healer | eb888765b8e2b4b0fc08ebf8fba4abd446d32b6ede64c32eaa333b81e38ccb6a

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66a582bbea52177a33c23172709ebfb4.exe
Size 666KB
Sample230708-klez1sdb95
SHA256 eb888765b8e2b4b0fc08ebf8fba4abd446d32b6ede64c32eaa333b81e38ccb6a
MD5 66a582bbea52177a33c23172709ebfb4
SHA1 c2c06d7ce85ed753d1b9987904f7b1ecc113dc66
SHA512 0b54aaf0a0eae7ca5622ab16519955943360caf7fbe433ffec2e36f2a0320d896e5852e9ba0a0c73c4e0bc20134ca7944556782f6b82452dc181e7040d3cd149
SSDEEP 12288:PYfVNfv1aRdnQgwu/1Ru2JeOJiatkzWnkIIUNt24EgvTs46pWlhh1a77/zo9I:gfV5v182gwu/1EPOJztkzWntQFAj1aP1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline norm dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.68.70:19073

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Signatures

Detects Healer an antivirus disabler dropper 4 IoCs

resource	yara_rule
behavioral2/memory/912-160-0x00000000001F0000-0x00000000001FA000-memory.dmp	healer
behavioral2/files/0x00060000000230bd-167.dat	healer
behavioral2/files/0x00060000000230bd-168.dat	healer
behavioral2/memory/400-169-0x0000000000010000-0x000000000001A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	r7808526.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	r7808526.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	r7808526.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	r7808526.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	r7808526.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	r7808526.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
4208	z9102919.exe
4904	z5032612.exe
912	p6319437.exe
400	r7808526.exe
2908	s6671017.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	p6319437.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	r7808526.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	66a582bbea52177a33c23172709ebfb4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z9102919.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9102919.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z5032612.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z5032612.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	66a582bbea52177a33c23172709ebfb4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
912	p6319437.exe
912	p6319437.exe
400	r7808526.exe
400	r7808526.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	p6319437.exe
Token: SeDebugPrivilege	400	r7808526.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4208	4196	66a582bbea52177a33c23172709ebfb4.exe	85
PID 4196 wrote to memory of 4208	4196	66a582bbea52177a33c23172709ebfb4.exe	85
PID 4196 wrote to memory of 4208	4196	66a582bbea52177a33c23172709ebfb4.exe	85
PID 4208 wrote to memory of 4904	4208	z9102919.exe	86
PID 4208 wrote to memory of 4904	4208	z9102919.exe	86
PID 4208 wrote to memory of 4904	4208	z9102919.exe	86
PID 4904 wrote to memory of 912	4904	z5032612.exe	87
PID 4904 wrote to memory of 912	4904	z5032612.exe	87
PID 4904 wrote to memory of 912	4904	z5032612.exe	87
PID 4904 wrote to memory of 400	4904	z5032612.exe	89
PID 4904 wrote to memory of 400	4904	z5032612.exe	89
PID 4208 wrote to memory of 2908	4208	z9102919.exe	90
PID 4208 wrote to memory of 2908	4208	z9102919.exe	90
PID 4208 wrote to memory of 2908	4208	z9102919.exe	90

C:\Users\Admin\AppData\Local\Temp\66a582bbea52177a33c23172709ebfb4.exe
"C:\Users\Admin\AppData\Local\Temp\66a582bbea52177a33c23172709ebfb4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9102919.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9102919.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5032612.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5032612.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6319437.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6319437.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7808526.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7808526.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:400
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s6671017.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s6671017.exe
    3⤵
    - Executes dropped EXE
    PID:2908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

z9102919.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9102919.exe
Size 397KB
SHA256 1a3d8932ce70f80fafe3ab650d84e46ef0e52408bb7ef4c15729339dca0b9efb
MD5 7e2f5a85f72ce1003ce036ff02f65ff7
SHA1 0df55a273ff0999324a86651e0ca7be966f07e3b
SHA512 b69b00db5af162b303bbbbbfb10efed36a4246ac74cac4433f878d8defe63ec380ed7ad1b6aa0fe64d19897fc40019f16e1e1e01a2e32770dd7cd23bc763bb3f
SSDEEP 12288:bMrLy90lnSJE2K3T2r5/eUsYRmnzyP7t98Z:ky/JPKD25e9c228
MD5 SHA1 SHA512 SSDEEP

Submit Download

z9102919.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9102919.exe
Size 397KB
SHA256 1a3d8932ce70f80fafe3ab650d84e46ef0e52408bb7ef4c15729339dca0b9efb
MD5 7e2f5a85f72ce1003ce036ff02f65ff7
SHA1 0df55a273ff0999324a86651e0ca7be966f07e3b
SHA512 b69b00db5af162b303bbbbbfb10efed36a4246ac74cac4433f878d8defe63ec380ed7ad1b6aa0fe64d19897fc40019f16e1e1e01a2e32770dd7cd23bc763bb3f
SSDEEP 12288:bMrLy90lnSJE2K3T2r5/eUsYRmnzyP7t98Z:ky/JPKD25e9c228
MD5 SHA1 SHA512 SSDEEP

