healer | 978e171cd435407b5d649543a5f213344d9b9d293c3ec582611301fc874c971a

Analysis

max time kernel
152s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2023, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5eca1019c6ec1fbc5b0143c7836df0ca.exe
Size 389KB
Sample230720-h94beadd69
SHA256 978e171cd435407b5d649543a5f213344d9b9d293c3ec582611301fc874c971a
MD5 5eca1019c6ec1fbc5b0143c7836df0ca
SHA1 174a5053bb6cb656f0ca4b8f2e012c9ee0704642
SHA512 679c8fd17831502dd1a268febc80012653d7ccc10b00052231615beb16a481c6738ea5c9a2098d268fae8c97ed64ef3766d86a092289e1339fe048492c95fe8c
SSDEEP 12288:DMr7y907Q+pQWEErMXujR9c1uXVwXk6JVs:gyQQz49FwXTK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000230da-148.dat	healer
behavioral2/files/0x00080000000230da-149.dat	healer
behavioral2/memory/2484-150-0x00000000003D0000-0x00000000003DA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p4466110.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p4466110.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p4466110.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p4466110.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p4466110.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p4466110.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4588	z1030284.exe
2484	p4466110.exe
2628	r0460277.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p4466110.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1030284.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5eca1019c6ec1fbc5b0143c7836df0ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5eca1019c6ec1fbc5b0143c7836df0ca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1030284.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	p4466110.exe
2484	p4466110.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	p4466110.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 4588	1092	5eca1019c6ec1fbc5b0143c7836df0ca.exe	88
PID 1092 wrote to memory of 4588	1092	5eca1019c6ec1fbc5b0143c7836df0ca.exe	88
PID 1092 wrote to memory of 4588	1092	5eca1019c6ec1fbc5b0143c7836df0ca.exe	88
PID 4588 wrote to memory of 2484	4588	z1030284.exe	89
PID 4588 wrote to memory of 2484	4588	z1030284.exe	89
PID 4588 wrote to memory of 2628	4588	z1030284.exe	90
PID 4588 wrote to memory of 2628	4588	z1030284.exe	90
PID 4588 wrote to memory of 2628	4588	z1030284.exe	90

C:\Users\Admin\AppData\Local\Temp\5eca1019c6ec1fbc5b0143c7836df0ca.exe
"C:\Users\Admin\AppData\Local\Temp\5eca1019c6ec1fbc5b0143c7836df0ca.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1030284.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1030284.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4466110.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4466110.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0460277.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0460277.exe
    3⤵
    - Executes dropped EXE
    PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z1030284.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1030284.exe
Size 206KB
SHA256 e211d2f2fe61a712bf067cd421c9e721d7e5dbcb09cc3d1b34852648e4d99e62
MD5 896ca9460480e38bfa02994acd7c6e63
SHA1 13df7070b3773714b0f6d1b61aeba7110b6fbe12
SHA512 5ba6b376a45633c0078d47f81b68f22db08d6620e96ce01befd2e917407ee9d6fc8ed91a1e1aba3a9f513c8bdfb2928f65577709af8daa46dc57d0f6635782b8
SSDEEP 6144:KAy+bnr+zp0yN90QElJ0kt3zP0yzNNztsc:wMrny901tjP0Sz2c
MD5 SHA1 SHA512 SSDEEP

Submit Download

z1030284.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1030284.exe
Size 206KB
SHA256 e211d2f2fe61a712bf067cd421c9e721d7e5dbcb09cc3d1b34852648e4d99e62
MD5 896ca9460480e38bfa02994acd7c6e63
SHA1 13df7070b3773714b0f6d1b61aeba7110b6fbe12
SHA512 5ba6b376a45633c0078d47f81b68f22db08d6620e96ce01befd2e917407ee9d6fc8ed91a1e1aba3a9f513c8bdfb2928f65577709af8daa46dc57d0f6635782b8
SSDEEP 6144:KAy+bnr+zp0yN90QElJ0kt3zP0yzNNztsc:wMrny901tjP0Sz2c
MD5 SHA1 SHA512 SSDEEP

Submit Download

p4466110.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4466110.exe
Size 14KB
SHA256 95ee58ad597640acea258f1b32daba6517201e24b4b5de1b405860850bd5cd4a
MD5 cbb14b86f8565f9edfccaf8c2d41c848
SHA1 67817c423210a0bd7f1668e90b0f289d30abb1a6
SHA512 a1f75d40d8c82c288a5ca31354463700c3b8342af9571a085e1c102165d56c66cbf73d59a0ae5ec9568c43fd76fb343b5e5bf79a784a9fb73db1f7e31ac75f7c
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

p4466110.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4466110.exe
Size 14KB
SHA256 95ee58ad597640acea258f1b32daba6517201e24b4b5de1b405860850bd5cd4a
MD5 cbb14b86f8565f9edfccaf8c2d41c848
SHA1 67817c423210a0bd7f1668e90b0f289d30abb1a6
SHA512 a1f75d40d8c82c288a5ca31354463700c3b8342af9571a085e1c102165d56c66cbf73d59a0ae5ec9568c43fd76fb343b5e5bf79a784a9fb73db1f7e31ac75f7c
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

r0460277.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0460277.exe
Size 173KB
SHA256 29716597a728f83e2019e13d3ebadd8d05549cd1c4f0016c1503e247fd3961d0
MD5 5b78c82d27d97394b5b6d6ce342ff6e6
SHA1 208303a8455695192865897c101ae5a02c1133ee
SHA512 51cc6bcf0bcb67fe155c3c1af84922dac055ef0cfa5d851e0d45ee3a0eac46722e65e45e94aba6b92dae94241607ff7fec8c153776ebf5d928f66889948ddc85
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

r0460277.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0460277.exe
Size 173KB
SHA256 29716597a728f83e2019e13d3ebadd8d05549cd1c4f0016c1503e247fd3961d0
MD5 5b78c82d27d97394b5b6d6ce342ff6e6
SHA1 208303a8455695192865897c101ae5a02c1133ee
SHA512 51cc6bcf0bcb67fe155c3c1af84922dac055ef0cfa5d851e0d45ee3a0eac46722e65e45e94aba6b92dae94241607ff7fec8c153776ebf5d928f66889948ddc85
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2484-150-0x00000000003D0000-0x00000000003DA000-memory.dmp

Download

memory/2484-154-0x00007FFC358F0000-0x00007FFC363B1000-memory.dmp

Download

memory/2484-152-0x00007FFC358F0000-0x00007FFC363B1000-memory.dmp

Download

memory/2484-151-0x00007FFC358F0000-0x00007FFC363B1000-memory.dmp

Download

memory/2628-158-0x0000000073BF0000-0x00000000743A0000-memory.dmp

Download

memory/2628-159-0x00000000003F0000-0x0000000000420000-memory.dmp

Download

memory/2628-160-0x000000000A820000-0x000000000AE38000-memory.dmp

Download

memory/2628-161-0x000000000A3A0000-0x000000000A4AA000-memory.dmp

Download

memory/2628-162-0x0000000004D30000-0x0000000004D40000-memory.dmp

Download

memory/2628-163-0x000000000A2E0000-0x000000000A2F2000-memory.dmp

Download

memory/2628-164-0x000000000A340000-0x000000000A37C000-memory.dmp

Download

memory/2628-165-0x0000000073BF0000-0x00000000743A0000-memory.dmp

Download

memory/2628-166-0x0000000004D30000-0x0000000004D40000-memory.dmp

Download