healer | 86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe
Size

659KB
MD5

a1379ddce5c7361d05b14be52a28863f
SHA1

42c3e61554bea5d928233da0c6043a839118db9e
SHA256

86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37
SHA512

9cc8586133cb1296ebf0dc931dd8eafb6215bfb1b034886085ed1dedd5e05c64b7c48edc01fe128ce8c63cf00fe14329b612de63cc1df0be60456f9735fafa0e
SSDEEP

12288:XMrzy90TpjRB+uJHz+KKL1ThPVJgtv4t7yHzccXmRKjJQoqBi/BbEqCBPPDZ:0yyp1dHyhT+B4tewSnNQDqEqCVDZ

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1796-18-0x0000000004A30000-0x0000000004A4A000-memory.dmp	healer
behavioral1/memory/1796-20-0x0000000004B30000-0x0000000004B48000-memory.dmp	healer
behavioral1/memory/1796-21-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-48-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-46-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-44-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-42-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-40-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-38-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-36-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-34-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-32-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-30-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-28-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-26-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-24-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer
behavioral1/memory/1796-22-0x0000000004B30000-0x0000000004B42000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro9794.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9794.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9794.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2180-60-0x0000000004950000-0x0000000004996000-memory.dmp	family_redline
behavioral1/memory/2180-61-0x0000000004B60000-0x0000000004BA4000-memory.dmp	family_redline
behavioral1/memory/2180-79-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-63-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-62-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-95-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-93-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-91-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-89-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-87-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-85-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-83-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-81-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-77-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-75-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-73-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-71-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-69-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-67-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline
behavioral1/memory/2180-65-0x0000000004B60000-0x0000000004B9F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un804912.exepro9794.exequ6922.exe

pid process

2200 un804912.exe
1796 pro9794.exe
2180 qu6922.exe

pid	process
2200	un804912.exe
1796	pro9794.exe
2180	qu6922.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro9794.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9794.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9794.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

un804912.exe86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un804912.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

6084 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4400 1796 WerFault.exe pro9794.exe

pid	process
6084	sc.exe

pid	pid_target	process	target process
4400	1796	WerFault.exe	pro9794.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exeun804912.exepro9794.exequ6922.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un804912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro9794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu6922.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro9794.exe

pid process

1796 pro9794.exe
1796 pro9794.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro9794.exequ6922.exe

description pid process

Token: SeDebugPrivilege 1796 pro9794.exe
Token: SeDebugPrivilege 2180 qu6922.exe

pid	process
1796	pro9794.exe
1796	pro9794.exe

description	pid	process
Token: SeDebugPrivilege	1796	pro9794.exe
Token: SeDebugPrivilege	2180	qu6922.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exeun804912.exe

description	pid	process	target process
PID 1828 wrote to memory of 2200	1828	86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe	un804912.exe
PID 1828 wrote to memory of 2200	1828	86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe	un804912.exe
PID 1828 wrote to memory of 2200	1828	86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe	un804912.exe
PID 2200 wrote to memory of 1796	2200	un804912.exe	pro9794.exe
PID 2200 wrote to memory of 1796	2200	un804912.exe	pro9794.exe
PID 2200 wrote to memory of 1796	2200	un804912.exe	pro9794.exe
PID 2200 wrote to memory of 2180	2200	un804912.exe	qu6922.exe
PID 2200 wrote to memory of 2180	2200	un804912.exe	qu6922.exe
PID 2200 wrote to memory of 2180	2200	un804912.exe	qu6922.exe

C:\Users\Admin\AppData\Local\Temp\86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe
"C:\Users\Admin\AppData\Local\Temp\86f4ce15715206a6d0c91cfe798e539a98417b76fbc58970413c19d9a7812d37.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un804912.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un804912.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9794.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9794.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1076
4⤵
- Program crash
PID:4400

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6922.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6922.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1796 -ip 1796
1⤵
PID:3588

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:6084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un804912.exe

Filesize
517KB

MD5
0b7396f45613b185fafaa4fe411e13c1

SHA1
ca42bc27b303af37dafbf28bc0740bc23605bfe0

SHA256
52a1a36788fda883c28085c2907a5518a6171f6cefc13ac8dfdcb51dcc5de496

SHA512
9effa0a683a6fb0c2121af47223ca57742b3e9285829221ee835a79ae4791ca2e483d1e2d23d093eaeb5112dd908d8a24c9e1ec2373bfdee7d809cb315a34ff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9794.exe

Filesize
295KB

MD5
da7fa276b88f9c0eb4dd12ab54d7b05c

SHA1
6171f32efa12ed35f231bdd22b70ac6c96ff61ca

SHA256
d9e322d7d417e31787e96bdd5de0de37e69912ae7d7babd10159b3a66997f0f2

SHA512
c37a3a3c6511de3b26c25031232582d71b5bea00eb2f0816eb09aed53fabeb989221ac2bdcfbfaca5bdfe36b649acbd8560bdeb8cca07fbcaaab2422ef18990b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6922.exe

Filesize
354KB

MD5
207cffc155f4cfa45e16ee06dd9878b7

SHA1
944f57d0ff2a1d5bc2d6f1cd5c7e8afac38c8b2e

SHA256
ed12ce551d7bd04be71e5e85ea07e6fbd4f54b22e68a7d11700ed6886fea77cf

SHA512
2c76e955062f9082f56a0a41eabd1c65ed610d37062bb5eea7ffeab79a4e3bc5e035c5ba4c7a6817e638a0b66a83454fd8f0342ee264946f898a1ce6f308986c

Download Submit
memory/1796-15-0x0000000002DC0000-0x0000000002EC0000-memory.dmp

Filesize
1024KB

Download
memory/1796-16-0x0000000002D10000-0x0000000002D3D000-memory.dmp

Filesize
180KB

Download
memory/1796-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1796-18-0x0000000004A30000-0x0000000004A4A000-memory.dmp

Filesize
104KB

Download
memory/1796-19-0x0000000007360000-0x0000000007904000-memory.dmp

Filesize
5.6MB

Download
memory/1796-20-0x0000000004B30000-0x0000000004B48000-memory.dmp

Filesize
96KB

Download
memory/1796-21-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-48-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-46-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-44-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-42-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-40-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-38-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-36-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-34-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-32-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-30-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-28-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-26-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-24-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-22-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1796-49-0x0000000002DC0000-0x0000000002EC0000-memory.dmp

Filesize
1024KB

Download
memory/1796-50-0x0000000002D10000-0x0000000002D3D000-memory.dmp

Filesize
180KB

Download
memory/1796-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1796-51-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/1796-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1796-54-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/2180-60-0x0000000004950000-0x0000000004996000-memory.dmp

Filesize
280KB

Download
memory/2180-61-0x0000000004B60000-0x0000000004BA4000-memory.dmp

Filesize
272KB

Download
memory/2180-79-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-63-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-62-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-95-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-93-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-91-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-89-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-87-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-85-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-83-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-81-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-77-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-75-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-73-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-71-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-69-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-67-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-65-0x0000000004B60000-0x0000000004B9F000-memory.dmp

Filesize
252KB

Download
memory/2180-968-0x00000000078E0000-0x0000000007EF8000-memory.dmp

Filesize
6.1MB

Download
memory/2180-969-0x0000000007F00000-0x000000000800A000-memory.dmp

Filesize
1.0MB

Download
memory/2180-970-0x00000000072B0000-0x00000000072C2000-memory.dmp

Filesize
72KB

Download
memory/2180-971-0x00000000072D0000-0x000000000730C000-memory.dmp

Filesize
240KB

Download
memory/2180-972-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download