healer | f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa

Analysis

max time kernel
150s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

393d6bd3d722abd31114cf500a6d31f5.exe
Size

919KB
MD5

393d6bd3d722abd31114cf500a6d31f5
SHA1

027ab7af8553f0a73e95d6c9c8ddeb0e12af8965
SHA256

f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa
SHA512

d97c315bd1aadb8f209099532d1d84265c305b7a0217dbbc172104c34be32d6a17d3473cfd89a44985d639e3e14bc723a3726b44fb857ab45120fc13feeac903
SSDEEP

24576:fyp+BYZ6J6nTHME00k7UjgA69JsKL0AI6bnscKUph5E:qpZsJAH87UjOHaonsrUP5

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/1752-162-0x0000000000560000-0x000000000059E000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6678803.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4696	y6713790.exe
2020	y9691614.exe
1752	k6678803.exe
3356	l0593874.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6678803.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y6713790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6713790.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y9691614.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y9691614.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	393d6bd3d722abd31114cf500a6d31f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	393d6bd3d722abd31114cf500a6d31f5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1752	k6678803.exe
1752	k6678803.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	k6678803.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4696	556	393d6bd3d722abd31114cf500a6d31f5.exe	84
PID 556 wrote to memory of 4696	556	393d6bd3d722abd31114cf500a6d31f5.exe	84
PID 556 wrote to memory of 4696	556	393d6bd3d722abd31114cf500a6d31f5.exe	84
PID 4696 wrote to memory of 2020	4696	y6713790.exe	85
PID 4696 wrote to memory of 2020	4696	y6713790.exe	85
PID 4696 wrote to memory of 2020	4696	y6713790.exe	85
PID 2020 wrote to memory of 1752	2020	y9691614.exe	87
PID 2020 wrote to memory of 1752	2020	y9691614.exe	87
PID 2020 wrote to memory of 1752	2020	y9691614.exe	87
PID 2020 wrote to memory of 3356	2020	y9691614.exe	91
PID 2020 wrote to memory of 3356	2020	y9691614.exe	91
PID 2020 wrote to memory of 3356	2020	y9691614.exe	91

C:\Users\Admin\AppData\Local\Temp\393d6bd3d722abd31114cf500a6d31f5.exe
"C:\Users\Admin\AppData\Local\Temp\393d6bd3d722abd31114cf500a6d31f5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe
      4⤵
      Executes dropped EXE
      PID:3356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe

Filesize
763KB

MD5
9cc9c916490c135defcc592f1f2a5374

SHA1
03f2aea5009ab3e5f8d2880b3904aa41de9fe537

SHA256
74a89129e242e5cf7c5332b993cad847e3f6edbf85df58c21f3efbb9b5269f23

SHA512
7e6132ce2d2b733287a767a963b57c0879ebc9b41e4a97c4a2f9bc9f5c8b4cc663ac3d25702516e2b8d0028091787f76e23d27a36f43726c9d0dd4946f68e684

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe

Filesize
763KB

MD5
9cc9c916490c135defcc592f1f2a5374

SHA1
03f2aea5009ab3e5f8d2880b3904aa41de9fe537

SHA256
74a89129e242e5cf7c5332b993cad847e3f6edbf85df58c21f3efbb9b5269f23

SHA512
7e6132ce2d2b733287a767a963b57c0879ebc9b41e4a97c4a2f9bc9f5c8b4cc663ac3d25702516e2b8d0028091787f76e23d27a36f43726c9d0dd4946f68e684

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe

Filesize
580KB

MD5
c5a850b9ed6a570f1369475362bbe02a

SHA1
b9bd9921109dee417ffae88e63f05f046d91aabe

SHA256
177f07125221507dd30a4895acaacc482b8deb8a39d3b93660e1d21a3a8788b5

SHA512
9c15b8d3bae0a746dd0bd6f8644f41bbadec9f3a8c7bd5d092d03d04daf3d8f11fb6bd841171d287d652fb94677fbf131031330ebf27d19a559550d059403436

