healer | 87e2f19d070b4fcf5e3514e43e25b6a720ef862178a6068227278bb26c5487ec

Analysis

max time kernel
128s
max time network
142s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

198603d17746063bbcb7f248a.exe
Size

538KB
MD5

198603d17746063bbcb7f248a4f62f73
SHA1

3696dbcbd0acf06dc051cf350da3d71b7d29cb65
SHA256

87e2f19d070b4fcf5e3514e43e25b6a720ef862178a6068227278bb26c5487ec
SHA512

37985970189b69e40207db2237139c295e215536b818a658d8d2c6bc22ac54e679e1ac4c014b2a317119a1731b30d515f3400145f16c8e335b3cd74e2987ab24
SSDEEP

12288:xegHDVz47sr4wY1aHmra1coPp6XmGd4nSG:Rjt47snYoucI/dSS

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral1/memory/2252-83-0x0000000000020000-0x000000000002A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8802469.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8802469.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3020	y2083379.exe
2252	k8802469.exe
3000	l8002337.exe

Loads dropped DLL 8 IoCs

pid	Process
3044	198603d17746063bbcb7f248a.exe
3020	y2083379.exe
3020	y2083379.exe
3020	y2083379.exe
2252	k8802469.exe
3020	y2083379.exe
3020	y2083379.exe
3000	l8002337.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8802469.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	198603d17746063bbcb7f248a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	198603d17746063bbcb7f248a.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2083379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2083379.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	k8802469.exe
2252	k8802469.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	k8802469.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3020	3044	198603d17746063bbcb7f248a.exe	29
PID 3044 wrote to memory of 3020	3044	198603d17746063bbcb7f248a.exe	29
PID 3044 wrote to memory of 3020	3044	198603d17746063bbcb7f248a.exe	29
PID 3044 wrote to memory of 3020	3044	198603d17746063bbcb7f248a.exe	29
PID 3044 wrote to memory of 3020	3044	198603d17746063bbcb7f248a.exe	29
PID 3044 wrote to memory of 3020	3044	198603d17746063bbcb7f248a.exe	29
PID 3044 wrote to memory of 3020	3044	198603d17746063bbcb7f248a.exe	29
PID 3020 wrote to memory of 2252	3020	y2083379.exe	30
PID 3020 wrote to memory of 2252	3020	y2083379.exe	30
PID 3020 wrote to memory of 2252	3020	y2083379.exe	30
PID 3020 wrote to memory of 2252	3020	y2083379.exe	30
PID 3020 wrote to memory of 2252	3020	y2083379.exe	30
PID 3020 wrote to memory of 2252	3020	y2083379.exe	30
PID 3020 wrote to memory of 2252	3020	y2083379.exe	30
PID 3020 wrote to memory of 3000	3020	y2083379.exe	32
PID 3020 wrote to memory of 3000	3020	y2083379.exe	32
PID 3020 wrote to memory of 3000	3020	y2083379.exe	32
PID 3020 wrote to memory of 3000	3020	y2083379.exe	32
PID 3020 wrote to memory of 3000	3020	y2083379.exe	32
PID 3020 wrote to memory of 3000	3020	y2083379.exe	32
PID 3020 wrote to memory of 3000	3020	y2083379.exe	32

C:\Users\Admin\AppData\Local\Temp\198603d17746063bbcb7f248a.exe
"C:\Users\Admin\AppData\Local\Temp\198603d17746063bbcb7f248a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe

Filesize
261KB

MD5
4f5a8efc33c6bde999182b2f98b35837

SHA1
eb749f0b56bf8e11b9ab72797462150effa14e27

SHA256
affce7573b4af34ac560ccfda4d558df29e593d63f69ed6f8c6c709d825cc9b2

SHA512
79f1e7c2c17c3134ec9a39faa30dfc227c8da6c24d3f6a740d5dd16d6ea53a0901ea3261987cd1d8ce2cda5e9439ba1d5a7da5f2c8510da335fcdda5dde9629a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe

Filesize
261KB

MD5
4f5a8efc33c6bde999182b2f98b35837

SHA1
eb749f0b56bf8e11b9ab72797462150effa14e27

SHA256
affce7573b4af34ac560ccfda4d558df29e593d63f69ed6f8c6c709d825cc9b2

SHA512
79f1e7c2c17c3134ec9a39faa30dfc227c8da6c24d3f6a740d5dd16d6ea53a0901ea3261987cd1d8ce2cda5e9439ba1d5a7da5f2c8510da335fcdda5dde9629a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe

Filesize
261KB

MD5
4f5a8efc33c6bde999182b2f98b35837

SHA1
eb749f0b56bf8e11b9ab72797462150effa14e27

SHA256
affce7573b4af34ac560ccfda4d558df29e593d63f69ed6f8c6c709d825cc9b2

SHA512
79f1e7c2c17c3134ec9a39faa30dfc227c8da6c24d3f6a740d5dd16d6ea53a0901ea3261987cd1d8ce2cda5e9439ba1d5a7da5f2c8510da335fcdda5dde9629a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe

Filesize
261KB

MD5
4f5a8efc33c6bde999182b2f98b35837

SHA1
eb749f0b56bf8e11b9ab72797462150effa14e27

SHA256
affce7573b4af34ac560ccfda4d558df29e593d63f69ed6f8c6c709d825cc9b2

SHA512
79f1e7c2c17c3134ec9a39faa30dfc227c8da6c24d3f6a740d5dd16d6ea53a0901ea3261987cd1d8ce2cda5e9439ba1d5a7da5f2c8510da335fcdda5dde9629a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
memory/2252-83-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/3000-97-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/3000-101-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/3000-102-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/3000-103-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/3044-54-0x0000000000220000-0x0000000000294000-memory.dmp

Filesize
464KB

Download