healer | e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9

Analysis

max time kernel
118s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe
Size

518KB
MD5

b6f839e1c634dd6dba45930d82512bde
SHA1

2dc7789326ab1c74176bf656687f7a24dfa8dc44
SHA256

e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9
SHA512

98798921efa56862d2ade506201cd76e351f939881d692f36aeb1236fd61ac78c387dc4702ff8928678361f239c2831718e274abe17bfcb28c07d34c62f2831d
SSDEEP

12288:xMrRy90wys716M8w9ceIW1hof5Kea/Wm7KR3U6np:QyUC16dwWeIW1WAGmE3U6np

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2244-12-0x0000000002460000-0x000000000247A000-memory.dmp	healer
behavioral1/memory/2244-14-0x00000000026F0000-0x0000000002708000-memory.dmp	healer
behavioral1/memory/2244-22-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-42-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-40-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-38-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-36-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-34-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-32-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-30-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-28-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-26-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-24-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-20-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-18-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-16-0x00000000026F0000-0x0000000002702000-memory.dmp	healer
behavioral1/memory/2244-15-0x00000000026F0000-0x0000000002702000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6628.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6628.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6628.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6628.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6628.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6628.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1984-55-0x0000000004B00000-0x0000000004B46000-memory.dmp	family_redline
behavioral1/memory/1984-56-0x0000000005180000-0x00000000051C4000-memory.dmp	family_redline
behavioral1/memory/1984-60-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-66-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-90-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-88-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-86-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-84-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-82-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-80-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-78-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-76-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-74-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-72-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-70-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-68-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-64-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-62-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-58-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1984-57-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 2 IoCs

pid	Process
2244	pro6628.exe
1984	qu9587.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6628.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6628.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	2244	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro6628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu9587.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2244	pro6628.exe
2244	pro6628.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	pro6628.exe
Token: SeDebugPrivilege	1984	qu9587.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2244	4832	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe	83
PID 4832 wrote to memory of 2244	4832	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe	83
PID 4832 wrote to memory of 2244	4832	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe	83
PID 4832 wrote to memory of 1984	4832	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe	95
PID 4832 wrote to memory of 1984	4832	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe	95
PID 4832 wrote to memory of 1984	4832	e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe	95

C:\Users\Admin\AppData\Local\Temp\e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe
"C:\Users\Admin\AppData\Local\Temp\e2792e3a4383e0058df427419068b4104f6d4a2867dadea4828aeaf04db01ed9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro6628.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro6628.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 1084
    3⤵
    - Program crash
    PID:2256
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu9587.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu9587.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2244 -ip 2244
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro6628.exe

Filesize
376KB

MD5
2009e4706c73cdd060ad8a9fa2f0b96b

SHA1
28839bb122ac1b5be75557c0e59e2ace006ba612

SHA256
686a6b4abfdf4865ae67a6fad51485e5e4e26c808ea93ed98dda5481eebe92b8

SHA512
d2fbdc8cb2dfa0595e0576a2b01a6bc81c0f33ab94f491d081eda3c3836b34acef026d0b8c83ed91eacfd4298b3244c5d00282bcd6d6aefe6335042eb953cff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu9587.exe

Filesize
434KB

MD5
dee4b05ad0e8731e70be1a6e3f21f071

SHA1
1aec4cdbb0dea2550ed4a057a75a3caadf7d83a6

SHA256
be17d6b1f3f8a5b93372eec9ced3503adb2363a60622494c3661c3ee6d87065f

SHA512
1f3b5593375481d93ba31980bf79e1eea77bddf279f61eafa4639fcf0a84f61a604a7e364b054cfd3dacfbd734de12548c4e335a70af19415c2e829db1ef4c37

Download Submit
memory/1984-74-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-53-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/1984-55-0x0000000004B00000-0x0000000004B46000-memory.dmp

Filesize
280KB

Download
memory/1984-963-0x0000000005330000-0x0000000005948000-memory.dmp

Filesize
6.1MB

Download
memory/1984-57-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-58-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-62-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-64-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-68-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-70-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-72-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-966-0x0000000005B70000-0x0000000005BAC000-memory.dmp

Filesize
240KB

Download
memory/1984-964-0x00000000059D0000-0x0000000005ADA000-memory.dmp

Filesize
1.0MB

Download
memory/1984-965-0x0000000005B10000-0x0000000005B22000-memory.dmp

Filesize
72KB

Download
memory/1984-66-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-80-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-82-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-84-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-86-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-88-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-90-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-78-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-60-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1984-56-0x0000000005180000-0x00000000051C4000-memory.dmp

Filesize
272KB

Download
memory/1984-54-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/1984-967-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

Filesize
304KB

Download
memory/1984-76-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/2244-34-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2244-47-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2244-44-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2244-43-0x0000000000880000-0x0000000000980000-memory.dmp

Filesize
1024KB

Download
memory/2244-15-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-16-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-18-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-20-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-24-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-26-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-28-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-30-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-32-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-36-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-38-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-40-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-42-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-22-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/2244-14-0x00000000026F0000-0x0000000002708000-memory.dmp

Filesize
96KB

Download
memory/2244-13-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download
memory/2244-12-0x0000000002460000-0x000000000247A000-memory.dmp

Filesize
104KB

Download
memory/2244-11-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2244-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2244-10-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2244-8-0x0000000000880000-0x0000000000980000-memory.dmp

Filesize
1024KB

Download