healer | b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe
Size

667KB
MD5

760b21975bd47f04402164965bf3fdd4
SHA1

cb16e736994704f14ba7c1fbe3aa36a9dc6ff624
SHA256

b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4
SHA512

88e808766b0a7c53cedd743a1b4200e48cb9d959121b61f8c6d5c8662d914905c857b8439f38e27954746acfeaf36e1001c8f4ab3cecd109b53d83a117623530
SSDEEP

12288:pMrwy901SnvrhgMVGTlUHI8H93iKxslk4t1JtbFqwk4u2cgNBR01SI:hyPuOICMk4HJtbUHVgNBR01SI

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4248-19-0x0000000002710000-0x000000000272A000-memory.dmp	healer
behavioral1/memory/4248-21-0x0000000005490000-0x00000000054A8000-memory.dmp	healer
behavioral1/memory/4248-35-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-49-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-47-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-45-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-43-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-41-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-40-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-37-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-33-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-31-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-30-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-27-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-25-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-23-0x0000000005490000-0x00000000054A2000-memory.dmp	healer
behavioral1/memory/4248-22-0x0000000005490000-0x00000000054A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro2344.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2344.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2344.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2344.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2344.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2344.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2344.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/632-60-0x0000000002790000-0x00000000027D6000-memory.dmp	family_redline
behavioral1/memory/632-61-0x0000000005430000-0x0000000005474000-memory.dmp	family_redline
behavioral1/memory/632-87-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-95-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-93-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-91-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-89-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-85-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-83-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-81-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-79-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-77-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-75-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-73-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-71-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-69-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-67-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-65-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-63-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline
behavioral1/memory/632-62-0x0000000005430000-0x000000000546F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un260942.exepro2344.exequ5603.exe

pid process

216 un260942.exe
4248 pro2344.exe
632 qu5603.exe

pid	process
216	un260942.exe
4248	pro2344.exe
632	qu5603.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro2344.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2344.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2344.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exeun260942.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un260942.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1248 4248 WerFault.exe pro2344.exe

pid	pid_target	process	target process
1248	4248	WerFault.exe	pro2344.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exeun260942.exepro2344.exequ5603.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un260942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro2344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu5603.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro2344.exe

pid process

4248 pro2344.exe
4248 pro2344.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro2344.exequ5603.exe

description pid process

Token: SeDebugPrivilege 4248 pro2344.exe
Token: SeDebugPrivilege 632 qu5603.exe

pid	process
4248	pro2344.exe
4248	pro2344.exe

description	pid	process
Token: SeDebugPrivilege	4248	pro2344.exe
Token: SeDebugPrivilege	632	qu5603.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exeun260942.exe

description	pid	process	target process
PID 2064 wrote to memory of 216	2064	b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe	un260942.exe
PID 2064 wrote to memory of 216	2064	b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe	un260942.exe
PID 2064 wrote to memory of 216	2064	b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe	un260942.exe
PID 216 wrote to memory of 4248	216	un260942.exe	pro2344.exe
PID 216 wrote to memory of 4248	216	un260942.exe	pro2344.exe
PID 216 wrote to memory of 4248	216	un260942.exe	pro2344.exe
PID 216 wrote to memory of 632	216	un260942.exe	qu5603.exe
PID 216 wrote to memory of 632	216	un260942.exe	qu5603.exe
PID 216 wrote to memory of 632	216	un260942.exe	qu5603.exe

C:\Users\Admin\AppData\Local\Temp\b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe
"C:\Users\Admin\AppData\Local\Temp\b8721cef3f7834a321f2f020b22103cc18a22ef2f17cbb312f1b2d7b8bb1b4c4.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un260942.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un260942.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:216

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2344.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2344.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1088
4⤵
- Program crash
PID:1248

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5603.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5603.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4248 -ip 4248
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un260942.exe

Filesize
524KB

MD5
aff62f2c701f6765ab8abd64b5119fcd

SHA1
62e01535798f9946c98e3d4ef5c2e876db6b3607

SHA256
10bff7ca7a29c6b682f02fc893a78ecef9afef0a8e35e3c6def8d27603721370

SHA512
2fc03ae84f077850421d62e0a242a1ad0fdbe0cf7b6e92c237b909c682b366fe2d5571ab3945e411ec494314ac18b00f6793fb723a8fea6036d8a5989aa3dc06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2344.exe

Filesize
295KB

MD5
92cdc2d32ff9bdc80e71405f0a1d941e

SHA1
615208b39bb6bf800853016dd8852551ff824856

SHA256
588bd54bb82a2b3ab96317fc215a47a6f5e133dda659274310904eb25204d9bd

SHA512
a54babc0e7d2e251bf2557d2c97904aabfb93fa3bb45b77633fdd2ae13222d5a632d4fa6860153499c8ef026d9ccc543cc3d6c6605ac26cd511197c2f05fa9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5603.exe

Filesize
353KB

MD5
3fb9d8d04335bc0169bd3f001f2b4e4e

SHA1
80bae56dc26f028739f694d1baffa9f447ea5111

SHA256
380dfea8f7eff620a5cc15f0f195e53b4833757073865b332621668580c4f2ba

SHA512
f736b6343e5707a1a55076cbd6c66e45b3e867a0425e0a6bfdb9dfad471a3d67ba68d690f342c37df2f637b0e91e56007a80ec7d0af9f81da2ae77839e3adb03

Download Submit
memory/632-73-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-77-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-969-0x0000000005C20000-0x0000000005D2A000-memory.dmp

Filesize
1.0MB

Download
memory/632-968-0x00000000055B0000-0x0000000005BC8000-memory.dmp

Filesize
6.1MB

Download
memory/632-62-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-63-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-65-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-67-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-69-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-71-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-971-0x0000000005D80000-0x0000000005DBC000-memory.dmp

Filesize
240KB

Download
memory/632-972-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Filesize
304KB

Download
memory/632-75-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-970-0x0000000005D60000-0x0000000005D72000-memory.dmp

Filesize
72KB

Download
memory/632-79-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-81-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-83-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-85-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-89-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-91-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-93-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-95-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-87-0x0000000005430000-0x000000000546F000-memory.dmp

Filesize
252KB

Download
memory/632-61-0x0000000005430000-0x0000000005474000-memory.dmp

Filesize
272KB

Download
memory/632-60-0x0000000002790000-0x00000000027D6000-memory.dmp

Filesize
280KB

Download
memory/4248-43-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4248-54-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4248-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4248-50-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download
memory/4248-22-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-23-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-25-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-27-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-30-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-31-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-33-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-37-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-40-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-41-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-45-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-47-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-49-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-35-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/4248-21-0x0000000005490000-0x00000000054A8000-memory.dmp

Filesize
96KB

Download
memory/4248-20-0x0000000004EA0000-0x0000000005444000-memory.dmp

Filesize
5.6MB

Download
memory/4248-19-0x0000000002710000-0x000000000272A000-memory.dmp

Filesize
104KB

Download
memory/4248-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4248-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4248-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4248-15-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download