healer | 7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe
Size

660KB
MD5

e9edba9c61b8b3f3f49e2f6d285ffd42
SHA1

ae6c8ef9be50eeed1d53ee2c4e7809ed38742d0a
SHA256

7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3
SHA512

324d2d74cf39c8fdb5f5a6c69baf77cf637bea1c4d077763bcb55f0ce0835ba0c3f6883a3ba3e2678114cbdee9675713a634ea3aaeaaf66c4f3acf44d0c44834
SSDEEP

12288:HMrUy90kmaxbiQQFT2JCAIXCxpRft5SqN2iLN4:jyNmaxuQQFjbX8ft5S2ta

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3760-19-0x00000000022C0000-0x00000000022DA000-memory.dmp	healer
behavioral1/memory/3760-21-0x0000000004A40000-0x0000000004A58000-memory.dmp	healer
behavioral1/memory/3760-49-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-47-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-45-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-43-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-41-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-40-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-37-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-35-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-33-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-31-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-29-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-27-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-25-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-23-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/3760-22-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6911.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6911.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6911.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6911.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6911.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6911.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4656-61-0x0000000002540000-0x0000000002586000-memory.dmp	family_redline
behavioral1/memory/4656-62-0x0000000005070000-0x00000000050B4000-memory.dmp	family_redline
behavioral1/memory/4656-68-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-76-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-96-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-95-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-90-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-88-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-87-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-82-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-80-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-78-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-74-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-72-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-70-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-92-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-84-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-66-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-64-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/4656-63-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2756	un425802.exe
3760	pro6911.exe
4656	qu3019.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6911.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6911.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un425802.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	3760	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro6911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu3019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un425802.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3760	pro6911.exe
3760	pro6911.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	pro6911.exe
Token: SeDebugPrivilege	4656	qu3019.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2756	5080	7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe	83
PID 5080 wrote to memory of 2756	5080	7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe	83
PID 5080 wrote to memory of 2756	5080	7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe	83
PID 2756 wrote to memory of 3760	2756	un425802.exe	84
PID 2756 wrote to memory of 3760	2756	un425802.exe	84
PID 2756 wrote to memory of 3760	2756	un425802.exe	84
PID 2756 wrote to memory of 4656	2756	un425802.exe	98
PID 2756 wrote to memory of 4656	2756	un425802.exe	98
PID 2756 wrote to memory of 4656	2756	un425802.exe	98

C:\Users\Admin\AppData\Local\Temp\7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe
"C:\Users\Admin\AppData\Local\Temp\7d88bc4ace371da935e54690b5dcb5fad95c09346c7cbbb0d1dc65327589e0d3.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un425802.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un425802.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6911.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6911.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1004
      4⤵
      Program crash
      PID:2268
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3019.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3019.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3760 -ip 3760
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un425802.exe

Filesize
518KB

MD5
522715a2aac62258df5cf4f3e55d12a8

SHA1
a222c5b8d8c48b103b78cbc244920c18f94e7fa3

SHA256
e80a460513a0f9b629b649088eeba3a2a3e67919680d46d347170caa89f629ac

SHA512
0fb59619d9c9daa61f8936d1077313c53a4db2bde6a2958728d0d43d1ace0734e366ea17a1ca2bce10b87fba3697ad6c0423f911252e32304691f4ee475562ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6911.exe

Filesize
237KB

MD5
a4e255887b019523e351bef8edacd075

SHA1
d49a80bd7c69a25d05a0d48d06f64fec505e6c8a

SHA256
edfc9ee79047ea1cd9c7804af2779892113e3f7ecc02eb800b148d19a8603e0f

SHA512
5523c3fa499cccc1bde0dd428232b3c5f1f2f59df093ceb4848b6fd423148d1907692987f18112a6e19c9241d5ae90ffa5c51a2ec6a2635de922e8c7a489b763

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3019.exe

Filesize
295KB

MD5
a47b3e2ec9e2b8be9d1bd3fd02a82b39

SHA1
ac37e923fcc1242e2de4e9676840eecd3de7ff94

SHA256
48aec32d469fcc8599e7f84931f9cff833bd2da421f4ad7faa00c736957c253b

SHA512
be91584e8de38d4608840190f88f6c715e4ab24ba91d17834f2e85595b95dcbc998fdd85b4fafb09045c967988a0edae1ee40aed63a10fe1715f79c017ee986f

Download Submit
memory/3760-15-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/3760-16-0x00000000020E0000-0x000000000210D000-memory.dmp

Filesize
180KB

Download
memory/3760-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3760-18-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3760-19-0x00000000022C0000-0x00000000022DA000-memory.dmp

Filesize
104KB

Download
memory/3760-20-0x0000000004B50000-0x00000000050F4000-memory.dmp

Filesize
5.6MB

Download
memory/3760-21-0x0000000004A40000-0x0000000004A58000-memory.dmp

Filesize
96KB

Download
memory/3760-49-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-47-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-45-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-43-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-41-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-40-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-37-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-35-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-33-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-31-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-29-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-27-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-25-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-23-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-22-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/3760-50-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/3760-51-0x00000000020E0000-0x000000000210D000-memory.dmp

Filesize
180KB

Download
memory/3760-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3760-55-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3760-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4656-61-0x0000000002540000-0x0000000002586000-memory.dmp

Filesize
280KB

Download
memory/4656-62-0x0000000005070000-0x00000000050B4000-memory.dmp

Filesize
272KB

Download
memory/4656-68-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-76-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-96-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-95-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-90-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-88-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-87-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-82-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-80-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-78-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-74-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-72-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-70-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-92-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-84-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-66-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-64-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-63-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/4656-969-0x00000000050F0000-0x0000000005708000-memory.dmp

Filesize
6.1MB

Download
memory/4656-970-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/4656-971-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/4656-972-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/4656-973-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download