healer | efcf2c587acbaf2e12ee67d4b8173c32ee00f1e5669cb295af64dc690a6893be

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b810e661378b0a3e898aa32c65e8659d.exe
Size 538KB
Sample230710-k785zshe65
SHA256 efcf2c587acbaf2e12ee67d4b8173c32ee00f1e5669cb295af64dc690a6893be
MD5 b810e661378b0a3e898aa32c65e8659d
SHA1 fe7bb3b05ad283bec668065c7c507ef9dcf6f0c8
SHA512 acc0d8fc1075292dadd5efa170fd4d345b45ce545ed4c805fd34ce10bf151e1980aec0a574a472316a777ae53b0fd8e59710a9c0c857872901701b3b2de49dd1
SSDEEP 12288:7PugHdxz47lfx4Q+vtW0H+NaYnKn1AZM:7L9h47lf+Q+vtzQnKnqZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/3656-153-0x00000000001F0000-0x00000000001FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k2208963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k2208963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k2208963.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k2208963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k2208963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k2208963.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4756	y6851929.exe
3656	k2208963.exe
376	l8472753.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k2208963.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k2208963.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6851929.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b810e661378b0a3e898aa32c65e8659d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b810e661378b0a3e898aa32c65e8659d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6851929.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3656	k2208963.exe
3656	k2208963.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	k2208963.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4756	3524	b810e661378b0a3e898aa32c65e8659d.exe	86
PID 3524 wrote to memory of 4756	3524	b810e661378b0a3e898aa32c65e8659d.exe	86
PID 3524 wrote to memory of 4756	3524	b810e661378b0a3e898aa32c65e8659d.exe	86
PID 4756 wrote to memory of 3656	4756	y6851929.exe	87
PID 4756 wrote to memory of 3656	4756	y6851929.exe	87
PID 4756 wrote to memory of 3656	4756	y6851929.exe	87
PID 4756 wrote to memory of 376	4756	y6851929.exe	89
PID 4756 wrote to memory of 376	4756	y6851929.exe	89
PID 4756 wrote to memory of 376	4756	y6851929.exe	89

C:\Users\Admin\AppData\Local\Temp\b810e661378b0a3e898aa32c65e8659d.exe
"C:\Users\Admin\AppData\Local\Temp\b810e661378b0a3e898aa32c65e8659d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6851929.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6851929.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2208963.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2208963.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8472753.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8472753.exe
    3⤵
    - Executes dropped EXE
    PID:376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

y6851929.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6851929.exe
Size 261KB
SHA256 c3fb43e628d5de8dcf6ad7c0b978a537a1bdaa0010e93bd5b4e1ac5ccdbbe7d6
MD5 03d384857694a4f754ea47d5ddcc7ecc
SHA1 fb70900664022b3e4e9832ebe872aaf6a8bf8da4
SHA512 00ccca6138613f227a0d3bf09352163acd537095c4da6c2a0ffc09b53999f5a74ee2ccdf803606dc77a2a729e678ad0006c005cc8e3209a6237e9315d8c212e1
SSDEEP 6144:KNy+bnr+Op0yN90QEOqVHyDNNkDjcUqugcASvd1Q:rMr+y904qVSpN6SoVi
MD5 SHA1 SHA512 SSDEEP

Submit Download

y6851929.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6851929.exe
Size 261KB
SHA256 c3fb43e628d5de8dcf6ad7c0b978a537a1bdaa0010e93bd5b4e1ac5ccdbbe7d6
MD5 03d384857694a4f754ea47d5ddcc7ecc
SHA1 fb70900664022b3e4e9832ebe872aaf6a8bf8da4
SHA512 00ccca6138613f227a0d3bf09352163acd537095c4da6c2a0ffc09b53999f5a74ee2ccdf803606dc77a2a729e678ad0006c005cc8e3209a6237e9315d8c212e1
SSDEEP 6144:KNy+bnr+Op0yN90QEOqVHyDNNkDjcUqugcASvd1Q:rMr+y904qVSpN6SoVi
MD5 SHA1 SHA512 SSDEEP

