healer | d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe
Size

665KB
MD5

cb09b0c2976ec80360da9cf9833dbeaf
SHA1

18ca5fd6ef720e44cb2320c2f1ba853cc1719142
SHA256

d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c
SHA512

ed874796367337d762de33c7586556806443f0886b550bdc3a4b86ce9a6022017c7d9088dabf92fef986383d6d4e26415baac1b153e4082d2a943d7c1d3130aa
SSDEEP

12288:oMrwy909DsJj1eGG0+DlSYOXTzP4WQMrU4rs/wSW9gcXr:4yUsOo+hDOXfzXrVqwSWr

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/540-19-0x0000000000D20000-0x0000000000D3A000-memory.dmp	healer
behavioral1/memory/540-21-0x0000000002810000-0x0000000002828000-memory.dmp	healer
behavioral1/memory/540-27-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-49-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-47-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-46-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-43-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-41-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-39-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-38-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-36-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-33-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-31-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-29-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-25-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-23-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/540-22-0x0000000002810000-0x0000000002822000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro5071.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro5071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro5071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro5071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro5071.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro5071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro5071.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4140-61-0x00000000025B0000-0x00000000025F6000-memory.dmp	family_redline
behavioral1/memory/4140-62-0x0000000002880000-0x00000000028C4000-memory.dmp	family_redline
behavioral1/memory/4140-78-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-80-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-96-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-94-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-90-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-88-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-86-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-84-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-82-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-76-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-74-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-72-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-70-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-68-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-92-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-66-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-64-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline
behavioral1/memory/4140-63-0x0000000002880000-0x00000000028BF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un506502.exepro5071.exequ9631.exe

pid process

2136 un506502.exe
540 pro5071.exe
4140 qu9631.exe

pid	process
2136	un506502.exe
540	pro5071.exe
4140	qu9631.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro5071.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro5071.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro5071.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exeun506502.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un506502.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5808 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3796 540 WerFault.exe pro5071.exe

pid	process
5808	sc.exe

pid	pid_target	process	target process
3796	540	WerFault.exe	pro5071.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exeun506502.exepro5071.exequ9631.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un506502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro5071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu9631.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro5071.exe

pid process

540 pro5071.exe
540 pro5071.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro5071.exequ9631.exe

description pid process

Token: SeDebugPrivilege 540 pro5071.exe
Token: SeDebugPrivilege 4140 qu9631.exe

pid	process
540	pro5071.exe
540	pro5071.exe

description	pid	process
Token: SeDebugPrivilege	540	pro5071.exe
Token: SeDebugPrivilege	4140	qu9631.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exeun506502.exe

description	pid	process	target process
PID 404 wrote to memory of 2136	404	d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe	un506502.exe
PID 404 wrote to memory of 2136	404	d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe	un506502.exe
PID 404 wrote to memory of 2136	404	d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe	un506502.exe
PID 2136 wrote to memory of 540	2136	un506502.exe	pro5071.exe
PID 2136 wrote to memory of 540	2136	un506502.exe	pro5071.exe
PID 2136 wrote to memory of 540	2136	un506502.exe	pro5071.exe
PID 2136 wrote to memory of 4140	2136	un506502.exe	qu9631.exe
PID 2136 wrote to memory of 4140	2136	un506502.exe	qu9631.exe
PID 2136 wrote to memory of 4140	2136	un506502.exe	qu9631.exe

C:\Users\Admin\AppData\Local\Temp\d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe
"C:\Users\Admin\AppData\Local\Temp\d4b4d5326222b2710026a6d8b0b0bfd00b14345ba4ecc61a1be4c5890c9d9f0c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un506502.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un506502.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 1084
4⤵
- Program crash
PID:3796

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9631.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9631.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 540 -ip 540
1⤵
PID:3992

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:5808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un506502.exe

Filesize
524KB

MD5
f69c84674f5ba076295e1575bf3e032d

SHA1
382e062da7bd7f389710e43ae9428d24ff13891a

SHA256
70cfe73bce2bf89ac1328c4b8deb63ef4ced681cb580baa1866ff6675862283a

SHA512
71d0a081f8b7eb348d588267d550d6daed4e997529b045b5720969cb7668e896072efdff899f6bc96d6b0696c47f0aee8c58c2fedba2bb30de7281ebf4315cd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5071.exe

Filesize
294KB

MD5
651eb6a245252bc77304a1dc4be7345b

SHA1
bec959c5d62a40d745148ce951b9b45c780c9ba4

SHA256
33504063c89cc97958862b4203cb5f902939b93d9e3b9ed2c66c62124e5c1bbf

SHA512
777de8af05c1753cdd02a11741bac79cc49b0a45fe055608f7ce63ecd1c95a94293fa1b1d51139f8852592b374a17493f92568e3c32f7540c91ccf239d657615

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9631.exe

Filesize
352KB

MD5
8c65141cf2ded4626cc166de2de6b91e

SHA1
690a166c33eb483679af7338eb657a3a136edecf

SHA256
0419d4b26c5c4c75ee53681f81ef86d485558ee6e256b351b68431c5e26acad4

SHA512
354910aefd72b877a518c71ffd273c364efb7b142196ebd99327811e9e1e2c854dfc34b556c7b61af1731a5bd89bd0ebfc5290c042cfbaa02b2869575083dc31

Download Submit
memory/540-15-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/540-16-0x0000000000960000-0x000000000098D000-memory.dmp

Filesize
180KB

Download
memory/540-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/540-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/540-19-0x0000000000D20000-0x0000000000D3A000-memory.dmp

Filesize
104KB

Download
memory/540-20-0x0000000004E20000-0x00000000053C4000-memory.dmp

Filesize
5.6MB

Download
memory/540-21-0x0000000002810000-0x0000000002828000-memory.dmp

Filesize
96KB

Download
memory/540-27-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-49-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-47-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-46-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-43-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-41-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-39-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-38-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-36-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-33-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-31-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-29-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-25-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-23-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-22-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/540-50-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/540-51-0x0000000000960000-0x000000000098D000-memory.dmp

Filesize
180KB

Download
memory/540-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/540-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/540-55-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4140-61-0x00000000025B0000-0x00000000025F6000-memory.dmp

Filesize
280KB

Download
memory/4140-62-0x0000000002880000-0x00000000028C4000-memory.dmp

Filesize
272KB

Download
memory/4140-78-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-80-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-96-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-94-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-90-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-88-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-86-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-84-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-82-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-76-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-74-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-72-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-70-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-68-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-92-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-66-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-64-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-63-0x0000000002880000-0x00000000028BF000-memory.dmp

Filesize
252KB

Download
memory/4140-969-0x0000000005500000-0x0000000005B18000-memory.dmp

Filesize
6.1MB

Download
memory/4140-970-0x0000000005B20000-0x0000000005C2A000-memory.dmp

Filesize
1.0MB

Download
memory/4140-971-0x0000000005C30000-0x0000000005C42000-memory.dmp

Filesize
72KB

Download
memory/4140-972-0x0000000005C50000-0x0000000005C8C000-memory.dmp

Filesize
240KB

Download
memory/4140-973-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download