healer | 3cecf7bfd01344832df68fda7f61935c8ba6a11b6a9cc9acab32b0dda22d733e

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0873a9150a1954c8b90bcfecbe801b49.exe
Size 538KB
Sample230710-paz82aba4t
SHA256 3cecf7bfd01344832df68fda7f61935c8ba6a11b6a9cc9acab32b0dda22d733e
MD5 0873a9150a1954c8b90bcfecbe801b49
SHA1 9405425954bacab3c83471446a152d512c2f7fb7
SHA512 b638a5bbb0a28535ac24c08fa66a7ae31bf4136c31ffd9dcd23586b74f1a757f8123d0f4e3f3f733440ddc4b026315ddfeea191c79c2436e9371e5b8480ffb53
SSDEEP 12288:2+gHF3z47ag9rI4Gv65ZNEGffiXA+N9CK:Alj47agtIk5sGH+b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/5052-153-0x00000000001F0000-0x00000000001FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6262035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6262035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6262035.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6262035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6262035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6262035.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1376	y3790216.exe
5052	k6262035.exe
3192	l0118264.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6262035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6262035.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3790216.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0873a9150a1954c8b90bcfecbe801b49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0873a9150a1954c8b90bcfecbe801b49.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y3790216.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5052	k6262035.exe
5052	k6262035.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	k6262035.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1376	5092	0873a9150a1954c8b90bcfecbe801b49.exe	85
PID 5092 wrote to memory of 1376	5092	0873a9150a1954c8b90bcfecbe801b49.exe	85
PID 5092 wrote to memory of 1376	5092	0873a9150a1954c8b90bcfecbe801b49.exe	85
PID 1376 wrote to memory of 5052	1376	y3790216.exe	87
PID 1376 wrote to memory of 5052	1376	y3790216.exe	87
PID 1376 wrote to memory of 5052	1376	y3790216.exe	87
PID 1376 wrote to memory of 3192	1376	y3790216.exe	89
PID 1376 wrote to memory of 3192	1376	y3790216.exe	89
PID 1376 wrote to memory of 3192	1376	y3790216.exe	89

C:\Users\Admin\AppData\Local\Temp\0873a9150a1954c8b90bcfecbe801b49.exe
"C:\Users\Admin\AppData\Local\Temp\0873a9150a1954c8b90bcfecbe801b49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3790216.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3790216.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6262035.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6262035.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0118264.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0118264.exe
    3⤵
    - Executes dropped EXE
    PID:3192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

y3790216.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3790216.exe
Size 261KB
SHA256 154a00b9a376c20ca879bd89e1894f20ada401e6b794d6a281f7ffb55a372b14
MD5 1439aa8aa55f204b48ed1ff719ebb440
SHA1 866a89bfb9794e9144cdf1cb32a99ce63bca7c26
SHA512 37e22f7679a52d2b127b7ff87275eb83907f302d2987369585ce12d1f419f364d7b18df3be8be456180d8ba1da821a0842e7989ef316e8a515f365a8f5011e1c
SSDEEP 3072:K8y+bnr+O115GWp1icKAArDZz4N9GhbkrNEk1nxNZRWQnNW9QPhXdnuf1XUdoO2+:K8y+bnr+ap0yN90QEgL19lJwvO2RQDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

y3790216.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3790216.exe
Size 261KB
SHA256 154a00b9a376c20ca879bd89e1894f20ada401e6b794d6a281f7ffb55a372b14
MD5 1439aa8aa55f204b48ed1ff719ebb440
SHA1 866a89bfb9794e9144cdf1cb32a99ce63bca7c26
SHA512 37e22f7679a52d2b127b7ff87275eb83907f302d2987369585ce12d1f419f364d7b18df3be8be456180d8ba1da821a0842e7989ef316e8a515f365a8f5011e1c
SSDEEP 3072:K8y+bnr+O115GWp1icKAArDZz4N9GhbkrNEk1nxNZRWQnNW9QPhXdnuf1XUdoO2+:K8y+bnr+ap0yN90QEgL19lJwvO2RQDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

