healer | 88d3ef3c436856785cd282b01d03fbe2e0673278993c3d84ca61ba4b0da14306

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69d85c4206fe2c51671acf136ad5c0e1.exe
Size 529KB
Sample230707-zapseabe37
SHA256 88d3ef3c436856785cd282b01d03fbe2e0673278993c3d84ca61ba4b0da14306
MD5 69d85c4206fe2c51671acf136ad5c0e1
SHA1 1d8876b9b0346a56a2766156d81aca33eade9fb5
SHA512 b44e9b08c70fb8752312b31ad6eb1cbe4a7d66905a6a364db44bbd4e9163f282fb7764106c6b03cd067bd60799115fcfa88a61602f505e43f96393bd311237fd
SSDEEP 12288:ro7PfvaaRdnQg7M1kk/EIp/zXSFrBwum1zv+9m1ntBg49j0ezqwO:ro73va82g7MqkX/zmmwA1/g4On
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline furod dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

furod

77.91.68.70:19073

Attributes

auth_value
d2386245fe11799b28b4521492a5879d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/892-153-0x0000000000560000-0x000000000056A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0747573.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0747573.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0747573.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0747573.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0747573.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0747573.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3656	y5821172.exe
892	k0747573.exe
1492	l4489364.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0747573.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0747573.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	69d85c4206fe2c51671acf136ad5c0e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	69d85c4206fe2c51671acf136ad5c0e1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y5821172.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5821172.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
892	k0747573.exe
892	k0747573.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	k0747573.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3656	5072	69d85c4206fe2c51671acf136ad5c0e1.exe	85
PID 5072 wrote to memory of 3656	5072	69d85c4206fe2c51671acf136ad5c0e1.exe	85
PID 5072 wrote to memory of 3656	5072	69d85c4206fe2c51671acf136ad5c0e1.exe	85
PID 3656 wrote to memory of 892	3656	y5821172.exe	86
PID 3656 wrote to memory of 892	3656	y5821172.exe	86
PID 3656 wrote to memory of 892	3656	y5821172.exe	86
PID 3656 wrote to memory of 1492	3656	y5821172.exe	88
PID 3656 wrote to memory of 1492	3656	y5821172.exe	88
PID 3656 wrote to memory of 1492	3656	y5821172.exe	88

C:\Users\Admin\AppData\Local\Temp\69d85c4206fe2c51671acf136ad5c0e1.exe
"C:\Users\Admin\AppData\Local\Temp\69d85c4206fe2c51671acf136ad5c0e1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5821172.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5821172.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0747573.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0747573.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4489364.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4489364.exe
    3⤵
    - Executes dropped EXE
    PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

y5821172.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5821172.exe
Size 261KB
SHA256 cf96ff25d6a3bdb046dc251e2ca5a3e0ba3e79009406fe244c967c71e2c943c4
MD5 a749bc2ba353ac8433ad81265ff00106
SHA1 d4cc8a7d2d2f6cd55d178f841f5db046cc0b4620
SHA512 7c3b8f15f6fbb384e2be6aefe924810f9355441922c4eb4402d66f5da7063261cc5284e9228a41f6ec6227ca6b798147a028928de7894aad29f3e197b17d49c8
SSDEEP 6144:Koy+bnr+ep0yN90QEqlbT02Qracgu5fZrt2h+5RtB4TW:IMryy90Ut4x5iItB4TW
MD5 SHA1 SHA512 SSDEEP

