healer | 5b4c2b82b43bf011eed8569a0282968a5031803aea901fe2f1b6da0537879af2

Analysis

max time kernel
128s
max time network
142s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b6cac753ef31aec267cf8bc6.exe
Size

529KB
MD5

7b6cac753ef31aec267cf8bc6e961a0d
SHA1

deb25674f39685523acf0070f1b5d79e155b2013
SHA256

5b4c2b82b43bf011eed8569a0282968a5031803aea901fe2f1b6da0537879af2
SHA512

aa4d9de15e043bc2f2618c4741c413785c119bd3e35652c11c9a5d90a087c9fa41f2abd82a7ebc02d376b89cc23482f2a832f279ef3be402c94660d602ea03ec
SSDEEP

12288:lZ+A2fvXaRdnQgY8SnONV34lC7w5EzSTVr:n+AsvX82gYx24pyGr

Score

10^/10

healer redline furod dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

furod

77.91.68.70:19073

Attributes

auth_value
d2386245fe11799b28b4521492a5879d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral1/memory/2116-83-0x0000000000020000-0x000000000002A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3744679.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3744679.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k3744679.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3744679.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3744679.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3744679.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2876	y6269710.exe
2116	k3744679.exe
2784	l5551200.exe

Loads dropped DLL 8 IoCs

pid	Process
692	7b6cac753ef31aec267cf8bc6.exe
2876	y6269710.exe
2876	y6269710.exe
2876	y6269710.exe
2116	k3744679.exe
2876	y6269710.exe
2876	y6269710.exe
2784	l5551200.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	k3744679.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3744679.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7b6cac753ef31aec267cf8bc6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7b6cac753ef31aec267cf8bc6.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6269710.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6269710.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	k3744679.exe
2116	k3744679.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	k3744679.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 2876	692	7b6cac753ef31aec267cf8bc6.exe	29
PID 692 wrote to memory of 2876	692	7b6cac753ef31aec267cf8bc6.exe	29
PID 692 wrote to memory of 2876	692	7b6cac753ef31aec267cf8bc6.exe	29
PID 692 wrote to memory of 2876	692	7b6cac753ef31aec267cf8bc6.exe	29
PID 692 wrote to memory of 2876	692	7b6cac753ef31aec267cf8bc6.exe	29
PID 692 wrote to memory of 2876	692	7b6cac753ef31aec267cf8bc6.exe	29
PID 692 wrote to memory of 2876	692	7b6cac753ef31aec267cf8bc6.exe	29
PID 2876 wrote to memory of 2116	2876	y6269710.exe	30
PID 2876 wrote to memory of 2116	2876	y6269710.exe	30
PID 2876 wrote to memory of 2116	2876	y6269710.exe	30
PID 2876 wrote to memory of 2116	2876	y6269710.exe	30
PID 2876 wrote to memory of 2116	2876	y6269710.exe	30
PID 2876 wrote to memory of 2116	2876	y6269710.exe	30
PID 2876 wrote to memory of 2116	2876	y6269710.exe	30
PID 2876 wrote to memory of 2784	2876	y6269710.exe	32
PID 2876 wrote to memory of 2784	2876	y6269710.exe	32
PID 2876 wrote to memory of 2784	2876	y6269710.exe	32
PID 2876 wrote to memory of 2784	2876	y6269710.exe	32
PID 2876 wrote to memory of 2784	2876	y6269710.exe	32
PID 2876 wrote to memory of 2784	2876	y6269710.exe	32
PID 2876 wrote to memory of 2784	2876	y6269710.exe	32

C:\Users\Admin\AppData\Local\Temp\7b6cac753ef31aec267cf8bc6.exe
"C:\Users\Admin\AppData\Local\Temp\7b6cac753ef31aec267cf8bc6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6269710.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6269710.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6269710.exe

Filesize
261KB

MD5
093c52e9205d4dd0293f443f2d0c2512

SHA1
e931be0a77eba4cb85b79bb54ffaf6bb1da56cef

SHA256
42625df68b25a907dbd1c8f1b0c349ed3a455d817f5daced8d69ee5514414d27

SHA512
0a096a5070c91ede81fca95656d66060805743164e38e3abc9b42fa493a33fae1d3ed700c9067b918d50983f73b4312066936f8e32542e3d125e590f2192b051

