healer | ba8c58d697662fa7c7a7f8f13b232e1dbbb527bd1e73fc435f53e86c53994a1e

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2023, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f266d30dcddb16dad8a39b078b5a581a.exe
Size 389KB
Sample230720-jgdqqade52
SHA256 ba8c58d697662fa7c7a7f8f13b232e1dbbb527bd1e73fc435f53e86c53994a1e
MD5 f266d30dcddb16dad8a39b078b5a581a
SHA1 79dec13b8a0f6f1e683cb667d52137274c2830c6
SHA512 115980f6be5466616cbb85eff4f7ae7acd361915f0c7d536937cc4f31d9e4f45121ca929283424de8ad90b4c8fa19b8e196496860534846fb0e3fa258944d308
SSDEEP 6144:Kny+bnr+Op0yN90QEWVVaBsNThp+DRVD3WD2bnf2DTNJmxa35KW:VMrKy90wNtpmLLfM+apKW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fb-145.dat	healer
behavioral2/files/0x00070000000231fb-146.dat	healer
behavioral2/memory/2860-147-0x0000000000760000-0x000000000076A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p9632857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p9632857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p9632857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p9632857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p9632857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p9632857.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
528	z2786390.exe
2860	p9632857.exe
4688	r1587596.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p9632857.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f266d30dcddb16dad8a39b078b5a581a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f266d30dcddb16dad8a39b078b5a581a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z2786390.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2786390.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	p9632857.exe
2860	p9632857.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	p9632857.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 528	2748	f266d30dcddb16dad8a39b078b5a581a.exe	86
PID 2748 wrote to memory of 528	2748	f266d30dcddb16dad8a39b078b5a581a.exe	86
PID 2748 wrote to memory of 528	2748	f266d30dcddb16dad8a39b078b5a581a.exe	86
PID 528 wrote to memory of 2860	528	z2786390.exe	87
PID 528 wrote to memory of 2860	528	z2786390.exe	87
PID 528 wrote to memory of 4688	528	z2786390.exe	92
PID 528 wrote to memory of 4688	528	z2786390.exe	92
PID 528 wrote to memory of 4688	528	z2786390.exe	92

C:\Users\Admin\AppData\Local\Temp\f266d30dcddb16dad8a39b078b5a581a.exe
"C:\Users\Admin\AppData\Local\Temp\f266d30dcddb16dad8a39b078b5a581a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2786390.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2786390.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9632857.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9632857.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1587596.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1587596.exe
    3⤵
    - Executes dropped EXE
    PID:4688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z2786390.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2786390.exe
Size 206KB
SHA256 dda591f48d79d55118bc0226249c925606bf991be5340a6e497483e0aa7713aa
MD5 ac2acd7f012b94035c1de830d3802ecc
SHA1 0a5a0423604b69a7c71dbcff3f522ae9600f6364
SHA512 5a8aaee098cc7744e3f28e9ee51eb3376813666612eb6eafac91c4ce6c8fd3814be429b202d468db582a6e95b66438044c90f9b4c5e9bc0a935c13f64ae44c44
SSDEEP 3072:KKy+bnr+O1C5GWp1icKAArDZz4N9GhbkrNEk12tWk6YjeHNhGejsSuuo+:KKy+bnr+pp0yN90QEnWk9ONhGe4SuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

z2786390.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2786390.exe
Size 206KB
SHA256 dda591f48d79d55118bc0226249c925606bf991be5340a6e497483e0aa7713aa
MD5 ac2acd7f012b94035c1de830d3802ecc
SHA1 0a5a0423604b69a7c71dbcff3f522ae9600f6364
SHA512 5a8aaee098cc7744e3f28e9ee51eb3376813666612eb6eafac91c4ce6c8fd3814be429b202d468db582a6e95b66438044c90f9b4c5e9bc0a935c13f64ae44c44
SSDEEP 3072:KKy+bnr+O1C5GWp1icKAArDZz4N9GhbkrNEk12tWk6YjeHNhGejsSuuo+:KKy+bnr+pp0yN90QEnWk9ONhGe4SuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

p9632857.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9632857.exe
Size 14KB
SHA256 ee53a5084a3d3ca1aa4f077f3ae843a18f47edd77f7491a7394598cdc94ba6e0
MD5 24fca3ea4b121f03dcb63924705510a9
SHA1 e0c3344727421ce345c709bb75fe6a4dcbe70563
SHA512 104e8ae70869f9ac524f531805aca971d07ec703deddb162c878c275bb774f4190b13af56eb0dfb70727558c65234535d4872de2aa8d5809ef65398b6c5bf17b
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

p9632857.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9632857.exe
Size 14KB
SHA256 ee53a5084a3d3ca1aa4f077f3ae843a18f47edd77f7491a7394598cdc94ba6e0
MD5 24fca3ea4b121f03dcb63924705510a9
SHA1 e0c3344727421ce345c709bb75fe6a4dcbe70563
SHA512 104e8ae70869f9ac524f531805aca971d07ec703deddb162c878c275bb774f4190b13af56eb0dfb70727558c65234535d4872de2aa8d5809ef65398b6c5bf17b
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

r1587596.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1587596.exe
Size 173KB
SHA256 177de47d6715c85d500d7181d939960ee8633c7f1cf62ee5b6037014b0bd9fe1
MD5 7ae6b346faa69efbe18c1e7e36413d52
SHA1 97cd788fe398f6d73c944ba5da7403dff6427fb3
SHA512 76ddfd3549e2d96748e897aad77b7ef6e6b6b18188ebe6b63671abcbf1e38fadb15d5be9edaf41d1b3bd937e473a7552b59899fb7586d1afc0696f2b271932f5
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

r1587596.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1587596.exe
Size 173KB
SHA256 177de47d6715c85d500d7181d939960ee8633c7f1cf62ee5b6037014b0bd9fe1
MD5 7ae6b346faa69efbe18c1e7e36413d52
SHA1 97cd788fe398f6d73c944ba5da7403dff6427fb3
SHA512 76ddfd3549e2d96748e897aad77b7ef6e6b6b18188ebe6b63671abcbf1e38fadb15d5be9edaf41d1b3bd937e473a7552b59899fb7586d1afc0696f2b271932f5
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2860-147-0x0000000000760000-0x000000000076A000-memory.dmp

Download

memory/2860-150-0x00007FFFD35E0000-0x00007FFFD40A1000-memory.dmp

Download

memory/2860-148-0x00007FFFD35E0000-0x00007FFFD40A1000-memory.dmp

Download

memory/4688-154-0x00000000006D0000-0x0000000000700000-memory.dmp

Download

memory/4688-155-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/4688-156-0x00000000057A0000-0x0000000005DB8000-memory.dmp

Download

memory/4688-157-0x0000000005290000-0x000000000539A000-memory.dmp

Download

memory/4688-158-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download

memory/4688-159-0x00000000051A0000-0x00000000051B2000-memory.dmp

Download

memory/4688-160-0x0000000005200000-0x000000000523C000-memory.dmp

Download

memory/4688-161-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/4688-162-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download