Submit Download

y5821172.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5821172.exe
Size 261KB
SHA256 cf96ff25d6a3bdb046dc251e2ca5a3e0ba3e79009406fe244c967c71e2c943c4
MD5 a749bc2ba353ac8433ad81265ff00106
SHA1 d4cc8a7d2d2f6cd55d178f841f5db046cc0b4620
SHA512 7c3b8f15f6fbb384e2be6aefe924810f9355441922c4eb4402d66f5da7063261cc5284e9228a41f6ec6227ca6b798147a028928de7894aad29f3e197b17d49c8
SSDEEP 6144:Koy+bnr+ep0yN90QEqlbT02Qracgu5fZrt2h+5RtB4TW:IMryy90Ut4x5iItB4TW
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0747573.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0747573.exe
Size 96KB
SHA256 f76ffd40c1c0d0e76bea4ce0a0dbfabe1fa1189b23c4b8f7b41ea5230716b455
MD5 cb3d6e0a80c290c6f6f17a465a1e1132
SHA1 2b37726d4be63b98d4e6dbcd755572aa6aa2bf03
SHA512 74eb579cc11ff30c5bf80bb233f31199a6618a5367302dfca0d412e2870a42a8ee9f3733d8af94c06fae0d4e6ea242891d6a8a24118f1f2cf54666cca9d93217
SSDEEP 1536:fCpBx3nfb4CERkYi21OzuOtyFopY5wOAFC7qQwH7PxM:6pj3M5JzguOtyCY5wOACejxM
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0747573.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0747573.exe
Size 96KB
SHA256 f76ffd40c1c0d0e76bea4ce0a0dbfabe1fa1189b23c4b8f7b41ea5230716b455
MD5 cb3d6e0a80c290c6f6f17a465a1e1132
SHA1 2b37726d4be63b98d4e6dbcd755572aa6aa2bf03
SHA512 74eb579cc11ff30c5bf80bb233f31199a6618a5367302dfca0d412e2870a42a8ee9f3733d8af94c06fae0d4e6ea242891d6a8a24118f1f2cf54666cca9d93217
SSDEEP 1536:fCpBx3nfb4CERkYi21OzuOtyFopY5wOAFC7qQwH7PxM:6pj3M5JzguOtyCY5wOACejxM
MD5 SHA1 SHA512 SSDEEP

Submit Download

l4489364.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4489364.exe
Size 257KB
SHA256 3e00242eade6d3d6e3e8debf42447c56259b2fd9bba080692be9ceb3182f5d46
MD5 6dcb40070a3678f028b2adf733b0fa8e
SHA1 4f69a43db888f0ae9f1e88f0540fdafe13fbcc5c
SHA512 08b32857f3fc279d0d2cf4ce311088a6073497088250dd9d35ebef46b9015e43999ae9921534cfe9ce5baa1b6b999b6f0367845442683ecc7a517517fda82c92
SSDEEP 6144:DQURNiwsp+ly2WtzH7NrIrBJjvft5LZFL92hUPEI+mPl:D5RNiTIYR0vfjZZ92hUrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

l4489364.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4489364.exe
Size 257KB
SHA256 3e00242eade6d3d6e3e8debf42447c56259b2fd9bba080692be9ceb3182f5d46
MD5 6dcb40070a3678f028b2adf733b0fa8e
SHA1 4f69a43db888f0ae9f1e88f0540fdafe13fbcc5c
SHA512 08b32857f3fc279d0d2cf4ce311088a6073497088250dd9d35ebef46b9015e43999ae9921534cfe9ce5baa1b6b999b6f0367845442683ecc7a517517fda82c92
SSDEEP 6144:DQURNiwsp+ly2WtzH7NrIrBJjvft5LZFL92hUPEI+mPl:D5RNiTIYR0vfjZZ92hUrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/892-153-0x0000000000560000-0x000000000056A000-memory.dmp

Download

memory/1492-162-0x0000000000490000-0x00000000004C0000-memory.dmp

Download

memory/1492-167-0x000000000A6D0000-0x000000000ACE8000-memory.dmp

Download

memory/1492-168-0x000000000A140000-0x000000000A24A000-memory.dmp

Download

memory/1492-169-0x000000000A280000-0x000000000A292000-memory.dmp

Download

memory/1492-170-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Download

memory/1492-171-0x000000000A2A0000-0x000000000A2DC000-memory.dmp

Download

memory/1492-172-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Download

memory/5072-133-0x00000000005B0000-0x0000000000624000-memory.dmp

Download