k6262035.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6262035.exe
Size 104KB
SHA256 8e10a5f052c486728162aad6f20ada41eb7a11b1e3063f696bd3093d8d357ad6
MD5 794a21e6000b7fd6337fa72a891e5933
SHA1 e7f712db50bd44a4054d6bb057cf8b7ffc8980cf
SHA512 0bc5dc4e0f9b08e733ad86585f0aaf87f4b8bb700c2e11e71e2be4ca48bafb7a05b88ef9eea87e67aa929f18fd097c54abfbeb6a1f87ed4843df6d90968ea2d6
SSDEEP 1536:HUMqAbXciWeGdHN4TOJ+qveDJCU8oQb75x+Ui5AL7ieidrCzculsWtiH7cd/bnvs:0UbEzBNeOJHeW75x+ULLJcM/bLxfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

k6262035.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6262035.exe
Size 104KB
SHA256 8e10a5f052c486728162aad6f20ada41eb7a11b1e3063f696bd3093d8d357ad6
MD5 794a21e6000b7fd6337fa72a891e5933
SHA1 e7f712db50bd44a4054d6bb057cf8b7ffc8980cf
SHA512 0bc5dc4e0f9b08e733ad86585f0aaf87f4b8bb700c2e11e71e2be4ca48bafb7a05b88ef9eea87e67aa929f18fd097c54abfbeb6a1f87ed4843df6d90968ea2d6
SSDEEP 1536:HUMqAbXciWeGdHN4TOJ+qveDJCU8oQb75x+Ui5AL7ieidrCzculsWtiH7cd/bnvs:0UbEzBNeOJHeW75x+ULLJcM/bLxfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

l0118264.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0118264.exe
Size 266KB
SHA256 8d110a0f5fa6fe8aa5018c74e8226524e673e895959108af026ba4cf0aa365cf
MD5 29ea327e44aa1e750f230c17eca422e8
SHA1 a50a4913d4f6365ebe3d664225f0abd1d6a9500c
SHA512 d1f38a3e85542f92f0a8506650f9fe7062109a23920c94a6615dbf8cec699a8c90de04333e5e63427cb8e0936d8b42e80b64dc48fefd24344d07e030462ed81e
SSDEEP 3072:cRnHs+iOHMwew7+picM/PsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:EHsvOswD7uVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

l0118264.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0118264.exe
Size 266KB
SHA256 8d110a0f5fa6fe8aa5018c74e8226524e673e895959108af026ba4cf0aa365cf
MD5 29ea327e44aa1e750f230c17eca422e8
SHA1 a50a4913d4f6365ebe3d664225f0abd1d6a9500c
SHA512 d1f38a3e85542f92f0a8506650f9fe7062109a23920c94a6615dbf8cec699a8c90de04333e5e63427cb8e0936d8b42e80b64dc48fefd24344d07e030462ed81e
SSDEEP 3072:cRnHs+iOHMwew7+picM/PsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:EHsvOswD7uVVctqoDo/QnfzKv2tq9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3192-162-0x0000000000520000-0x0000000000550000-memory.dmp

Download

memory/3192-167-0x0000000009E20000-0x000000000A438000-memory.dmp

Download

memory/3192-168-0x000000000A4D0000-0x000000000A5DA000-memory.dmp

Download

memory/3192-169-0x000000000A610000-0x000000000A622000-memory.dmp

Download

memory/3192-170-0x000000000A630000-0x000000000A66C000-memory.dmp

Download

memory/3192-171-0x0000000004A80000-0x0000000004A90000-memory.dmp

Download

memory/3192-172-0x0000000004A80000-0x0000000004A90000-memory.dmp

Download

memory/5052-153-0x00000000001F0000-0x00000000001FA000-memory.dmp

Download

memory/5092-133-0x00000000005B0000-0x0000000000624000-memory.dmp

Download