healer | d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe
Size

659KB
MD5

19f91d36542897e357f4e7a25da702ba
SHA1

59cfec44e37b06eea7724fb16521417575601cf7
SHA256

d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91
SHA512

8ee4289f8f03ace052053627c69c91275b98961f2c6ed3083068dd250b960ede94797dfaf83a58381368cbc771b93bc788ba045b2377faa3d58c1d30d57cadf6
SSDEEP

12288:FMr8y9060Ux5fBCfxJF1kqfRK9eHYGyMuA6Ry1lqLhhx1:FyP/xtM5VkqwQHuBRCy31

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1680-19-0x00000000029D0000-0x00000000029EA000-memory.dmp	healer
behavioral1/memory/1680-21-0x0000000002AA0000-0x0000000002AB8000-memory.dmp	healer
behavioral1/memory/1680-27-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-49-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-47-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-45-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-43-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-41-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-40-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-37-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-35-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-33-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-31-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-29-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-25-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-23-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer
behavioral1/memory/1680-22-0x0000000002AA0000-0x0000000002AB2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3817.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3817.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3817.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro3817.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3817.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3817.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3168-61-0x0000000002600000-0x0000000002646000-memory.dmp	family_redline
behavioral1/memory/3168-62-0x0000000004E00000-0x0000000004E44000-memory.dmp	family_redline
behavioral1/memory/3168-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-63-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-96-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-94-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-92-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-90-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-88-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-84-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3168-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2816	un564479.exe
1680	pro3817.exe
3168	qu6507.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3817.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3817.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un564479.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	1680	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un564479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro3817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu6507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	pro3817.exe
1680	pro3817.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	pro3817.exe
Token: SeDebugPrivilege	3168	qu6507.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2816	1192	d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe	83
PID 1192 wrote to memory of 2816	1192	d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe	83
PID 1192 wrote to memory of 2816	1192	d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe	83
PID 2816 wrote to memory of 1680	2816	un564479.exe	84
PID 2816 wrote to memory of 1680	2816	un564479.exe	84
PID 2816 wrote to memory of 1680	2816	un564479.exe	84
PID 2816 wrote to memory of 3168	2816	un564479.exe	100
PID 2816 wrote to memory of 3168	2816	un564479.exe	100
PID 2816 wrote to memory of 3168	2816	un564479.exe	100

C:\Users\Admin\AppData\Local\Temp\d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe
"C:\Users\Admin\AppData\Local\Temp\d1dede93c314c5ce57547081a886ac16e9264996c31cb451dbe422ff37327b91.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un564479.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un564479.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3817.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3817.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1088
      4⤵
      Program crash
      PID:3276
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6507.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6507.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1680 -ip 1680
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un564479.exe

Filesize
517KB

MD5
a92d9470aaee1f3178afdb4938044e52

SHA1
6b111065c85055d255fa3d569356b8d440430560

SHA256
63936283589e13e34e402a2b28e24d5c67f9747a6d0437c74314c5fd0b5e1868

SHA512
e91314eb9294bd1595cb1bfcf4349762afcf938b3bcc4105fe4e6372b44b0663c8f4493ba38b13b70e94282a115c1b5ddf763c037e890b624656265b806f3db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3817.exe

Filesize
376KB

MD5
017efaf31dd9a75c127155adc07ba498

SHA1
58af6fa367d616f1c91b08151494267e1ed47071

SHA256
04d5bdca7b4f6deb34a5b53a30c3190d5ace906623cec739e26f851f65d7b2e5

SHA512
26d122c0953886fb29f7bc572c4b343b04f0513aa8730a41416a97c8342092e488604bc6a25dfc8ac4e554f09a80bd376684886967cdc87487aa87f768ce977c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6507.exe

Filesize
434KB

MD5
fbfc3e9e8e633777838fa2baa1b5c06c

SHA1
330e0cda6b7ee863d94f4c164d225803f72b55ff

SHA256
aaf7a59a8e5c5e978358684451822e5c57d8c545c17cf63d493d192934409f73

SHA512
0f01d0d3f8e24e76ef1ad27e8f70246587fbadc128dc3b468ca8556b53127c53f6b0a8427a5e8cb88dd3e4303962c2a862a27759bff7d23ffa5d427e2cdf4f46

Download Submit
memory/1680-15-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1680-16-0x0000000002330000-0x000000000235D000-memory.dmp

Filesize
180KB

Download
memory/1680-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1680-18-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/1680-19-0x00000000029D0000-0x00000000029EA000-memory.dmp

Filesize
104KB

Download
memory/1680-20-0x0000000005010000-0x00000000055B4000-memory.dmp

Filesize
5.6MB

Download
memory/1680-21-0x0000000002AA0000-0x0000000002AB8000-memory.dmp

Filesize
96KB

Download
memory/1680-27-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-49-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-47-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-45-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-43-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-41-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-40-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-37-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-35-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-33-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-31-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-29-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-25-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-23-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-22-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/1680-50-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/1680-51-0x0000000002330000-0x000000000235D000-memory.dmp

Filesize
180KB

Download
memory/1680-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1680-55-0x0000000000400000-0x0000000000813000-memory.dmp

Filesize
4.1MB

Download
memory/1680-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3168-61-0x0000000002600000-0x0000000002646000-memory.dmp

Filesize
280KB

Download
memory/3168-62-0x0000000004E00000-0x0000000004E44000-memory.dmp

Filesize
272KB

Download
memory/3168-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-63-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-96-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-94-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-92-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-90-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-88-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-84-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3168-969-0x0000000005470000-0x0000000005A88000-memory.dmp

Filesize
6.1MB

Download
memory/3168-970-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Filesize
1.0MB

Download
memory/3168-971-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/3168-972-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/3168-973-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download