healer | a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe
Size

658KB
MD5

bd3a8e7801aabb6801065238fff923e1
SHA1

ca6492f0e8a9a2e7f7048bb9960b26a4aaddea9b
SHA256

a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1
SHA512

3ce2e8a7296e4a66271c5b561761a983698bd82c9c91e8d48b633b8007763bb8f08afc23baa8c732ee6ed4ef0854f94476da95053651219cfb16bd71f2a65712
SSDEEP

12288:YMrAy906RMlZT1n7qz/KxG+jBWaLY5y7UgyYH3GsS+EjZxyzSyq+8x7s:IyFk17PzHrS+Ejzyzv

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/220-18-0x0000000004BA0000-0x0000000004BBA000-memory.dmp	healer
behavioral1/memory/220-20-0x00000000076E0000-0x00000000076F8000-memory.dmp	healer
behavioral1/memory/220-46-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-45-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-48-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-42-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-36-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-34-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-32-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-30-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-28-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-26-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-24-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-21-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-40-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-38-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer
behavioral1/memory/220-22-0x00000000076E0000-0x00000000076F2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro4331.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro4331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro4331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro4331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro4331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro4331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro4331.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2628-60-0x00000000049F0000-0x0000000004A36000-memory.dmp	family_redline
behavioral1/memory/2628-61-0x0000000004BF0000-0x0000000004C34000-memory.dmp	family_redline
behavioral1/memory/2628-91-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-95-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-93-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-89-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-87-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-86-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-83-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-81-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-77-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-75-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-73-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-69-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-67-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-79-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-71-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-65-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-63-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline
behavioral1/memory/2628-62-0x0000000004BF0000-0x0000000004C2F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un979933.exepro4331.exequ6791.exe

pid process

4348 un979933.exe
220 pro4331.exe
2628 qu6791.exe

pid	process
4348	un979933.exe
220	pro4331.exe
2628	qu6791.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro4331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro4331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro4331.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exeun979933.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un979933.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 220 WerFault.exe pro4331.exe

pid	pid_target	process	target process
2036	220	WerFault.exe	pro4331.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exeun979933.exepro4331.exequ6791.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un979933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro4331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu6791.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro4331.exe

pid process

220 pro4331.exe
220 pro4331.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro4331.exequ6791.exe

description pid process

Token: SeDebugPrivilege 220 pro4331.exe
Token: SeDebugPrivilege 2628 qu6791.exe

pid	process
220	pro4331.exe
220	pro4331.exe

description	pid	process
Token: SeDebugPrivilege	220	pro4331.exe
Token: SeDebugPrivilege	2628	qu6791.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exeun979933.exe

description	pid	process	target process
PID 3664 wrote to memory of 4348	3664	a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe	un979933.exe
PID 3664 wrote to memory of 4348	3664	a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe	un979933.exe
PID 3664 wrote to memory of 4348	3664	a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe	un979933.exe
PID 4348 wrote to memory of 220	4348	un979933.exe	pro4331.exe
PID 4348 wrote to memory of 220	4348	un979933.exe	pro4331.exe
PID 4348 wrote to memory of 220	4348	un979933.exe	pro4331.exe
PID 4348 wrote to memory of 2628	4348	un979933.exe	qu6791.exe
PID 4348 wrote to memory of 2628	4348	un979933.exe	qu6791.exe
PID 4348 wrote to memory of 2628	4348	un979933.exe	qu6791.exe

C:\Users\Admin\AppData\Local\Temp\a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe
"C:\Users\Admin\AppData\Local\Temp\a38bd9cd5a2050d379abbed2dbe2e16cd60a0949eeb5fce06ecd220dd20ca3e1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un979933.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un979933.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4331.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4331.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1072
4⤵
- Program crash
PID:2036

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6791.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6791.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 220 -ip 220
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un979933.exe

Filesize
516KB

MD5
3ce80f2bdb21c4620248f936ba01df78

SHA1
5860db535ab87cd558e021fcc6c640e502eab007

SHA256
6a36c3082fa88eea66225992a6f60493a07d21705bf272dadc348058b007f477

SHA512
24031c44200900af3c1ef0acae3f6db3505f3a4fd25133e2d6ae623fe5bb9cdb5d078108275c37d7cb2c802009a2ce162667c21d1aa157823d9ecce2d66e60f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4331.exe

Filesize
295KB

MD5
5d2d3f18163089a7abf4a42b786485d3

SHA1
d81b6ca2cf7ad0169114f5c105ce7042f721604a

SHA256
16717868c3c8f01fa2ac3241569ea2b670eef90519aee38a0d6a089410834ab3

SHA512
eb6ac0fe649c7f6be0cdbc7f2909d784db2a03246e17f8b461d696c04b9cd7b42ea2c99e841536fef207a083efd2f0df2592b06c67e08f68ff03705344a3491e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6791.exe

Filesize
354KB

MD5
a5d815193469e6edf45a3e7c8fd9b9ff

SHA1
7da1ac57923957b8225972abf8bf11ffa195cb77

SHA256
bfaa2fa4ca7aa41aa5f38ab4c8f3ee50656c5da4fc8fb449965a9ad8cf9464b2

SHA512
a58c4cfd7f2ed8dd3467fc4cc6ecd0a736fb888484ad4cfd7a4642e7e9c033ea2760b9af47663355e2c8281f38bc9478b32b6e743ad7737646f66c0110df3252

Download Submit
memory/220-15-0x0000000002C00000-0x0000000002D00000-memory.dmp

Filesize
1024KB

Download
memory/220-16-0x00000000047C0000-0x00000000047ED000-memory.dmp

Filesize
180KB

Download
memory/220-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/220-18-0x0000000004BA0000-0x0000000004BBA000-memory.dmp

Filesize
104KB

Download
memory/220-19-0x00000000070F0000-0x0000000007694000-memory.dmp

Filesize
5.6MB

Download
memory/220-20-0x00000000076E0000-0x00000000076F8000-memory.dmp

Filesize
96KB

Download
memory/220-46-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-45-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-48-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-42-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-36-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-34-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-32-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-30-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-28-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-26-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-24-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-21-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-40-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-38-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-22-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/220-49-0x0000000002C00000-0x0000000002D00000-memory.dmp

Filesize
1024KB

Download
memory/220-50-0x00000000047C0000-0x00000000047ED000-memory.dmp

Filesize
180KB

Download
memory/220-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/220-51-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/220-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/220-54-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/2628-60-0x00000000049F0000-0x0000000004A36000-memory.dmp

Filesize
280KB

Download
memory/2628-61-0x0000000004BF0000-0x0000000004C34000-memory.dmp

Filesize
272KB

Download
memory/2628-91-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-95-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-93-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-89-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-87-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-86-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-83-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-81-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-77-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-75-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-73-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-69-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-67-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-79-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-71-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-65-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-63-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-62-0x0000000004BF0000-0x0000000004C2F000-memory.dmp

Filesize
252KB

Download
memory/2628-968-0x0000000007A50000-0x0000000008068000-memory.dmp

Filesize
6.1MB

Download
memory/2628-969-0x0000000007320000-0x000000000742A000-memory.dmp

Filesize
1.0MB

Download
memory/2628-970-0x0000000004F60000-0x0000000004F72000-memory.dmp

Filesize
72KB

Download
memory/2628-971-0x0000000004F80000-0x0000000004FBC000-memory.dmp

Filesize
240KB

Download
memory/2628-972-0x0000000007430000-0x000000000747C000-memory.dmp

Filesize
304KB

Download