healer | 2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe
Size

687KB
MD5

b2a1b982ac536c1ec09e640430c8a2b8
SHA1

9fe2c70fd4b46e0907ec71bd085f7f6e06f91eba
SHA256

2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9
SHA512

8deab405a896ead4c91de13fd4b82ac356051db136bbf4bb3cc6e79c49a1531b869d054670ad4baa21de8f378bdbfb435f23d672edf5ab1a07eda4f12a8dbce6
SSDEEP

12288:0Mrmy90zz4fQ9VsKBdYhXJVy5tDLZ5t49KyF4PwOUVUwU8MWBzmXcm33KM/:iyGPTsKBdYhZcLy9KyFOOVUwYWBzmX9P

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4696-18-0x0000000004920000-0x000000000493A000-memory.dmp	healer
behavioral1/memory/4696-20-0x0000000007260000-0x0000000007278000-memory.dmp	healer
behavioral1/memory/4696-22-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-36-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-48-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-46-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-44-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-42-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-24-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-40-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-38-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-34-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-32-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-30-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-28-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-26-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/4696-21-0x0000000007260000-0x0000000007272000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro2793.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2793.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2793.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4792-60-0x0000000004890000-0x00000000048D6000-memory.dmp	family_redline
behavioral1/memory/4792-61-0x0000000007180000-0x00000000071C4000-memory.dmp	family_redline
behavioral1/memory/4792-89-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-93-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-92-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-83-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-81-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-79-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-77-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-96-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-87-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-85-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-75-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-73-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-71-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-69-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-67-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-65-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-63-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/4792-62-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un910846.exepro2793.exequ6007.exe

pid process

680 un910846.exe
4696 pro2793.exe
4792 qu6007.exe

pid	process
680	un910846.exe
4696	pro2793.exe
4792	qu6007.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro2793.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2793.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2793.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exeun910846.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un910846.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3464 4696 WerFault.exe pro2793.exe

pid	pid_target	process	target process
3464	4696	WerFault.exe	pro2793.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exeun910846.exepro2793.exequ6007.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un910846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro2793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu6007.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro2793.exe

pid process

4696 pro2793.exe
4696 pro2793.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro2793.exequ6007.exe

description pid process

Token: SeDebugPrivilege 4696 pro2793.exe
Token: SeDebugPrivilege 4792 qu6007.exe

pid	process
4696	pro2793.exe
4696	pro2793.exe

description	pid	process
Token: SeDebugPrivilege	4696	pro2793.exe
Token: SeDebugPrivilege	4792	qu6007.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exeun910846.exe

description	pid	process	target process
PID 4808 wrote to memory of 680	4808	2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe	un910846.exe
PID 4808 wrote to memory of 680	4808	2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe	un910846.exe
PID 4808 wrote to memory of 680	4808	2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe	un910846.exe
PID 680 wrote to memory of 4696	680	un910846.exe	pro2793.exe
PID 680 wrote to memory of 4696	680	un910846.exe	pro2793.exe
PID 680 wrote to memory of 4696	680	un910846.exe	pro2793.exe
PID 680 wrote to memory of 4792	680	un910846.exe	qu6007.exe
PID 680 wrote to memory of 4792	680	un910846.exe	qu6007.exe
PID 680 wrote to memory of 4792	680	un910846.exe	qu6007.exe

C:\Users\Admin\AppData\Local\Temp\2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe
"C:\Users\Admin\AppData\Local\Temp\2c8b7fe8d3aec78780aea43008dd4b43ce8a1c2b076e54ccd87aface193949b9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un910846.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un910846.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:680

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2793.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2793.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1084
4⤵
- Program crash
PID:3464

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6007.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6007.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4696 -ip 4696
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un910846.exe

Filesize
545KB

MD5
58def2fe0647bce716bc527f128c3d41

SHA1
18d88ea6760034e467d8b382f53121603a955880

SHA256
aeeb920c66572674415a5b2c944ab5ff7ec2da72f888589f5fb0440785986966

SHA512
5e47a93502092158d44ad48b3ef290ee93d0624209420cf83c86714fd4182b82688b2bb53fe8f8d60f6d69479f2752ef649a3e445ce5546242bc3428fc2fc253

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2793.exe

Filesize
321KB

MD5
7f07433c7356cd6c8a874fa2390ef217

SHA1
6179ed60e0659f92015a175c2eabcc26ff452a52

SHA256
2c33c0f3d7711aa8758a47b943d23b5d7941fef2261b390fdd98e1d648a4dfc8

SHA512
486bfacf6587bf6faa959b11bad56c68f43be0c627e85580ce1ba08774b0d50ff0b7d8d0f8f1cd1c285b6289f78909fb325cf5f6daca2e194ed3698d6acc8b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6007.exe

Filesize
380KB

MD5
f7724f73ff415effb2de001bab7e0050

SHA1
437fb4c568143a22a0d633b54ecb8bf3cb691fe6

SHA256
06ed12cbc4d5eda40f7fbfceffaf8d20c458d195f888f5cc5fedf4afc48c456b

SHA512
425d0cb87952d4c5f617656858008319a3c95497fd740b5f8a86f4a2418cb1e6384c99a65b4ef1bb22377d1438a7859cb5201dc50b5238abd5989dcb7c02cf75

Download Submit
memory/4696-15-0x0000000002C40000-0x0000000002D40000-memory.dmp

Filesize
1024KB

Download
memory/4696-16-0x0000000002B90000-0x0000000002BBD000-memory.dmp

Filesize
180KB

Download
memory/4696-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4696-18-0x0000000004920000-0x000000000493A000-memory.dmp

Filesize
104KB

Download
memory/4696-19-0x0000000007430000-0x00000000079D4000-memory.dmp

Filesize
5.6MB

Download
memory/4696-20-0x0000000007260000-0x0000000007278000-memory.dmp

Filesize
96KB

Download
memory/4696-22-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-36-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-48-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-46-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-44-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-42-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-24-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-40-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-38-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-34-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-32-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-30-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-28-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-26-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-21-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/4696-49-0x0000000002C40000-0x0000000002D40000-memory.dmp

Filesize
1024KB

Download
memory/4696-51-0x0000000002B90000-0x0000000002BBD000-memory.dmp

Filesize
180KB

Download
memory/4696-50-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4696-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4696-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4696-54-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4792-60-0x0000000004890000-0x00000000048D6000-memory.dmp

Filesize
280KB

Download
memory/4792-61-0x0000000007180000-0x00000000071C4000-memory.dmp

Filesize
272KB

Download
memory/4792-89-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-93-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-92-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-83-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-81-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-79-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-77-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-96-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-87-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-85-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-75-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-73-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-71-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-69-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-67-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-65-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-63-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-62-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/4792-968-0x0000000007870000-0x0000000007E88000-memory.dmp

Filesize
6.1MB

Download
memory/4792-969-0x0000000007E90000-0x0000000007F9A000-memory.dmp

Filesize
1.0MB

Download
memory/4792-970-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/4792-971-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

Filesize
240KB

Download
memory/4792-972-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download