healer | 5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe
Size

699KB
MD5

509aca804538f3e19a56a4a37089af72
SHA1

e73d25a6fd711c55662a6ec2694d37b9cb26be85
SHA256

5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5
SHA512

3447485a4a050516a27eb7609fb330001830f036ffe910c84878f7a3f0dfc22da4c2c55a58216dc16fbe40aa660605a461cba2f55015e5ad230cb86d46f4c930
SSDEEP

12288:bMr7y90C6iXcdPQeq2C5hCKN6jW1zDrM9NwPAiL2alpyzda4sk/:0yz6HPz+PCK6WDrM9NAAY2anEdaO/

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4920-19-0x00000000024E0000-0x00000000024FA000-memory.dmp	healer
behavioral1/memory/4920-21-0x0000000002680000-0x0000000002698000-memory.dmp	healer
behavioral1/memory/4920-49-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-47-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-45-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-43-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-41-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-39-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-37-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-35-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-33-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-31-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-29-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-27-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-25-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-23-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4920-22-0x0000000002680000-0x0000000002692000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro7054.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro7054.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro7054.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro7054.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro7054.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro7054.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/976-62-0x00000000027A0000-0x00000000027E4000-memory.dmp	family_redline
behavioral1/memory/976-61-0x0000000002420000-0x0000000002466000-memory.dmp	family_redline
behavioral1/memory/976-68-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-73-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-96-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-94-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-92-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-90-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-88-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-86-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-82-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-80-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-78-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-77-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-74-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-70-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-84-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-66-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-64-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline
behavioral1/memory/976-63-0x00000000027A0000-0x00000000027DF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3544	un087903.exe
4920	pro7054.exe
976	qu1209.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro7054.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro7054.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un087903.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3484	4920	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un087903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro7054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu1209.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	pro7054.exe
4920	pro7054.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	pro7054.exe
Token: SeDebugPrivilege	976	qu1209.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3544	384	5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe	83
PID 384 wrote to memory of 3544	384	5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe	83
PID 384 wrote to memory of 3544	384	5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe	83
PID 3544 wrote to memory of 4920	3544	un087903.exe	85
PID 3544 wrote to memory of 4920	3544	un087903.exe	85
PID 3544 wrote to memory of 4920	3544	un087903.exe	85
PID 3544 wrote to memory of 976	3544	un087903.exe	96
PID 3544 wrote to memory of 976	3544	un087903.exe	96
PID 3544 wrote to memory of 976	3544	un087903.exe	96

C:\Users\Admin\AppData\Local\Temp\5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe
"C:\Users\Admin\AppData\Local\Temp\5340e8e4b8f0e7ca7891f874a67eb8c88e368d0a80c3f97a6417cb30607d96b5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un087903.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un087903.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7054.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7054.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1084
      4⤵
      Program crash
      PID:3484
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1209.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1209.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4920 -ip 4920
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un087903.exe

Filesize
557KB

MD5
ef4c36d95992b2235c1c8b4f0e2a246d

SHA1
394c8fb6b85c7a2889c83cca6b2363e2c077fa70

SHA256
31ecd3bb987af8414ff9e45b8934ce0ef04cf50ea279776c288a450b743b65a6

SHA512
430654beeb3b71f41b9652d4c6997351e1da1191fa838b144fc66a1cfa46180db67a69bc55705d748bae9c9bc0ac17058838a27c313311809c6b77aec35ef0ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7054.exe

Filesize
307KB

MD5
7a829153cab73ce7b2e5ee4623cca3b0

SHA1
f24111c6f5f103b06440b9eab3946c0de31f3c47

SHA256
262d08280c099ccb1d1100bbf85621bb60b0b5e5aaf2a923a359d36794114211

SHA512
fe37fe5f0928d0625b700da259d4ba61679ff15da7066ef1d29ea9f739a27d77390b3a29c1f447886528d8aadbb4b93aefa9071cf9b739b2d3f4c0a73f2b48fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1209.exe

Filesize
366KB

MD5
53cf9a1db23b94b3220b3722bc6a8660

SHA1
aa6f7a53a4335b3e630522fddf165f427e12dc14

SHA256
c3ffb3fa5bb794fe4d316144390994dfe9f6918e163290595f40ee03d9fdcaaa

SHA512
be9059df1c0e13da7a5d1c4f499cc01e6d2a85c84dec10d430691e8c9a712707251c79d238fcfd3f4510a5040067864146f5283ea866e9c4c8f57b8eefdd8f69

Download Submit
memory/976-77-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-80-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-970-0x0000000005BB0000-0x0000000005CBA000-memory.dmp

Filesize
1.0MB

Download
memory/976-969-0x0000000005590000-0x0000000005BA8000-memory.dmp

Filesize
6.1MB

Download
memory/976-63-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-64-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-66-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-84-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-70-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-74-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-972-0x0000000005CC0000-0x0000000005CFC000-memory.dmp

Filesize
240KB

Download
memory/976-973-0x0000000005E00000-0x0000000005E4C000-memory.dmp

Filesize
304KB

Download
memory/976-78-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-971-0x0000000004E80000-0x0000000004E92000-memory.dmp

Filesize
72KB

Download
memory/976-82-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-86-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-88-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-90-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-92-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-94-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-96-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-73-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-68-0x00000000027A0000-0x00000000027DF000-memory.dmp

Filesize
252KB

Download
memory/976-61-0x0000000002420000-0x0000000002466000-memory.dmp

Filesize
280KB

Download
memory/976-62-0x00000000027A0000-0x00000000027E4000-memory.dmp

Filesize
272KB

Download
memory/4920-41-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-55-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/4920-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4920-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4920-51-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/4920-50-0x0000000000A90000-0x0000000000B90000-memory.dmp

Filesize
1024KB

Download
memory/4920-22-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-23-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-25-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-27-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-29-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-31-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-33-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-35-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-37-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-39-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-43-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-45-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-47-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-49-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4920-21-0x0000000002680000-0x0000000002698000-memory.dmp

Filesize
96KB

Download
memory/4920-20-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/4920-19-0x00000000024E0000-0x00000000024FA000-memory.dmp

Filesize
104KB

Download
memory/4920-18-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/4920-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4920-16-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/4920-15-0x0000000000A90000-0x0000000000B90000-memory.dmp

Filesize
1024KB

Download