healer | 76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe
Size

690KB
MD5

308576662f170316f089df9c66ad5faf
SHA1

ed00c085862e96b63cb820bc018f7dba57040902
SHA256

76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268
SHA512

39bbdde0757645d9b2da1ce0b6e8f6b6863abe512229fe357d2ea7258d771084964480b353c4816588db90ede4646c4738ecde40f6652a020a14183d720733b8
SSDEEP

12288:dMroy90e8JpqR9eSh2QYF16oD5KtTa8aAYo/A/iO37vBvvFr7figcbnXl9XA:tyaqh2tD4mFiO37pFr7agcXPQ

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4796-19-0x0000000002630000-0x000000000264A000-memory.dmp	healer
behavioral1/memory/4796-21-0x00000000027A0000-0x00000000027B8000-memory.dmp	healer
behavioral1/memory/4796-23-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-49-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-47-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-45-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-43-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-41-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-39-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-37-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-35-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-33-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-31-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-29-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-27-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-25-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer
behavioral1/memory/4796-22-0x00000000027A0000-0x00000000027B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro8963.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro8963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro8963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro8963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro8963.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro8963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro8963.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4016-61-0x0000000003970000-0x00000000039B6000-memory.dmp	family_redline
behavioral1/memory/4016-62-0x0000000006030000-0x0000000006074000-memory.dmp	family_redline
behavioral1/memory/4016-74-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-72-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-96-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-95-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-90-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-88-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-86-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-84-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-82-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-80-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-78-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-76-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-70-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-92-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-68-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-66-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-64-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline
behavioral1/memory/4016-63-0x0000000006030000-0x000000000606F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un214176.exepro8963.exequ2980.exe

pid process

3276 un214176.exe
4796 pro8963.exe
4016 qu2980.exe

pid	process
3276	un214176.exe
4796	pro8963.exe
4016	qu2980.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro8963.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro8963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro8963.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exeun214176.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un214176.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1396 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5080 4796 WerFault.exe pro8963.exe

pid	process
1396	sc.exe

pid	pid_target	process	target process
5080	4796	WerFault.exe	pro8963.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exeun214176.exepro8963.exequ2980.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un214176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro8963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu2980.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro8963.exe

pid process

4796 pro8963.exe
4796 pro8963.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro8963.exequ2980.exe

description pid process

Token: SeDebugPrivilege 4796 pro8963.exe
Token: SeDebugPrivilege 4016 qu2980.exe

pid	process
4796	pro8963.exe
4796	pro8963.exe

description	pid	process
Token: SeDebugPrivilege	4796	pro8963.exe
Token: SeDebugPrivilege	4016	qu2980.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exeun214176.exe

description	pid	process	target process
PID 5060 wrote to memory of 3276	5060	76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe	un214176.exe
PID 5060 wrote to memory of 3276	5060	76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe	un214176.exe
PID 5060 wrote to memory of 3276	5060	76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe	un214176.exe
PID 3276 wrote to memory of 4796	3276	un214176.exe	pro8963.exe
PID 3276 wrote to memory of 4796	3276	un214176.exe	pro8963.exe
PID 3276 wrote to memory of 4796	3276	un214176.exe	pro8963.exe
PID 3276 wrote to memory of 4016	3276	un214176.exe	qu2980.exe
PID 3276 wrote to memory of 4016	3276	un214176.exe	qu2980.exe
PID 3276 wrote to memory of 4016	3276	un214176.exe	qu2980.exe

C:\Users\Admin\AppData\Local\Temp\76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe
"C:\Users\Admin\AppData\Local\Temp\76dc1d69b79021f79d567ae5345240fdd88fda1b16b068a4d6e3d3b9fde91268.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un214176.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un214176.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8963.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8963.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1080
4⤵
- Program crash
PID:5080

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2980.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2980.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4796 -ip 4796
1⤵
PID:2484

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un214176.exe

Filesize
548KB

MD5
ab0dd1d39727a4d3456e5f7bcc7294b6

SHA1
1b6a21e0ef35ed62ab99c186f5311bd54cdbb188

SHA256
6439024b93ac10eceaf4526a7471c251eb01f91301f296d3daad2371d657932d

SHA512
36cef925a79128c7580d7275a75d4bd344bd3c3339e20834ffb062dacdf906c54a6ddb7e4fca52a987076614f064a3bd96d0d7b78925b2556a8b0d85dd9ff8ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8963.exe

Filesize
291KB

MD5
9f568b149f3f013e1b9cd0208bb9c7cf

SHA1
6afe2ecf55d33a18619ccbef5cd3689f36784464

SHA256
161e74dcccf245b79a47153875c8b941ac451ac7fbdae762d281c22e67a4c5cc

SHA512
fbaddc009d2474913d97b91f84bf733a30a66bfda2b9a45350e356b35a6d87c1a0574f9a7de44eaa79663c284ed5e4cdd31f2a5de732afd3c09aee3b3a1cea1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2980.exe

Filesize
345KB

MD5
9da8b40e90afbcaff05f8c2f896a4b17

SHA1
f933b9b956791ee1f1931f5d115f76c50544550b

SHA256
809e8c8355e424a36585748d79fd59d1fdfaf43bec22c2601f74b22206cfaebc

SHA512
1141c83a757dfa6181c34b40151daf0788be5e9708c0ef0e313ad43ebf7e6d55bf38f105a73921ce9324e3a4fc92b51de7a3c197b5dc65c48c9cd5360eb3d8d7

Download Submit
memory/4016-76-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-80-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-971-0x0000000006E40000-0x0000000006E52000-memory.dmp

Filesize
72KB

Download
memory/4016-969-0x00000000066F0000-0x0000000006D08000-memory.dmp

Filesize
6.1MB

Download
memory/4016-63-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-64-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-66-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-68-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-92-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-70-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-972-0x0000000006E60000-0x0000000006E9C000-memory.dmp

Filesize
240KB

Download
memory/4016-973-0x0000000006FB0000-0x0000000006FFC000-memory.dmp

Filesize
304KB

Download
memory/4016-78-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-970-0x0000000006D10000-0x0000000006E1A000-memory.dmp

Filesize
1.0MB

Download
memory/4016-82-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-84-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-86-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-88-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-90-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-95-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-96-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-72-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-74-0x0000000006030000-0x000000000606F000-memory.dmp

Filesize
252KB

Download
memory/4016-62-0x0000000006030000-0x0000000006074000-memory.dmp

Filesize
272KB

Download
memory/4016-61-0x0000000003970000-0x00000000039B6000-memory.dmp

Filesize
280KB

Download
memory/4796-43-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-55-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/4796-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4796-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4796-51-0x0000000000800000-0x000000000082D000-memory.dmp

Filesize
180KB

Download
memory/4796-50-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/4796-22-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-25-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-27-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-29-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-31-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-33-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-35-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-37-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-39-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-41-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-45-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-47-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-49-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-23-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/4796-21-0x00000000027A0000-0x00000000027B8000-memory.dmp

Filesize
96KB

Download
memory/4796-20-0x0000000004FC0000-0x0000000005564000-memory.dmp

Filesize
5.6MB

Download
memory/4796-19-0x0000000002630000-0x000000000264A000-memory.dmp

Filesize
104KB

Download
memory/4796-18-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/4796-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4796-16-0x0000000000800000-0x000000000082D000-memory.dmp

Filesize
180KB

Download
memory/4796-15-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download