healer | ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe
Size

658KB
MD5

f3e70e106bfcf7df3ce1c008e297e8fe
SHA1

9419740bf4c85cc7517c3c71a5192e8e584849f7
SHA256

ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b
SHA512

b9532697c7864225ba30c865d250be8e6b6a29bc1fa50b5a7e99853d6099cee82f7da5d7eaa464109ffa31331ad3a76cc2777cfae9be6888d076d198c8652525
SSDEEP

12288:JMrYy90tBUKU09K27MiD+Mety+dQJHIAUoF9x644xzWKb78vAIMQGAN:NyuqCtMkmtdO3UoDx74EK0h

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4416-19-0x0000000002280000-0x000000000229A000-memory.dmp	healer
behavioral1/memory/4416-21-0x0000000002440000-0x0000000002458000-memory.dmp	healer
behavioral1/memory/4416-23-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-49-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-48-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-45-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-43-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-41-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-39-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-38-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-35-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-34-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-31-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-29-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-27-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-25-0x0000000002440000-0x0000000002452000-memory.dmp	healer
behavioral1/memory/4416-22-0x0000000002440000-0x0000000002452000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3505.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro3505.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1896-60-0x0000000004A10000-0x0000000004A56000-memory.dmp	family_redline
behavioral1/memory/1896-61-0x0000000004A90000-0x0000000004AD4000-memory.dmp	family_redline
behavioral1/memory/1896-71-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-95-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-94-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-91-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-88-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-85-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-82-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-73-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-69-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-67-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-65-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-63-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/1896-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2864	un765319.exe
4416	pro3505.exe
1896	qu0863.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3505.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un765319.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4000	4416	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un765319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro3505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu0863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4416	pro3505.exe
4416	pro3505.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	pro3505.exe
Token: SeDebugPrivilege	1896	qu0863.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2864	3024	ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe	83
PID 3024 wrote to memory of 2864	3024	ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe	83
PID 3024 wrote to memory of 2864	3024	ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe	83
PID 2864 wrote to memory of 4416	2864	un765319.exe	85
PID 2864 wrote to memory of 4416	2864	un765319.exe	85
PID 2864 wrote to memory of 4416	2864	un765319.exe	85
PID 2864 wrote to memory of 1896	2864	un765319.exe	95
PID 2864 wrote to memory of 1896	2864	un765319.exe	95
PID 2864 wrote to memory of 1896	2864	un765319.exe	95

C:\Users\Admin\AppData\Local\Temp\ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe
"C:\Users\Admin\AppData\Local\Temp\ec7e0be847b78cd2100aa669c004ff7e92d95b20bed8a221b1d3ca14d548227b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un765319.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un765319.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3505.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3505.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 1084
      4⤵
      Program crash
      PID:4000
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0863.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0863.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4416 -ip 4416
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un765319.exe

Filesize
516KB

MD5
21568e6e4f01708bc31205b5ed6cb265

SHA1
fbcdfcceb07549117d2527cd44f6fafcffbd5603

SHA256
054d9505830f500b557ea5ecd8896dab50c409d0c2fdaa01cfad5bff4463d49d

SHA512
3ccc1ae809c97cf4f035729434a9c0e3902b7f552243eecc4a219a2f4c8df709114d37ac37d91ddacc5ae75e36381244f0902300b434d5b0821ad2109dd245ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3505.exe

Filesize
235KB

MD5
0668182b3cfef9c857b382eaede777d3

SHA1
b517788e7cce24005cc4003f7cb4a7499fc61fe0

SHA256
f32b0e000f0554bd9f3938e3862f93fc81e5e77cea3bce082856070a543a9891

SHA512
572e535035622e955f9afad22fb06e2b44ced49779c9c442248daba9cc3f9e772dda14386c4308d0fa8cbad308db078aa84a2baea4e53cdcd90f4890f4a72694

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0863.exe

Filesize
294KB

MD5
5fc5f1e27cd61ca233fdcd5f48ca35dd

SHA1
020a376bfc50aa7c8a89a884d2e23dedd1799d52

SHA256
bb8919ee01155b61bec6db8bac515c460acd0b57b001319cd1d1ea022b3839e9

SHA512
ad8fee1c8aaf209ba14b8a7e4e6fd8c5b0be215ffc8471ff8cf0fdf655e8913c7361ce7be9d011585534485a5ba0f423adce4aef9200d2011b18749a6af6abe0

Download Submit
memory/1896-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-969-0x00000000057B0000-0x00000000058BA000-memory.dmp

Filesize
1.0MB

Download
memory/1896-968-0x0000000005190000-0x00000000057A8000-memory.dmp

Filesize
6.1MB

Download
memory/1896-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-63-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-65-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-67-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-69-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-73-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-971-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/1896-972-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download
memory/1896-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-970-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/1896-82-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-85-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-88-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-91-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-94-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-95-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-71-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/1896-61-0x0000000004A90000-0x0000000004AD4000-memory.dmp

Filesize
272KB

Download
memory/1896-60-0x0000000004A10000-0x0000000004A56000-memory.dmp

Filesize
280KB

Download
memory/4416-43-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4416-54-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4416-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4416-50-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download
memory/4416-22-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-25-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-27-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-29-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-31-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-34-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-35-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-38-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-39-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-41-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-45-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-48-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-49-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-23-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/4416-21-0x0000000002440000-0x0000000002458000-memory.dmp

Filesize
96KB

Download
memory/4416-20-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download
memory/4416-19-0x0000000002280000-0x000000000229A000-memory.dmp

Filesize
104KB

Download
memory/4416-18-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4416-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4416-17-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4416-15-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download