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6269710.exe

Filesize
261KB

MD5
093c52e9205d4dd0293f443f2d0c2512

SHA1
e931be0a77eba4cb85b79bb54ffaf6bb1da56cef

SHA256
42625df68b25a907dbd1c8f1b0c349ed3a455d817f5daced8d69ee5514414d27

SHA512
0a096a5070c91ede81fca95656d66060805743164e38e3abc9b42fa493a33fae1d3ed700c9067b918d50983f73b4312066936f8e32542e3d125e590f2192b051

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe

Filesize
96KB

MD5
566f12b73758077b7ca3e6f79d8c40a4

SHA1
4e00342758d8da4e49b1c9c07865c0e51472321e

SHA256
9f8ed00602a70250a86d980148c8e254b4bf9cad3f1dfb27b5ccfe580dcdb85d

SHA512
0a51bbfb1265c7c5216211a057ed35567c3a41b7d00cd9792e8c8472bbe6821984fb7a2db5146c385bb075acbe12fa7823613aa493e484e003c16f978e10ed85

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe

Filesize
96KB

MD5
566f12b73758077b7ca3e6f79d8c40a4

SHA1
4e00342758d8da4e49b1c9c07865c0e51472321e

SHA256
9f8ed00602a70250a86d980148c8e254b4bf9cad3f1dfb27b5ccfe580dcdb85d

SHA512
0a51bbfb1265c7c5216211a057ed35567c3a41b7d00cd9792e8c8472bbe6821984fb7a2db5146c385bb075acbe12fa7823613aa493e484e003c16f978e10ed85

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe

Filesize
96KB

MD5
566f12b73758077b7ca3e6f79d8c40a4

SHA1
4e00342758d8da4e49b1c9c07865c0e51472321e

SHA256
9f8ed00602a70250a86d980148c8e254b4bf9cad3f1dfb27b5ccfe580dcdb85d

SHA512
0a51bbfb1265c7c5216211a057ed35567c3a41b7d00cd9792e8c8472bbe6821984fb7a2db5146c385bb075acbe12fa7823613aa493e484e003c16f978e10ed85

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe

Filesize
258KB

MD5
d3f815d367d6e66dd1e5f39b2b77a401

SHA1
d95189405c97851a0c9de08a98f300601e6d7fc5

SHA256
adfa89acbe26b1c516e5531160dc504e8eb56464a56efd1cc33fdd86d99b4afb

SHA512
e426df72465408794e2b42b2d9078c9e2a8640efe4c674343a62a1899118a4ebeed95f59d4f0461b7dffa2b6eee788764c708b4fc832d3e66db4b339493efae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe

Filesize
258KB

MD5
d3f815d367d6e66dd1e5f39b2b77a401

SHA1
d95189405c97851a0c9de08a98f300601e6d7fc5

SHA256
adfa89acbe26b1c516e5531160dc504e8eb56464a56efd1cc33fdd86d99b4afb

SHA512
e426df72465408794e2b42b2d9078c9e2a8640efe4c674343a62a1899118a4ebeed95f59d4f0461b7dffa2b6eee788764c708b4fc832d3e66db4b339493efae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe

Filesize
258KB

MD5
d3f815d367d6e66dd1e5f39b2b77a401

SHA1
d95189405c97851a0c9de08a98f300601e6d7fc5

SHA256
adfa89acbe26b1c516e5531160dc504e8eb56464a56efd1cc33fdd86d99b4afb

SHA512
e426df72465408794e2b42b2d9078c9e2a8640efe4c674343a62a1899118a4ebeed95f59d4f0461b7dffa2b6eee788764c708b4fc832d3e66db4b339493efae0

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6269710.exe

Filesize
261KB

MD5
093c52e9205d4dd0293f443f2d0c2512

SHA1
e931be0a77eba4cb85b79bb54ffaf6bb1da56cef

SHA256
42625df68b25a907dbd1c8f1b0c349ed3a455d817f5daced8d69ee5514414d27

SHA512
0a096a5070c91ede81fca95656d66060805743164e38e3abc9b42fa493a33fae1d3ed700c9067b918d50983f73b4312066936f8e32542e3d125e590f2192b051

