healer | b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe
Size

670KB
MD5

3fff431cd0549149e7031170edace814
SHA1

5110f9acaacec3c13cdbb7ece6ea2d0e11e8a548
SHA256

b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb
SHA512

cc0a42a293c757456d3f4178cdc71d8f3af6086d2e635c9775c9379bdd52e8fadd9ab657e480e180e9bd753894954b7a2478b5102e3f5cd8c5a9fcb6911b44e0
SSDEEP

12288:8MrEy90UK4gDY7mbBiMZE1KvBV39TK7jzleUcJJyCWqgxMp/zj2nChFeoZPX:4y4Y7mwKBngg3uCWqbp/f2Chf

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2892-19-0x0000000002440000-0x000000000245A000-memory.dmp	healer
behavioral1/memory/2892-21-0x0000000005000000-0x0000000005018000-memory.dmp	healer
behavioral1/memory/2892-43-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-49-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-47-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-45-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-41-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-39-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-37-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-35-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-31-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-29-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-28-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-26-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-22-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-33-0x0000000005000000-0x0000000005012000-memory.dmp	healer
behavioral1/memory/2892-23-0x0000000005000000-0x0000000005012000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro7665.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro7665.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro7665.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro7665.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro7665.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro7665.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1720-60-0x0000000002630000-0x0000000002676000-memory.dmp	family_redline
behavioral1/memory/1720-61-0x00000000026B0000-0x00000000026F4000-memory.dmp	family_redline
behavioral1/memory/1720-77-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-80-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-93-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-91-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-89-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-85-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-83-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-81-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-75-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-73-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-71-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-69-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-95-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-87-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-67-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-65-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-63-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline
behavioral1/memory/1720-62-0x00000000026B0000-0x00000000026EF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2836	un826834.exe
2892	pro7665.exe
1720	qu3952.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro7665.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro7665.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un826834.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	2892	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un826834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro7665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu3952.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2892	pro7665.exe
2892	pro7665.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	pro7665.exe
Token: SeDebugPrivilege	1720	qu3952.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2836	4828	b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe	84
PID 4828 wrote to memory of 2836	4828	b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe	84
PID 4828 wrote to memory of 2836	4828	b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe	84
PID 2836 wrote to memory of 2892	2836	un826834.exe	85
PID 2836 wrote to memory of 2892	2836	un826834.exe	85
PID 2836 wrote to memory of 2892	2836	un826834.exe	85
PID 2836 wrote to memory of 1720	2836	un826834.exe	96
PID 2836 wrote to memory of 1720	2836	un826834.exe	96
PID 2836 wrote to memory of 1720	2836	un826834.exe	96

C:\Users\Admin\AppData\Local\Temp\b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe
"C:\Users\Admin\AppData\Local\Temp\b2bb3c540cdb1a22fcfbdba53e1137ed4809227bde09cdd5ac3fd4a985dcbacb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un826834.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un826834.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7665.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7665.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1084
      4⤵
      Program crash
      PID:2308
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3952.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3952.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2892 -ip 2892
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un826834.exe

Filesize
516KB

MD5
3477a51cb1cfaf2119f2dbf34093b488

SHA1
741084bd20e8e0bec2df0b306c6c5f61f502d016

SHA256
6055e3214a14c2eb738ffe354a5367fd5ecc6f70ceb6437cd1555d2acc654e94

SHA512
645b3c9475c31d204c31cef536407deb34bb373e5e19815dd212efd62d91622de6b7e30952732e4fd85b687aea20ab624f21b1a38a6cec5cbcbfe64e51ac6748

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7665.exe

Filesize
237KB

MD5
4f60fe94d0dd2d3e0263f3e7f00a3e91

SHA1
a5668008ef02b8d9e2dad274278c3d07346e55ae

SHA256
1f38fc46c94a73d73ce92dd3907577f29ad2dbaeebb9860707dda7494cf54a90

SHA512
c1b838d3909c22a1269c769d916186f32e426a22c623910916cd7e23fe12af0245c70501c28a31fd60e4cea2488b208402621f756afc4cc8eaa0a21de9a562bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3952.exe

Filesize
295KB

MD5
bcb76d992e1783ee355b056421ae1c25

SHA1
8b3bcc665ee5c1febca6ace5d13d0ee4de766f4f

SHA256
edc1e5688960f051be8813cf7cb08d6a2e021bdd7f42cf9da85691b93376db0d

SHA512
281f56343aa8027a18b88e51483cb08160ac5e29a1f6af3d526e1e123297a901956e6d50482316d7737c5195ed44849fd8325c868e74ea81c03060209a860f71

Download Submit
memory/1720-69-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-73-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-969-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/1720-968-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/1720-62-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-63-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-65-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-67-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-87-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-95-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-971-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/1720-972-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Filesize
304KB

Download
memory/1720-71-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-970-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/1720-75-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-81-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-83-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-85-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-89-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-91-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-93-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-80-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-77-0x00000000026B0000-0x00000000026EF000-memory.dmp

Filesize
252KB

Download
memory/1720-61-0x00000000026B0000-0x00000000026F4000-memory.dmp

Filesize
272KB

Download
memory/1720-60-0x0000000002630000-0x0000000002676000-memory.dmp

Filesize
280KB

Download
memory/2892-41-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2892-54-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2892-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2892-50-0x00000000004C0000-0x00000000005C0000-memory.dmp

Filesize
1024KB

Download
memory/2892-23-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-33-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-22-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-26-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-28-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-29-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-31-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-35-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-37-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-39-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-45-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-47-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-49-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-43-0x0000000005000000-0x0000000005012000-memory.dmp

Filesize
72KB

Download
memory/2892-21-0x0000000005000000-0x0000000005018000-memory.dmp

Filesize
96KB

Download
memory/2892-20-0x0000000004A00000-0x0000000004FA4000-memory.dmp

Filesize
5.6MB

Download
memory/2892-19-0x0000000002440000-0x000000000245A000-memory.dmp

Filesize
104KB

Download
memory/2892-18-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2892-17-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2892-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2892-15-0x00000000004C0000-0x00000000005C0000-memory.dmp

Filesize
1024KB

Download