healer | fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe
Size

689KB
MD5

24d1004bb0145fc4c68eccdc75731ed9
SHA1

32fa42933e89956679dd684eb92dd3c0a3bfce3e
SHA256

fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5
SHA512

c06b4ad8ac1d853092cd77ddcf2c8c7ddb0beeae4c35ca01cd45377c7475855725170d9278d4090e1732f81367c030beb2d5b58d81968718559096d9ce78334e
SSDEEP

12288:hMrjy90CdGC1i3+VXJrl5DL452rziuOB4+tzhhWT2Ke0lEkgJf:2yRsaRl1LwQzlOB4KhiS0lgf

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3724-19-0x0000000000AC0000-0x0000000000ADA000-memory.dmp	healer
behavioral1/memory/3724-21-0x00000000027E0000-0x00000000027F8000-memory.dmp	healer
behavioral1/memory/3724-49-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-47-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-45-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-43-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-25-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-41-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-40-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-37-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-36-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-33-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-31-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-29-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-27-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-23-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer
behavioral1/memory/3724-22-0x00000000027E0000-0x00000000027F2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3221.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3221.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3221.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3221.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3221.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro3221.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4900-62-0x00000000028E0000-0x0000000002926000-memory.dmp	family_redline
behavioral1/memory/4900-63-0x0000000004E50000-0x0000000004E94000-memory.dmp	family_redline
behavioral1/memory/4900-91-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-95-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-97-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-93-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-89-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-87-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-85-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-83-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-79-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-77-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-75-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-73-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-71-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-81-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-69-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-67-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-65-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4900-64-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3528	un278563.exe
3724	pro3221.exe
4900	qu8580.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3221.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3221.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un278563.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4780	3724	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro3221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu8580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un278563.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3724	pro3221.exe
3724	pro3221.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	pro3221.exe
Token: SeDebugPrivilege	4900	qu8580.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3528	3632	fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe	83
PID 3632 wrote to memory of 3528	3632	fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe	83
PID 3632 wrote to memory of 3528	3632	fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe	83
PID 3528 wrote to memory of 3724	3528	un278563.exe	84
PID 3528 wrote to memory of 3724	3528	un278563.exe	84
PID 3528 wrote to memory of 3724	3528	un278563.exe	84
PID 3528 wrote to memory of 4900	3528	un278563.exe	99
PID 3528 wrote to memory of 4900	3528	un278563.exe	99
PID 3528 wrote to memory of 4900	3528	un278563.exe	99

C:\Users\Admin\AppData\Local\Temp\fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe
"C:\Users\Admin\AppData\Local\Temp\fcdded680b09b65413d3b14abe5b821143d106ef381fb1481c8120420d925cd5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un278563.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un278563.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3221.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3221.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 1088
      4⤵
      Program crash
      PID:4780
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8580.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8580.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3724 -ip 3724
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un278563.exe

Filesize
536KB

MD5
5da8c631d45dfb6d07304b53a163d936

SHA1
23a6ba96cff9b340334174ad3ae4f6707139ad6e

SHA256
364c0f9c6186ccdecf579fab486b199cd3d7926e3867410b20a6e248056093dc

SHA512
aee2f72f2fcf8097127289883d4fa8d537bdb0da392b07734d797598e8ec1114acd7ddb4c3a6481d9c8f63608949b6693edfe97c203b26f617c0fb315c4d129e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3221.exe

Filesize
314KB

MD5
208760d463d90c971d4821f11abcbd5d

SHA1
c979770b3804deae65b86fe80ba33a1a8a38ccbd

SHA256
ac0046d07d08edac01ea4fa105999b4d0590e4e5f4e35f9fe69058ce16c6b20d

SHA512
277d0ac92c8ac553914104d702c36eff844b26d70ee5785a8a2d8e6e6b415c576c6a78a5d027ab1277f145c9fdc49c69c44c3367a0317bcf32f13b09448f1218

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8580.exe

Filesize
372KB

MD5
35cc078a3dc7a220b2d8758e5f8bc679

SHA1
231e3adf8847f15b718e26eeab27f87825988226

SHA256
38b42e3a6ca7b878e48b0a033cdaa44e21a28385932755456ad43122d3902c9e

SHA512
8a642c74ae15c61bbe4843f29c76edbbd0ca96945706ad2a320e860a59d28121100d5950226e0df77d320a98fa494ef510149421d878f72b4ffd663357fc524d

Download Submit
memory/3724-15-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

Filesize
1024KB

Download
memory/3724-16-0x00000000008E0000-0x000000000090D000-memory.dmp

Filesize
180KB

Download
memory/3724-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3724-18-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/3724-19-0x0000000000AC0000-0x0000000000ADA000-memory.dmp

Filesize
104KB

Download
memory/3724-20-0x0000000004E30000-0x00000000053D4000-memory.dmp

Filesize
5.6MB

Download
memory/3724-21-0x00000000027E0000-0x00000000027F8000-memory.dmp

Filesize
96KB

Download
memory/3724-49-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-47-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-45-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-43-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-25-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-41-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-40-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-37-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-36-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-33-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-31-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-29-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-27-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-23-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-22-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/3724-50-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

Filesize
1024KB

Download
memory/3724-51-0x00000000008E0000-0x000000000090D000-memory.dmp

Filesize
180KB

Download
memory/3724-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3724-57-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/3724-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4900-62-0x00000000028E0000-0x0000000002926000-memory.dmp

Filesize
280KB

Download
memory/4900-63-0x0000000004E50000-0x0000000004E94000-memory.dmp

Filesize
272KB

Download
memory/4900-91-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-95-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-97-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-93-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-89-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-87-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-85-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-83-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-79-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-77-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-75-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-73-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-71-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-81-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-69-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-67-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-65-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-64-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4900-970-0x0000000005530000-0x0000000005B48000-memory.dmp

Filesize
6.1MB

Download
memory/4900-971-0x0000000005B50000-0x0000000005C5A000-memory.dmp

Filesize
1.0MB

Download
memory/4900-972-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/4900-973-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/4900-974-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Filesize
304KB

Download