Submit Download

s6671017.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s6671017.exe
Size 258KB
SHA256 a3c1515e911fb0faf36e08e496868089f21c797fa964c13e6e1b8f3c62d5e083
MD5 b6f79c36f77d438d3bb23566d5f684ac
SHA1 0f5bc4465cc2eca5659e89deb99803c9a294d3d9
SHA512 ce58b831f18f0a4a810a47561285fb00d7731321ff1868aed1e6930de5565d6f1e075fb7bf539f5c631f6b3f144baf6cf48f7b5f653213f00a9526a8bbd89228
SSDEEP 6144:uSR6eXgH6Irily2WtzH7SXIWv7lt78l5GWrlO2RMEImT:uSoeXNYSzzj78mWhO2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

s6671017.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s6671017.exe
Size 258KB
SHA256 a3c1515e911fb0faf36e08e496868089f21c797fa964c13e6e1b8f3c62d5e083
MD5 b6f79c36f77d438d3bb23566d5f684ac
SHA1 0f5bc4465cc2eca5659e89deb99803c9a294d3d9
SHA512 ce58b831f18f0a4a810a47561285fb00d7731321ff1868aed1e6930de5565d6f1e075fb7bf539f5c631f6b3f144baf6cf48f7b5f653213f00a9526a8bbd89228
SSDEEP 6144:uSR6eXgH6Irily2WtzH7SXIWv7lt78l5GWrlO2RMEImT:uSoeXNYSzzj78mWhO2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5032612.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5032612.exe
Size 197KB
SHA256 6799befa6344588d020e9fc8119211dc7c38ca264478edf2fd8d6b1f662d0ab0
MD5 801a89c4e658e6bb147abb587158cf1b
SHA1 760787bcb6d03e1fc3a903c01e14cde56a360c81
SHA512 e7f9bb59e70a95ba718bce38f42a38f65639b3e75d2c401f39d199582e1ad66973c67c5b0681e686efbafaa5b7402a18a2d7b889c25fbd8db3e08160cd59be28
SSDEEP 3072:Kty+bnr+O1a5GWp1icKAArDZz4N9GhbkrNEk1BAzQ3NMmnkEVOMfE3zC3oH:Kty+bnr+Np0yN90QEG3NHf4
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5032612.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5032612.exe
Size 197KB
SHA256 6799befa6344588d020e9fc8119211dc7c38ca264478edf2fd8d6b1f662d0ab0
MD5 801a89c4e658e6bb147abb587158cf1b
SHA1 760787bcb6d03e1fc3a903c01e14cde56a360c81
SHA512 e7f9bb59e70a95ba718bce38f42a38f65639b3e75d2c401f39d199582e1ad66973c67c5b0681e686efbafaa5b7402a18a2d7b889c25fbd8db3e08160cd59be28
SSDEEP 3072:Kty+bnr+O1a5GWp1icKAArDZz4N9GhbkrNEk1BAzQ3NMmnkEVOMfE3zC3oH:Kty+bnr+Np0yN90QEG3NHf4
MD5 SHA1 SHA512 SSDEEP

Submit Download

p6319437.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6319437.exe
Size 96KB
SHA256 0de2bf78f05aa8705b42e07b57b2b45273819ce4f3438b2dc2cd040870ad1bd5
MD5 a8c2b12785470b5cdc8246fb758d245b
SHA1 c5af2b4f0fe1699f432a5aa3e5c1e38a0876195a
SHA512 ee8bcd4ed765a7072aa4a2ea8c55accc9b4f0d486cd9a83fe7cac95322ff75839f79ec7500ee656d57c9204202516fb110c69b0489fe840b8f2b985979224d76
SSDEEP 1536:hLCVD53EJ9jAv4QkYdQ21+j1u7hZyFopgl8C7qQwH7Pxs:oVtUJGQ4dN2u7XyCgl8Cejxs
MD5 SHA1 SHA512 SSDEEP

Submit Download

p6319437.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6319437.exe
Size 96KB
SHA256 0de2bf78f05aa8705b42e07b57b2b45273819ce4f3438b2dc2cd040870ad1bd5
MD5 a8c2b12785470b5cdc8246fb758d245b
SHA1 c5af2b4f0fe1699f432a5aa3e5c1e38a0876195a
SHA512 ee8bcd4ed765a7072aa4a2ea8c55accc9b4f0d486cd9a83fe7cac95322ff75839f79ec7500ee656d57c9204202516fb110c69b0489fe840b8f2b985979224d76
SSDEEP 1536:hLCVD53EJ9jAv4QkYdQ21+j1u7hZyFopgl8C7qQwH7Pxs:oVtUJGQ4dN2u7XyCgl8Cejxs
MD5 SHA1 SHA512 SSDEEP

Submit Download

r7808526.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7808526.exe
Size 11KB
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

r7808526.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r7808526.exe
Size 11KB
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-169-0x0000000000010000-0x000000000001A000-memory.dmp

Download

memory/912-160-0x00000000001F0000-0x00000000001FA000-memory.dmp

Download

memory/2908-174-0x0000000000450000-0x0000000000480000-memory.dmp

Download

memory/2908-179-0x0000000009F70000-0x000000000A588000-memory.dmp

Download

memory/2908-180-0x000000000A620000-0x000000000A72A000-memory.dmp

Download

memory/2908-181-0x000000000A760000-0x000000000A772000-memory.dmp

Download

memory/2908-182-0x000000000A780000-0x000000000A7BC000-memory.dmp

Download

memory/2908-183-0x0000000002440000-0x0000000002450000-memory.dmp

Download

memory/2908-184-0x0000000002440000-0x0000000002450000-memory.dmp

Download

memory/4196-133-0x0000000000830000-0x00000000008C6000-memory.dmp

Download