healer | 5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe
Size

657KB
MD5

e3bf750c92b72ee912ab82a178f14bb7
SHA1

47d9aa79980cf9c7a00f8fa42ad7f789161e713f
SHA256

5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b
SHA512

e6e76521796de8824863a7313dfc9ce85853f4a671d7106f067b82ca9da32412215cae0a466097173fc0b0bf4fdf241d49733ed690d0177f6621be6787659eb8
SSDEEP

12288:TMrhy90/WgEKV07CgCI3gLhZORibYep9Ye6xLbsjGDVHp4VlP71:eyPKCebxLRDkLbIeVJ4Vlx

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2912-15-0x0000000004BD0000-0x0000000004BEA000-memory.dmp	healer
behavioral1/memory/2912-17-0x0000000004DB0000-0x0000000004DC8000-memory.dmp	healer
behavioral1/memory/2912-46-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-44-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-42-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-40-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-39-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-36-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-35-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-32-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-30-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-28-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-26-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-24-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-23-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-19-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/2912-20-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro0793.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro0793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro0793.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro0793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro0793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro0793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro0793.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1456-55-0x0000000004A00000-0x0000000004A46000-memory.dmp	family_redline
behavioral1/memory/1456-56-0x0000000007770000-0x00000000077B4000-memory.dmp	family_redline
behavioral1/memory/1456-78-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-90-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-88-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-86-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-84-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-82-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-80-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-76-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-75-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-72-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-70-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-69-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-66-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-64-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-62-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-60-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-58-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline
behavioral1/memory/1456-57-0x0000000007770000-0x00000000077AF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un082382.exepro0793.exequ2029.exe

pid process

2016 un082382.exe
2912 pro0793.exe
1456 qu2029.exe

pid	process
2016	un082382.exe
2912	pro0793.exe
1456	qu2029.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro0793.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro0793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro0793.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exeun082382.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un082382.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1124 2912 WerFault.exe pro0793.exe

pid	pid_target	process	target process
1124	2912	WerFault.exe	pro0793.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

qu2029.exe5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exeun082382.exepro0793.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu2029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un082382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro0793.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro0793.exe

pid process

2912 pro0793.exe
2912 pro0793.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro0793.exequ2029.exe

description pid process

Token: SeDebugPrivilege 2912 pro0793.exe
Token: SeDebugPrivilege 1456 qu2029.exe

pid	process
2912	pro0793.exe
2912	pro0793.exe

description	pid	process
Token: SeDebugPrivilege	2912	pro0793.exe
Token: SeDebugPrivilege	1456	qu2029.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exeun082382.exe

description	pid	process	target process
PID 1780 wrote to memory of 2016	1780	5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe	un082382.exe
PID 1780 wrote to memory of 2016	1780	5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe	un082382.exe
PID 1780 wrote to memory of 2016	1780	5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe	un082382.exe
PID 2016 wrote to memory of 2912	2016	un082382.exe	pro0793.exe
PID 2016 wrote to memory of 2912	2016	un082382.exe	pro0793.exe
PID 2016 wrote to memory of 2912	2016	un082382.exe	pro0793.exe
PID 2016 wrote to memory of 1456	2016	un082382.exe	qu2029.exe
PID 2016 wrote to memory of 1456	2016	un082382.exe	qu2029.exe
PID 2016 wrote to memory of 1456	2016	un082382.exe	qu2029.exe

C:\Users\Admin\AppData\Local\Temp\5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe
"C:\Users\Admin\AppData\Local\Temp\5b796031794cc0471fc2316105b3469408550a14b85c8ce740ee62919917d20b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un082382.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un082382.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0793.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0793.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1084
4⤵
- Program crash
PID:1124

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2029.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2029.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2912 -ip 2912
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un082382.exe

Filesize
515KB

MD5
393678a238e2566d4736aea523da6fbf

SHA1
90b750920728e468ea5e16e54c86cb33451ffd19

SHA256
c9fe732bdaa6231ff329353c7bf2a565f9172a940f38053810aedbb69c2e7376

SHA512
64eaead19ce2fa5be528a2cceea035d6c558e115fe64a6b1efa432ea3971c74a267892955165ce5c4c7ea078eeb6e6fcecffb25506f65b16d410b43c248cbf23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0793.exe

Filesize
284KB

MD5
c1c06f59dde4c6bc17bd0b8d4c5216df

SHA1
890863afc9c7cb5c4c26a02de1a1ab13d1df246d

SHA256
0ff525f75b1e36c4bb24b7446689de6a47a4f60dd761ae63482de9f00506f34d

SHA512
11a1ca4bbb5183c503ec8cd3c671d7322cdcf7bb794a82075bf6874d8898271cc78915d6b8785a63f8c174b6b5ca329a0a5ddc68dbd508bab0950da5d42b68f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2029.exe

Filesize
342KB

MD5
cfc2894e36aa1e2ba865c7a0ee566518

SHA1
cf5998d77bae1523b35052d19580610c889e001c

SHA256
042b631fbb415efde286d682be7dc017def67a565ef03e1e3f6e57b7678660e0

SHA512
0088f75a2b01d373e2cf38787039d7c23a46711fdc8e6109126fc175c6e2d13c71bc808861de901fa0ff65bb615feb1d994f198c836487b487deeec73052a3b6

Download Submit
memory/1456-70-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-69-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-967-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download
memory/1456-78-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-965-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/1456-964-0x0000000007E60000-0x0000000007F6A000-memory.dmp

Filesize
1.0MB

Download
memory/1456-963-0x00000000077C0000-0x0000000007DD8000-memory.dmp

Filesize
6.1MB

Download
memory/1456-57-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-58-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-60-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-62-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-64-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-66-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-72-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-75-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-76-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-56-0x0000000007770000-0x00000000077B4000-memory.dmp

Filesize
272KB

Download
memory/1456-80-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-82-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-84-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-86-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-55-0x0000000004A00000-0x0000000004A46000-memory.dmp

Filesize
280KB

Download
memory/1456-90-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/1456-966-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

Filesize
240KB

Download
memory/1456-88-0x0000000007770000-0x00000000077AF000-memory.dmp

Filesize
252KB

Download
memory/2912-16-0x0000000007270000-0x0000000007814000-memory.dmp

Filesize
5.6MB

Download
memory/2912-20-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-19-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-32-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-26-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-23-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-24-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-30-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-15-0x0000000004BD0000-0x0000000004BEA000-memory.dmp

Filesize
104KB

Download
memory/2912-18-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/2912-50-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/2912-28-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-47-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/2912-35-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-36-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-39-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-40-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-42-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-44-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-46-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/2912-17-0x0000000004DB0000-0x0000000004DC8000-memory.dmp

Filesize
96KB

Download