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6269710.exe

Filesize
261KB

MD5
093c52e9205d4dd0293f443f2d0c2512

SHA1
e931be0a77eba4cb85b79bb54ffaf6bb1da56cef

SHA256
42625df68b25a907dbd1c8f1b0c349ed3a455d817f5daced8d69ee5514414d27

SHA512
0a096a5070c91ede81fca95656d66060805743164e38e3abc9b42fa493a33fae1d3ed700c9067b918d50983f73b4312066936f8e32542e3d125e590f2192b051

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe

Filesize
96KB

MD5
566f12b73758077b7ca3e6f79d8c40a4

SHA1
4e00342758d8da4e49b1c9c07865c0e51472321e

SHA256
9f8ed00602a70250a86d980148c8e254b4bf9cad3f1dfb27b5ccfe580dcdb85d

SHA512
0a51bbfb1265c7c5216211a057ed35567c3a41b7d00cd9792e8c8472bbe6821984fb7a2db5146c385bb075acbe12fa7823613aa493e484e003c16f978e10ed85

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe

Filesize
96KB

MD5
566f12b73758077b7ca3e6f79d8c40a4

SHA1
4e00342758d8da4e49b1c9c07865c0e51472321e

SHA256
9f8ed00602a70250a86d980148c8e254b4bf9cad3f1dfb27b5ccfe580dcdb85d

SHA512
0a51bbfb1265c7c5216211a057ed35567c3a41b7d00cd9792e8c8472bbe6821984fb7a2db5146c385bb075acbe12fa7823613aa493e484e003c16f978e10ed85

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3744679.exe

Filesize
96KB

MD5
566f12b73758077b7ca3e6f79d8c40a4

SHA1
4e00342758d8da4e49b1c9c07865c0e51472321e

SHA256
9f8ed00602a70250a86d980148c8e254b4bf9cad3f1dfb27b5ccfe580dcdb85d

SHA512
0a51bbfb1265c7c5216211a057ed35567c3a41b7d00cd9792e8c8472bbe6821984fb7a2db5146c385bb075acbe12fa7823613aa493e484e003c16f978e10ed85

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe

Filesize
258KB

MD5
d3f815d367d6e66dd1e5f39b2b77a401

SHA1
d95189405c97851a0c9de08a98f300601e6d7fc5

SHA256
adfa89acbe26b1c516e5531160dc504e8eb56464a56efd1cc33fdd86d99b4afb

SHA512
e426df72465408794e2b42b2d9078c9e2a8640efe4c674343a62a1899118a4ebeed95f59d4f0461b7dffa2b6eee788764c708b4fc832d3e66db4b339493efae0

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe

Filesize
258KB

MD5
d3f815d367d6e66dd1e5f39b2b77a401

SHA1
d95189405c97851a0c9de08a98f300601e6d7fc5

SHA256
adfa89acbe26b1c516e5531160dc504e8eb56464a56efd1cc33fdd86d99b4afb

SHA512
e426df72465408794e2b42b2d9078c9e2a8640efe4c674343a62a1899118a4ebeed95f59d4f0461b7dffa2b6eee788764c708b4fc832d3e66db4b339493efae0

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5551200.exe

Filesize
258KB

MD5
d3f815d367d6e66dd1e5f39b2b77a401

SHA1
d95189405c97851a0c9de08a98f300601e6d7fc5

SHA256
adfa89acbe26b1c516e5531160dc504e8eb56464a56efd1cc33fdd86d99b4afb

SHA512
e426df72465408794e2b42b2d9078c9e2a8640efe4c674343a62a1899118a4ebeed95f59d4f0461b7dffa2b6eee788764c708b4fc832d3e66db4b339493efae0

Download Submit
memory/692-54-0x0000000000490000-0x0000000000504000-memory.dmp

Filesize
464KB

Download
memory/2116-83-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/2784-97-0x00000000002A0000-0x00000000002D0000-memory.dmp

Filesize
192KB

Download
memory/2784-101-0x0000000000B10000-0x0000000000B16000-memory.dmp

Filesize
24KB

Download
memory/2784-102-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/2784-103-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download