healer | bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2023, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a93f2fead052a76fbae72166ac8fb12.exe
Size 389KB
Sample230720-js9brseb5v
SHA256 bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2
MD5 8a93f2fead052a76fbae72166ac8fb12
SHA1 d3717ab4c59cc8ede584e2ce79bc768d62a03dc3
SHA512 cade714bb097b4e24cf985f5156bf55ac4e3390c812055e4e5f10c118e4b2e40d9b449e8b2f236ca9b3095382f884e7f49ce17779362f1cb7a44255c7839711a
SSDEEP 6144:KZy+bnr+wp0yN90QE/Yd+B4GwMEbYWOYNdGGxPYuQX/ceXe:fMrIy90TFIYPixAuocj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231df-145.dat	healer
behavioral2/files/0x00080000000231df-146.dat	healer
behavioral2/memory/3376-147-0x0000000000C50000-0x0000000000C5A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p0739731.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4940	z4360316.exe
3376	p0739731.exe
4692	r8147143.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p0739731.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8a93f2fead052a76fbae72166ac8fb12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8a93f2fead052a76fbae72166ac8fb12.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z4360316.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4360316.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3376	p0739731.exe
3376	p0739731.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	p0739731.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4940	2104	8a93f2fead052a76fbae72166ac8fb12.exe	85
PID 2104 wrote to memory of 4940	2104	8a93f2fead052a76fbae72166ac8fb12.exe	85
PID 2104 wrote to memory of 4940	2104	8a93f2fead052a76fbae72166ac8fb12.exe	85
PID 4940 wrote to memory of 3376	4940	z4360316.exe	86
PID 4940 wrote to memory of 3376	4940	z4360316.exe	86
PID 4940 wrote to memory of 4692	4940	z4360316.exe	100
PID 4940 wrote to memory of 4692	4940	z4360316.exe	100
PID 4940 wrote to memory of 4692	4940	z4360316.exe	100

C:\Users\Admin\AppData\Local\Temp\8a93f2fead052a76fbae72166ac8fb12.exe
"C:\Users\Admin\AppData\Local\Temp\8a93f2fead052a76fbae72166ac8fb12.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe
    3⤵
    - Executes dropped EXE
    PID:4692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z4360316.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe
Size 206KB
SHA256 96356b86475b7fbf7dce2734b64e0ed95cba6b5a7be0efcb71bf469965457adb
MD5 e6b4ba6f5d76a4719f406cd3aca3b9a7
SHA1 77a6d0a2e77a71534c848a111573f6af326ce5dc
SHA512 ae8b1d3801243dc81ad6288cc449d90ced08d8a34039a8fd07b09557a6fd52213cb08b334f63e1dcdd0110de12dfc7d9ff24e2886bec6175927a385baf1d0486
SSDEEP 3072:KAy+bnr+O1g5GWp1icKAArDZz4N9GhbkrNEk1LM3w0OVhv0fhOh9FUiUWwo3:KAy+bnr+7p0yN90QE137m0s9FUiUWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4360316.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe
Size 206KB
SHA256 96356b86475b7fbf7dce2734b64e0ed95cba6b5a7be0efcb71bf469965457adb
MD5 e6b4ba6f5d76a4719f406cd3aca3b9a7
SHA1 77a6d0a2e77a71534c848a111573f6af326ce5dc
SHA512 ae8b1d3801243dc81ad6288cc449d90ced08d8a34039a8fd07b09557a6fd52213cb08b334f63e1dcdd0110de12dfc7d9ff24e2886bec6175927a385baf1d0486
SSDEEP 3072:KAy+bnr+O1g5GWp1icKAArDZz4N9GhbkrNEk1LM3w0OVhv0fhOh9FUiUWwo3:KAy+bnr+7p0yN90QE137m0s9FUiUWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

p0739731.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe
Size 14KB
SHA256 e4c23c0d96badfd1ea7612225bd61898a296a585b69230989ee61ecd87fcc57b
MD5 84983a334ac089ec14cf05f1c0605bef
SHA1 6836067a70683845a7e773d1f28f1cb9e4138d15
SHA512 0ea33bab35c21d5612219337945079d3cac74552c776e379bdbeac809538f600b5a2eb17a6877f7fd1956fad3cdea651fd0b9abde76c5be8a2c1fbc686225080
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

p0739731.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe
Size 14KB
SHA256 e4c23c0d96badfd1ea7612225bd61898a296a585b69230989ee61ecd87fcc57b
MD5 84983a334ac089ec14cf05f1c0605bef
SHA1 6836067a70683845a7e773d1f28f1cb9e4138d15
SHA512 0ea33bab35c21d5612219337945079d3cac74552c776e379bdbeac809538f600b5a2eb17a6877f7fd1956fad3cdea651fd0b9abde76c5be8a2c1fbc686225080
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

r8147143.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe
Size 173KB
SHA256 f492ece3bdadd718f42d07315e318b307757c406025d07bfaf56e619232eb9de
MD5 36fe0ab069c8ee215f9b18e10bb5a184
SHA1 42a3650d4fbda059640555bce0be87544556870d
SHA512 a201e8d2a5fdd44f2aea01b9ba1ea51ae6c75c40979a912212bea270b223d2f686b271879a5cca2cab01fb3bdbc01d5719bdf4fe7691c878fc3dbd05b79ab06e
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

r8147143.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe
Size 173KB
SHA256 f492ece3bdadd718f42d07315e318b307757c406025d07bfaf56e619232eb9de
MD5 36fe0ab069c8ee215f9b18e10bb5a184
SHA1 42a3650d4fbda059640555bce0be87544556870d
SHA512 a201e8d2a5fdd44f2aea01b9ba1ea51ae6c75c40979a912212bea270b223d2f686b271879a5cca2cab01fb3bdbc01d5719bdf4fe7691c878fc3dbd05b79ab06e
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3376-147-0x0000000000C50000-0x0000000000C5A000-memory.dmp

Download

memory/3376-150-0x00007FFC5BF00000-0x00007FFC5C9C1000-memory.dmp

Download

memory/3376-148-0x00007FFC5BF00000-0x00007FFC5C9C1000-memory.dmp

Download

memory/4692-154-0x0000000073C50000-0x0000000074400000-memory.dmp

Download

memory/4692-155-0x0000000000860000-0x0000000000890000-memory.dmp

Download

memory/4692-156-0x0000000005850000-0x0000000005E68000-memory.dmp

Download

memory/4692-157-0x0000000005340000-0x000000000544A000-memory.dmp

Download

memory/4692-159-0x0000000005220000-0x0000000005230000-memory.dmp

Download

memory/4692-158-0x00000000051F0000-0x0000000005202000-memory.dmp

Download

memory/4692-160-0x0000000005270000-0x00000000052AC000-memory.dmp

Download

memory/4692-161-0x0000000073C50000-0x0000000074400000-memory.dmp

Download

memory/4692-162-0x0000000005220000-0x0000000005230000-memory.dmp

Download