healer | da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe
Size

659KB
MD5

c656e1d517c3285d29c2d90b7ab8ae2d
SHA1

7eff86bbf993c624e1f08fe2f6929edb7c624a9a
SHA256

da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84
SHA512

c75c3aabc2cb481fd5fc463421c89a216114afc9fb9a2658732ec2567ceffc2ac028b6381016cbcf6215738e5da242bd6473d011531a50c714633648b7ef4e8a
SSDEEP

12288:yMrSy90vS2n/aFEW5cFWjm9Rs5P2IrVi1Mof5KMa/1mmpObb7v1fgt:cyUtFWj8R+pVi11AnmmpC71fM

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4784-19-0x00000000023C0000-0x00000000023DA000-memory.dmp	healer
behavioral1/memory/4784-21-0x0000000004B40000-0x0000000004B58000-memory.dmp	healer
behavioral1/memory/4784-22-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-31-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-49-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-48-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-45-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-43-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-41-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-40-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-37-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-35-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-33-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-30-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-27-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-25-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer
behavioral1/memory/4784-23-0x0000000004B40000-0x0000000004B52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro1025.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro1025.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro1025.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro1025.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro1025.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro1025.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4328-61-0x0000000002380000-0x00000000023C6000-memory.dmp	family_redline
behavioral1/memory/4328-62-0x0000000004BE0000-0x0000000004C24000-memory.dmp	family_redline
behavioral1/memory/4328-76-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-86-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-96-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-94-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-92-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-88-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-84-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-82-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-80-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-78-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-74-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-72-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-70-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-68-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-90-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-66-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-64-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline
behavioral1/memory/4328-63-0x0000000004BE0000-0x0000000004C1F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1848	un321389.exe
4784	pro1025.exe
4328	qu0625.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro1025.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro1025.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un321389.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4932	4784	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu0625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un321389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro1025.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4784	pro1025.exe
4784	pro1025.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4784	pro1025.exe
Token: SeDebugPrivilege	4328	qu0625.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1848	2596	da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe	84
PID 2596 wrote to memory of 1848	2596	da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe	84
PID 2596 wrote to memory of 1848	2596	da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe	84
PID 1848 wrote to memory of 4784	1848	un321389.exe	85
PID 1848 wrote to memory of 4784	1848	un321389.exe	85
PID 1848 wrote to memory of 4784	1848	un321389.exe	85
PID 1848 wrote to memory of 4328	1848	un321389.exe	95
PID 1848 wrote to memory of 4328	1848	un321389.exe	95
PID 1848 wrote to memory of 4328	1848	un321389.exe	95

C:\Users\Admin\AppData\Local\Temp\da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe
"C:\Users\Admin\AppData\Local\Temp\da5b186e215413612cada8bb19f2f0db568c880e3b1c9a557c954d624ae0dd84.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un321389.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un321389.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1025.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1025.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1084
      4⤵
      Program crash
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0625.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0625.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4784 -ip 4784
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un321389.exe

Filesize
518KB

MD5
5f505959775d9055b7148b4caa284437

SHA1
b694faf447b8c6ff3b5f6a03f1a4eff0ff83277a

SHA256
cf9432e840f8b29d654e775c2d1efdcd62e416301dc358cad0293a7e6ed7f434

SHA512
26fb09d5adb4266685c8b3749e53a0714732dae431f2b47a423b0b5f4b6dc049de26220c43a0795d77029a5c8c2f0d2cacaaf7c64d9adc5eb1bda08d63bcadfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1025.exe

Filesize
376KB

MD5
cff0901bff0eb4db42bdb3f4e54493f8

SHA1
16d2e91bcd25394a2604e4e3c1d1cff4b09f946b

SHA256
1e653b8255ccae8b9f197b9b1197a565b59583abfd0d5cc19e09df8925618e0a

SHA512
b8bbbb089f505dbb13d4e270e07847e567ee37ea9364b3da173726a5a74edb90ed1c89a4e0d36d227e122ae3d8cdbd4557418921d84d9ec2461da94e74352cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0625.exe

Filesize
434KB

MD5
a92e6b0c487b9cb1e568c9a4723ea1fe

SHA1
4400b8b2ef4674b577db0c4e9ef18cac76b9841b

SHA256
bf3aab3a1f318b3b6169e3c1c8fe68ff1d660f0129b9fb67c8cb9535f91271cb

SHA512
682f740b11d40000e493b1be051784527d5f43f05842c652d91216812bd8df165d711ba5b734273db7bf1f6160c7ab3bd44b4ee2238e79e1318b9d5096df50ba

Download Submit
memory/4328-72-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-78-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-970-0x00000000058B0000-0x00000000059BA000-memory.dmp

Filesize
1.0MB

Download
memory/4328-969-0x0000000005290000-0x00000000058A8000-memory.dmp

Filesize
6.1MB

Download
memory/4328-63-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-64-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-66-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-90-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-68-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-70-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-972-0x00000000059F0000-0x0000000005A2C000-memory.dmp

Filesize
240KB

Download
memory/4328-973-0x0000000005B40000-0x0000000005B8C000-memory.dmp

Filesize
304KB

Download
memory/4328-74-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-971-0x00000000059D0000-0x00000000059E2000-memory.dmp

Filesize
72KB

Download
memory/4328-80-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-82-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-84-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-88-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-92-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-94-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-96-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-86-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-76-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

Filesize
252KB

Download
memory/4328-62-0x0000000004BE0000-0x0000000004C24000-memory.dmp

Filesize
272KB

Download
memory/4328-61-0x0000000002380000-0x00000000023C6000-memory.dmp

Filesize
280KB

Download
memory/4784-45-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-55-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4784-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4784-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4784-51-0x0000000000920000-0x000000000094D000-memory.dmp

Filesize
180KB

Download
memory/4784-50-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download
memory/4784-23-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-25-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-27-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-30-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-33-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-35-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-37-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-40-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-41-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-43-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-48-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-49-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-31-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-22-0x0000000004B40000-0x0000000004B52000-memory.dmp

Filesize
72KB

Download
memory/4784-21-0x0000000004B40000-0x0000000004B58000-memory.dmp

Filesize
96KB

Download
memory/4784-20-0x0000000004D20000-0x00000000052C4000-memory.dmp

Filesize
5.6MB

Download
memory/4784-19-0x00000000023C0000-0x00000000023DA000-memory.dmp

Filesize
104KB

Download
memory/4784-18-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4784-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4784-16-0x0000000000920000-0x000000000094D000-memory.dmp

Filesize
180KB

Download
memory/4784-15-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download