healer | ef11bf7b35a28054917643092a94f68ccdbc57cd68005df66e6d81a0d2d012d4

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2023, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3acf2e92c0625f14957b8bba85a5a133.exe
Size 389KB
Sample230720-l83v2afh4y
SHA256 ef11bf7b35a28054917643092a94f68ccdbc57cd68005df66e6d81a0d2d012d4
MD5 3acf2e92c0625f14957b8bba85a5a133
SHA1 519645e11407ed3991cf6501314ea5d8cd4e7a64
SHA512 e181da02b0e85eb7362d0528e5f2da52140b607e44c0f01bf5f772e80992c4fe396d1aaab512e1fb57f7cd54258488a8bd00386ab23b57b932c8d1259dc000b9
SSDEEP 6144:K+y+bnr+lp0yN90QEUO/bqnT1boVBqmroo3FgmF32GBzHPIRUMjRDDQdf:uMrty907zqT0BtUqoAIRUMjRwdf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000230a5-145.dat	healer
behavioral2/files/0x00070000000230a5-146.dat	healer
behavioral2/memory/984-147-0x0000000000060000-0x000000000006A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p5335402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p5335402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p5335402.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p5335402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p5335402.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p5335402.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2212	z8044384.exe
984	p5335402.exe
3912	r5275281.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p5335402.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z8044384.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3acf2e92c0625f14957b8bba85a5a133.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3acf2e92c0625f14957b8bba85a5a133.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z8044384.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
984	p5335402.exe
984	p5335402.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	984	p5335402.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2212	2968	3acf2e92c0625f14957b8bba85a5a133.exe	85
PID 2968 wrote to memory of 2212	2968	3acf2e92c0625f14957b8bba85a5a133.exe	85
PID 2968 wrote to memory of 2212	2968	3acf2e92c0625f14957b8bba85a5a133.exe	85
PID 2212 wrote to memory of 984	2212	z8044384.exe	86
PID 2212 wrote to memory of 984	2212	z8044384.exe	86
PID 2212 wrote to memory of 3912	2212	z8044384.exe	92
PID 2212 wrote to memory of 3912	2212	z8044384.exe	92
PID 2212 wrote to memory of 3912	2212	z8044384.exe	92

C:\Users\Admin\AppData\Local\Temp\3acf2e92c0625f14957b8bba85a5a133.exe
"C:\Users\Admin\AppData\Local\Temp\3acf2e92c0625f14957b8bba85a5a133.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5275281.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5275281.exe
    3⤵
    - Executes dropped EXE
    PID:3912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z8044384.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe
Size 206KB
SHA256 40c4c723b4d0c89645ae299cab3530bc2ef9c57d9150449fe0c8c6aead004937
MD5 c8b9665121b73a485f79a2de1628661c
SHA1 bd0d783f55f37e8737343bb00b49ee8cf2fa0ba4
SHA512 9b5eed29972830c26142a8bbbe0dd7b850854dfaeb6c1d0b8e2597f874df5cea1737de4b52142527e6da33dc9f10275113c66b694faf153613929f28bd9d2862
SSDEEP 3072:KDy+bnr+O185GWp1icKAArDZz4N9GhbkrNEk1/7bEOvvZDZhnmBFE9LtnX3AoP:KDy+bnr+rp0yN90QEsEOFZwEZ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

z8044384.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8044384.exe
Size 206KB
SHA256 40c4c723b4d0c89645ae299cab3530bc2ef9c57d9150449fe0c8c6aead004937
MD5 c8b9665121b73a485f79a2de1628661c
SHA1 bd0d783f55f37e8737343bb00b49ee8cf2fa0ba4
SHA512 9b5eed29972830c26142a8bbbe0dd7b850854dfaeb6c1d0b8e2597f874df5cea1737de4b52142527e6da33dc9f10275113c66b694faf153613929f28bd9d2862
SSDEEP 3072:KDy+bnr+O185GWp1icKAArDZz4N9GhbkrNEk1/7bEOvvZDZhnmBFE9LtnX3AoP:KDy+bnr+rp0yN90QEsEOFZwEZ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

p5335402.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe
Size 14KB
SHA256 f4c25888b594f3e771c892db06734e7a18adc87a4dc9e2ab0488322307844584
MD5 7cd0e92a3344c81e96123ea28d0acb91
SHA1 71c25bf1f5eb3e3f23ed2bde5ae76c853bcc16c2
SHA512 4965602e6ea39d53b3044432ac9ca2a58b8d556ffa5295bc75b065d8db6df21e6ef6578cc7bc47f2a239b067ae6226fc2fa8dc9315ca5b16cad6e842fd6c9cc2
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

p5335402.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5335402.exe
Size 14KB
SHA256 f4c25888b594f3e771c892db06734e7a18adc87a4dc9e2ab0488322307844584
MD5 7cd0e92a3344c81e96123ea28d0acb91
SHA1 71c25bf1f5eb3e3f23ed2bde5ae76c853bcc16c2
SHA512 4965602e6ea39d53b3044432ac9ca2a58b8d556ffa5295bc75b065d8db6df21e6ef6578cc7bc47f2a239b067ae6226fc2fa8dc9315ca5b16cad6e842fd6c9cc2
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

r5275281.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5275281.exe
Size 174KB
SHA256 d68f96f7972e2a8c02ed03bf9cb5bdba900bb7dde262eeddc9a31cd30722f3bf
MD5 88902ec73df2239eb1b5444e9faca32e
SHA1 708b48c5f20fb8929510495b969f77cf7f990061
SHA512 b88c8e41ffd91482882d22569af4c86302e483ccc0cc0f1931080c126a1794a6e2183880a153107911c28526782faf1fb5f59efa4cf5d32eb1a9ec9125084fe6
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

r5275281.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5275281.exe
Size 174KB
SHA256 d68f96f7972e2a8c02ed03bf9cb5bdba900bb7dde262eeddc9a31cd30722f3bf
MD5 88902ec73df2239eb1b5444e9faca32e
SHA1 708b48c5f20fb8929510495b969f77cf7f990061
SHA512 b88c8e41ffd91482882d22569af4c86302e483ccc0cc0f1931080c126a1794a6e2183880a153107911c28526782faf1fb5f59efa4cf5d32eb1a9ec9125084fe6
SSDEEP 3072:gciW+Zh8+WtcTIwxNm4/Lk/DWjAn8e8hJ:gciv7IJT/DWjAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/984-147-0x0000000000060000-0x000000000006A000-memory.dmp

Download

memory/984-152-0x00007FFEE7EA0000-0x00007FFEE8961000-memory.dmp

Download

memory/984-148-0x00007FFEE7EA0000-0x00007FFEE8961000-memory.dmp

Download

memory/3912-154-0x0000000074BC0000-0x0000000075370000-memory.dmp

Download

memory/3912-155-0x0000000000A40000-0x0000000000A70000-memory.dmp

Download

memory/3912-156-0x0000000005B80000-0x0000000006198000-memory.dmp

Download

memory/3912-157-0x0000000005670000-0x000000000577A000-memory.dmp

Download

memory/3912-159-0x0000000005400000-0x0000000005412000-memory.dmp

Download

memory/3912-158-0x0000000005450000-0x0000000005460000-memory.dmp

Download

memory/3912-160-0x00000000055A0000-0x00000000055DC000-memory.dmp

Download

memory/3912-161-0x0000000074BC0000-0x0000000075370000-memory.dmp

Download

memory/3912-162-0x0000000005450000-0x0000000005460000-memory.dmp

Download