30000-0x0000000004E74000-memory.dmp

Filesize
272KB

Download
memory/2664-68-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-74-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-96-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-95-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-90-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-88-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-86-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-84-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-82-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-80-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-78-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-72-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-71-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-92-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-76-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-66-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-64-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-63-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/2664-969-0x0000000005510000-0x0000000005B28000-memory.dmp

Filesize
6.1MB

Download
memory/2664-970-0x0000000005B30000-0x0000000005C3A000-memory.dmp

Filesize
1.0MB

Download
memory/2664-971-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/2664-972-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/2664-973-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download