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe

Filesize
580KB

MD5
c5a850b9ed6a570f1369475362bbe02a

SHA1
b9bd9921109dee417ffae88e63f05f046d91aabe

SHA256
177f07125221507dd30a4895acaacc482b8deb8a39d3b93660e1d21a3a8788b5

SHA512
9c15b8d3bae0a746dd0bd6f8644f41bbadec9f3a8c7bd5d092d03d04daf3d8f11fb6bd841171d287d652fb94677fbf131031330ebf27d19a559550d059403436

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe

Filesize
291KB

MD5
1950f38d40bcb31bcd36050781382251

SHA1
88757c97fccc4654d94f84effaa208190f456316

SHA256
567eb24dd7ab2978dfb9b2fd429db5689c4ec354f001a061fb37537384e5b9ec

SHA512
1af275f1119e06b030b96d34628a19f370b16dec4c996fa0451292b217b3535061a2a66c752437b9e77b9788ef66864a23fc997bc155897a98f01bbc35a66fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe

Filesize
291KB

MD5
1950f38d40bcb31bcd36050781382251

SHA1
88757c97fccc4654d94f84effaa208190f456316

SHA256
567eb24dd7ab2978dfb9b2fd429db5689c4ec354f001a061fb37537384e5b9ec

SHA512
1af275f1119e06b030b96d34628a19f370b16dec4c996fa0451292b217b3535061a2a66c752437b9e77b9788ef66864a23fc997bc155897a98f01bbc35a66fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe

Filesize
492KB

MD5
f543fa9e3d44db6851ca3a1af6a094c2

SHA1
4aa6879c80ef145d11f95810c41b7c5733e81f7a

SHA256
408ef900484b44fb7d41ebe3c3a8c06ce8f13cfc791803374666b15847272736

SHA512
efda8c364c056a0b12ac94f3606f9f93bfc6325378e57f148ae3b400cb6a31774705d083fb9ffa739c2b8c7441aba58c03481202e9df63fc14cb1fcd9aac0aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe

Filesize
492KB

MD5
f543fa9e3d44db6851ca3a1af6a094c2

SHA1
4aa6879c80ef145d11f95810c41b7c5733e81f7a

SHA256
408ef900484b44fb7d41ebe3c3a8c06ce8f13cfc791803374666b15847272736

SHA512
efda8c364c056a0b12ac94f3606f9f93bfc6325378e57f148ae3b400cb6a31774705d083fb9ffa739c2b8c7441aba58c03481202e9df63fc14cb1fcd9aac0aa6

Download Submit
memory/1752-167-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/1752-154-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1752-164-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/1752-162-0x0000000000560000-0x000000000059E000-memory.dmp

Filesize
248KB

Download
memory/1752-161-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/1752-155-0x0000000000560000-0x000000000059E000-memory.dmp

Filesize
248KB

Download
memory/1752-163-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3356-179-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/3356-174-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3356-171-0x0000000002050000-0x00000000020DC000-memory.dmp

Filesize
560KB

Download
memory/3356-180-0x0000000002050000-0x00000000020DC000-memory.dmp

Filesize
560KB

Download
memory/3356-182-0x0000000007FB0000-0x00000000085C8000-memory.dmp

Filesize
6.1MB

Download
memory/3356-183-0x00000000085D0000-0x00000000086DA000-memory.dmp

Filesize
1.0MB

Download
memory/3356-184-0x0000000006D30000-0x0000000006D40000-memory.dmp

Filesize
64KB

Download
memory/3356-185-0x0000000006CF0000-0x0000000006D02000-memory.dmp

Filesize
72KB

Download
memory/3356-186-0x00000000086E0000-0x000000000871C000-memory.dmp

Filesize
240KB

Download
memory/3356-187-0x0000000073D70000-0x0000000074520000-memory.dmp

Filesize
7.7MB

Download
memory/3356-188-0x0000000006D30000-0x0000000006D40000-memory.dmp

Filesize
64KB

Download