Submit Download

k2208963.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2208963.exe
Size 104KB
SHA256 d8899ca29c3ea0a80256f90954d194d513b62345b8e00e2f485d06f01cbdcbad
MD5 33215e8764441fa98cac77704c1cceeb
SHA1 3d84224608d4c2e4e0aa6c95207a8b271b4c7459
SHA512 ee396fc440cebaf37dc4d27cfe072898e98b45c70e6aa6d3096ed8457452aa96d8e54a04d3f09ee00480be3f29abc45962837daf6f579241ead3f8675170581e
SSDEEP 1536:MU8qAbXciWeGdHN4TOJ+qveDJCU8oQb75x+Ui5AL7ieidrCzculsWtiH7cd/pnvs:vkbEzBNeOJHeW75x+ULLJcM/pLxfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

k2208963.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2208963.exe
Size 104KB
SHA256 d8899ca29c3ea0a80256f90954d194d513b62345b8e00e2f485d06f01cbdcbad
MD5 33215e8764441fa98cac77704c1cceeb
SHA1 3d84224608d4c2e4e0aa6c95207a8b271b4c7459
SHA512 ee396fc440cebaf37dc4d27cfe072898e98b45c70e6aa6d3096ed8457452aa96d8e54a04d3f09ee00480be3f29abc45962837daf6f579241ead3f8675170581e
SSDEEP 1536:MU8qAbXciWeGdHN4TOJ+qveDJCU8oQb75x+Ui5AL7ieidrCzculsWtiH7cd/pnvs:vkbEzBNeOJHeW75x+ULLJcM/pLxfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

l8472753.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8472753.exe
Size 266KB
SHA256 a8b67586e54900b88d82eca4bc335b226977e6a71968ea50e0b43dddfeae57df
MD5 8c7e9e5114cfe2561df51c210a77110b
SHA1 fe1be1f971de04f0db02e130e0b91719ae6be0d0
SHA512 c5e292ea3984c51ab8a3558ccfcaf6afb555deb1dec72a5b45c925e421df3c465960f1db83ad691949d74999d3437489834f559bfd7207b7e060c7a61883d74a
SSDEEP 3072:bYIM+iOHMwew7+picM/BsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:bYIMvOswD7UVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

l8472753.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8472753.exe
Size 266KB
SHA256 a8b67586e54900b88d82eca4bc335b226977e6a71968ea50e0b43dddfeae57df
MD5 8c7e9e5114cfe2561df51c210a77110b
SHA1 fe1be1f971de04f0db02e130e0b91719ae6be0d0
SHA512 c5e292ea3984c51ab8a3558ccfcaf6afb555deb1dec72a5b45c925e421df3c465960f1db83ad691949d74999d3437489834f559bfd7207b7e060c7a61883d74a
SSDEEP 3072:bYIM+iOHMwew7+picM/BsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:bYIMvOswD7UVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-162-0x0000000000450000-0x0000000000480000-memory.dmp

Download

memory/376-167-0x000000000A5F0000-0x000000000AC08000-memory.dmp

Download

memory/376-168-0x0000000009FF0000-0x000000000A0FA000-memory.dmp

Download

memory/376-169-0x000000000A130000-0x000000000A142000-memory.dmp

Download

memory/376-170-0x000000000A150000-0x000000000A18C000-memory.dmp

Download

memory/376-171-0x0000000004A40000-0x0000000004A50000-memory.dmp

Download

memory/376-172-0x0000000004A40000-0x0000000004A50000-memory.dmp

Download

memory/3524-133-0x0000000000690000-0x0000000000704000-memory.dmp

Download

memory/3656-153-0x00000000001F0000-0x00000000001FA000-memory.dmp

Download