healer | 806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe
Size

659KB
MD5

ff43e403f5c8c3a42575abe36d947851
SHA1

c830292381bb7c1db9c2562ce6c409d3b33e6844
SHA256

806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea
SHA512

aa0b990be4ede4d1cca3549a6408e5bc17c72d86a688601e4157f00deab95dc696cf230f41f004bfc40a9a2b15915098c0c1c2962c7361ac16a5b94e1eed68b4
SSDEEP

12288:/MrNy90FlPFBBOyix+nw4uoG3bnzKBMYN00sBrLiUiHaWPOHNBh:GyAlPrW+nw4un3bn8NtsB6UiH5OHNBh

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2960-19-0x00000000023A0000-0x00000000023BA000-memory.dmp	healer
behavioral1/memory/2960-21-0x0000000002610000-0x0000000002628000-memory.dmp	healer
behavioral1/memory/2960-22-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-45-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-49-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-47-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-43-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-41-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-39-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-37-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-35-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-33-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-31-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-29-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-27-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-25-0x0000000002610000-0x0000000002622000-memory.dmp	healer
behavioral1/memory/2960-23-0x0000000002610000-0x0000000002622000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro8527.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro8527.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro8527.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro8527.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro8527.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro8527.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro8527.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2360-60-0x0000000002580000-0x00000000025C6000-memory.dmp	family_redline
behavioral1/memory/2360-61-0x0000000002740000-0x0000000002784000-memory.dmp	family_redline
behavioral1/memory/2360-73-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-77-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-95-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-91-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-89-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-87-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-85-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-83-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-81-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-79-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-75-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-71-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-69-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-67-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-93-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-65-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-63-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline
behavioral1/memory/2360-62-0x0000000002740000-0x000000000277F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un976385.exepro8527.exequ7105.exe

pid process

1432 un976385.exe
2960 pro8527.exe
2360 qu7105.exe

pid	process
1432	un976385.exe
2960	pro8527.exe
2360	qu7105.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro8527.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro8527.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro8527.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exeun976385.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un976385.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4228 2960 WerFault.exe pro8527.exe

pid	pid_target	process	target process
4228	2960	WerFault.exe	pro8527.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exeun976385.exepro8527.exequ7105.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un976385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro8527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu7105.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro8527.exe

pid process

2960 pro8527.exe
2960 pro8527.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro8527.exequ7105.exe

description pid process

Token: SeDebugPrivilege 2960 pro8527.exe
Token: SeDebugPrivilege 2360 qu7105.exe

pid	process
2960	pro8527.exe
2960	pro8527.exe

description	pid	process
Token: SeDebugPrivilege	2960	pro8527.exe
Token: SeDebugPrivilege	2360	qu7105.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exeun976385.exe

description	pid	process	target process
PID 5032 wrote to memory of 1432	5032	806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe	un976385.exe
PID 5032 wrote to memory of 1432	5032	806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe	un976385.exe
PID 5032 wrote to memory of 1432	5032	806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe	un976385.exe
PID 1432 wrote to memory of 2960	1432	un976385.exe	pro8527.exe
PID 1432 wrote to memory of 2960	1432	un976385.exe	pro8527.exe
PID 1432 wrote to memory of 2960	1432	un976385.exe	pro8527.exe
PID 1432 wrote to memory of 2360	1432	un976385.exe	qu7105.exe
PID 1432 wrote to memory of 2360	1432	un976385.exe	qu7105.exe
PID 1432 wrote to memory of 2360	1432	un976385.exe	qu7105.exe

C:\Users\Admin\AppData\Local\Temp\806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe
"C:\Users\Admin\AppData\Local\Temp\806bf1787be79cbfdb49a858eb3047d402c531ebae5fbeec0319db46a098ccea.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un976385.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un976385.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8527.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8527.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 1080
4⤵
- Program crash
PID:4228

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7105.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7105.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2960 -ip 2960
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un976385.exe

Filesize
518KB

MD5
886a3e57d2e554367cf4c6d102c9cabe

SHA1
55305200716920f76da4b17db48fca4332f0c78c

SHA256
152732ce63e7c25c9923644455689d9b6255cdb1589394a0f3d4a78cf69cb95a

SHA512
d23d2d1e834d60f9852ee1da4858cc71ed2726403ba79cbbf8601c162da65cdac5478ec452f27523bfae84a6bc69026666dc2e388d8d22ec4d309d034c51db94

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8527.exe

Filesize
236KB

MD5
56daadb4561a1747dd0a1a4c5f2955cc

SHA1
e2e231afee6fba50966fe50cb1ef885e98c1070b

SHA256
05f4056fb79ab7eca7b650af44d423ef45a19a99dcead0e2a13d3f75ed68a2c6

SHA512
05c6f15ee9b54bbe643a38b70cd1e8f2027c32470facaf4283ff82d0686a3a2f276b4fa85c4b891f78550ac7626a93a7398c6287a9fb21994fe5af1f4fa1f98e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7105.exe

Filesize
295KB

MD5
51b1c581d4ec01404464e84e5d770f9e

SHA1
fa5380bd9e716f6608e2ec20a811681c258850d0

SHA256
a2e9a8233581fabf464e8b6ff005707bd0964eaa978cadcd0e9d1bdcc72185d8

SHA512
4f0e23a1b1063b367e799024ba2c1d95b1f807fafeb95f3d24023807a7deaddd8d61969f3780eca35141a47ea5ca0e92d8488ff5dcea31035836b72375578b71

Download Submit
memory/2360-71-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-79-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-969-0x00000000058D0000-0x00000000059DA000-memory.dmp

Filesize
1.0MB

Download
memory/2360-968-0x0000000005250000-0x0000000005868000-memory.dmp

Filesize
6.1MB

Download
memory/2360-62-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-63-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-65-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-93-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-67-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-69-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-971-0x0000000005A30000-0x0000000005A6C000-memory.dmp

Filesize
240KB

Download
memory/2360-972-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Filesize
304KB

Download
memory/2360-75-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-970-0x0000000005A10000-0x0000000005A22000-memory.dmp

Filesize
72KB

Download
memory/2360-81-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-83-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-85-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-87-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-89-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-91-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-95-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-77-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-73-0x0000000002740000-0x000000000277F000-memory.dmp

Filesize
252KB

Download
memory/2360-61-0x0000000002740000-0x0000000002784000-memory.dmp

Filesize
272KB

Download
memory/2360-60-0x0000000002580000-0x00000000025C6000-memory.dmp

Filesize
280KB

Download
memory/2960-43-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2960-54-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2960-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2960-50-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/2960-23-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-25-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-27-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-29-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-31-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-33-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-35-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-37-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-39-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-41-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-47-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-49-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-45-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-22-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/2960-21-0x0000000002610000-0x0000000002628000-memory.dmp

Filesize
96KB

Download
memory/2960-20-0x0000000004C90000-0x0000000005234000-memory.dmp

Filesize
5.6MB

Download
memory/2960-19-0x00000000023A0000-0x00000000023BA000-memory.dmp

Filesize
104KB

Download
memory/2960-18-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2960-16-0x0000000002120000-0x000000000214D000-memory.dmp

Filesize
180KB

Download
memory/2960-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2960-15-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download