healer | 35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe
Size

667KB
MD5

a129e1a4d31e1005e9a998124573f089
SHA1

641f859bae9f9af264c0193777a4620db4ad5f36
SHA256

35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c
SHA512

39337790700cb7b54fb00fc8f7088ecbcbcb4126b11c34e20b65c77334a3a55081e9799364150159c05269cca1baec30a29a1d6699e546a053f4ffff7af7f00b
SSDEEP

12288:RMrMy901mIqyGcavqE14FEyMoMLtMk/FBUhttN3b4NQ4v5YY:tyCAtcavirMLthFBwDN3e5D

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2416-19-0x0000000004E20000-0x0000000004E3A000-memory.dmp	healer
behavioral1/memory/2416-21-0x00000000054A0000-0x00000000054B8000-memory.dmp	healer
behavioral1/memory/2416-49-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-47-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-45-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-43-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-41-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-39-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-37-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-35-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-33-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-31-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-29-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-27-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-25-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-23-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer
behavioral1/memory/2416-22-0x00000000054A0000-0x00000000054B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro0737.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro0737.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro0737.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro0737.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro0737.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro0737.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3348-60-0x0000000002700000-0x0000000002746000-memory.dmp	family_redline
behavioral1/memory/3348-61-0x00000000053C0000-0x0000000005404000-memory.dmp	family_redline
behavioral1/memory/3348-67-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-79-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-95-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-93-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-91-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-89-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-87-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-85-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-81-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-77-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-75-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-73-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-71-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-69-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-83-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-65-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-63-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3348-62-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3312	un537052.exe
2416	pro0737.exe
3348	qu3537.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro0737.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro0737.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un537052.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
672	2416	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu3537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un537052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro0737.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	pro0737.exe
2416	pro0737.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	pro0737.exe
Token: SeDebugPrivilege	3348	qu3537.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3312	4980	35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe	83
PID 4980 wrote to memory of 3312	4980	35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe	83
PID 4980 wrote to memory of 3312	4980	35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe	83
PID 3312 wrote to memory of 2416	3312	un537052.exe	84
PID 3312 wrote to memory of 2416	3312	un537052.exe	84
PID 3312 wrote to memory of 2416	3312	un537052.exe	84
PID 3312 wrote to memory of 3348	3312	un537052.exe	99
PID 3312 wrote to memory of 3348	3312	un537052.exe	99
PID 3312 wrote to memory of 3348	3312	un537052.exe	99

C:\Users\Admin\AppData\Local\Temp\35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe
"C:\Users\Admin\AppData\Local\Temp\35b210fed22d9a4d66244695d12dad3d7a79d9023d2512e34984d68eb4a5500c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un537052.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un537052.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0737.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0737.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1084
      4⤵
      Program crash
      PID:672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3537.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3537.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2416 -ip 2416
1⤵
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un537052.exe

Filesize
525KB

MD5
f49402389f012874545c46c8678412ce

SHA1
f5473412527259f6cec47fc275cee9f817a2a449

SHA256
affe729f36a62e0601b755bbd8e669211fe29ae6b105db19aeaf2180eda0a7a8

SHA512
d4ccef626bf72ddef32b5f075af8f5bb7399b1ee014cc8c44c66e36d32c277515e02b03ea1ac97f96729335c635aa35d71c64814726dd187e03af5918365a625

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0737.exe

Filesize
294KB

MD5
3f14f78e14abd089f4e9b297d6a029ef

SHA1
82fe17a89b5b4bbee28b980d19f161448b59ff7c

SHA256
2cacc9227aaffe802a04ef3b5057ef5579f37af7189baff40fa0ea9e3c86bdc1

SHA512
4613f5d364d73dcfc28aa0270de42d145faef2d487b8dd9e69983c46a1c0ffb98381f6b3e5b460295503b9fd56cce86e717550d6dcd2e8b278e86495da0d72ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3537.exe

Filesize
353KB

MD5
c6d8dd1f78249ead7da81bbc1de9fc9e

SHA1
f0c568c7c52509c41ae06f9c16c7c0c1e5c1622d

SHA256
57b5cf205f027cdf81711cbd9f728ec0cc511f3392092be502a159bcbff3efed

SHA512
287e4a6cb7f507b6dccf658aab267ff93423e602717741bf1a19df3ef4c10cb76b2b67f6e64137267f1cd63c94b074b18e66aa3500b9f01b919d0b3f555bd6a7

Download Submit
memory/2416-15-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/2416-17-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/2416-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2416-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/2416-19-0x0000000004E20000-0x0000000004E3A000-memory.dmp

Filesize
104KB

Download
memory/2416-20-0x0000000004EB0000-0x0000000005454000-memory.dmp

Filesize
5.6MB

Download
memory/2416-21-0x00000000054A0000-0x00000000054B8000-memory.dmp

Filesize
96KB

Download
memory/2416-49-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-47-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-45-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-43-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-41-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-39-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-37-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-35-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-33-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-31-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-29-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-27-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-25-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-23-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-22-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/2416-50-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/2416-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2416-54-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/2416-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3348-60-0x0000000002700000-0x0000000002746000-memory.dmp

Filesize
280KB

Download
memory/3348-61-0x00000000053C0000-0x0000000005404000-memory.dmp

Filesize
272KB

Download
memory/3348-67-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-79-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-95-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-93-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-91-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-89-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-87-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-85-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-81-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-77-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-75-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-73-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-71-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-69-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-83-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-65-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-63-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-62-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3348-968-0x0000000005440000-0x0000000005A58000-memory.dmp

Filesize
6.1MB

Download
memory/3348-969-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

Filesize
1.0MB

Download
memory/3348-970-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/3348-971-0x0000000005C40000-0x0000000005C7C000-memory.dmp

Filesize
240KB

Download
memory/3348-972-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download