healer | c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2023 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541.exe
Size

505KB
MD5

d91479128d94363b158b2e3095bd473f
SHA1

ef9632d7d1df5770c08a0d4596f86f03c3918844
SHA256

c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541
SHA512

84d2ba8ff04ffab9c769c0ed378d7aa6ed801cb6b81bd8226418aa787ca12c9d5cc00c1c5a6dc628d02132ee579de0e7124a23058ff2fd858aab8065a3f485e9
SSDEEP

12288:oMr9y90qE+kCydlhyVeq7Qab+sHqQDV4xP4/VR8R:lynE+klPyUqEaqQh8A/VyR

Score

10^/10

healer redline meson dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

meson

77.91.124.54:19071

Attributes

auth_value
47ca57ebe5c142c9ad4650f71bf57877

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023225-155.dat	healer
behavioral1/files/0x0007000000023225-156.dat	healer
behavioral1/memory/2468-157-0x00000000004B0000-0x00000000004BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h2563877.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h2563877.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	h2563877.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h2563877.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h2563877.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h2563877.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
3420	x2518074.exe
1420	x8212281.exe
4952	g1403652.exe
2468	h2563877.exe
3752	i7578073.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	h2563877.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2518074.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8212281.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	h2563877.exe
2468	h2563877.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	h2563877.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3420	2944	c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541.exe	81
PID 2944 wrote to memory of 3420	2944	c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541.exe	81
PID 2944 wrote to memory of 3420	2944	c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541.exe	81
PID 3420 wrote to memory of 1420	3420	x2518074.exe	82
PID 3420 wrote to memory of 1420	3420	x2518074.exe	82
PID 3420 wrote to memory of 1420	3420	x2518074.exe	82
PID 1420 wrote to memory of 4952	1420	x8212281.exe	83
PID 1420 wrote to memory of 4952	1420	x8212281.exe	83
PID 1420 wrote to memory of 4952	1420	x8212281.exe	83
PID 1420 wrote to memory of 2468	1420	x8212281.exe	84
PID 1420 wrote to memory of 2468	1420	x8212281.exe	84
PID 3420 wrote to memory of 3752	3420	x2518074.exe	90
PID 3420 wrote to memory of 3752	3420	x2518074.exe	90
PID 3420 wrote to memory of 3752	3420	x2518074.exe	90

C:\Users\Admin\AppData\Local\Temp\c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541.exe
"C:\Users\Admin\AppData\Local\Temp\c93529a1d87dbe4e9754e6b06d762bcd3ff2ee5e4629f428491cb6ae7a4fa541.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2518074.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2518074.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8212281.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8212281.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1403652.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1403652.exe
      4⤵
      Executes dropped EXE
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h2563877.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h2563877.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2468
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7578073.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7578073.exe
    3⤵
    - Executes dropped EXE
    PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2518074.exe

Filesize
372KB

MD5
432111d7ab6693eb16bcbd1e7ab73d4d

SHA1
db4c4780051a77b58001bcb57e1d038e52c370fb

SHA256
85cda2a10ad0d6376dfb2ea2a8e2a557b2ba53f8f39cdef83e1b26b3fbb51137

SHA512
63208db17827a53c18e9fb08d11078eab26415cfe8b7f9ae0c939b34d0566fc5be27c23ea175e7a990444e4b47daad3f1cfeeb05183ea1759dc8c860358e6beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2518074.exe

Filesize
372KB

MD5
432111d7ab6693eb16bcbd1e7ab73d4d

SHA1
db4c4780051a77b58001bcb57e1d038e52c370fb

SHA256
85cda2a10ad0d6376dfb2ea2a8e2a557b2ba53f8f39cdef83e1b26b3fbb51137

SHA512
63208db17827a53c18e9fb08d11078eab26415cfe8b7f9ae0c939b34d0566fc5be27c23ea175e7a990444e4b47daad3f1cfeeb05183ea1759dc8c860358e6beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7578073.exe

Filesize
174KB

MD5
65146dccc04b76a4fe5096a6b2c88281

SHA1
205b8329619abb97a6cc60611fa22ec964326fd6

SHA256
b0279bc2ec5fdd5db15fab292739ddbfce4aec5dfc3177fc8ba8bf13b5001cdb

SHA512
3e1c65df21ee406b6ea71dd0f0e5c1835e48f4803c61186c1abd232327ce48361b31fc823dd10f6f844776863952d55af9ac3c42d78fa3e068ab068d128986d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7578073.exe

Filesize
174KB

MD5
65146dccc04b76a4fe5096a6b2c88281

SHA1
205b8329619abb97a6cc60611fa22ec964326fd6

SHA256
b0279bc2ec5fdd5db15fab292739ddbfce4aec5dfc3177fc8ba8bf13b5001cdb

SHA512
3e1c65df21ee406b6ea71dd0f0e5c1835e48f4803c61186c1abd232327ce48361b31fc823dd10f6f844776863952d55af9ac3c42d78fa3e068ab068d128986d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8212281.exe

Filesize
217KB

MD5
1e91ee24af179de82653b16931eb4ce7

SHA1
f624b0a3f19fb238ad5bab299d76bc201d848235

SHA256
768f1ea6a0fecfc9e9e06d3b60832f8f86f3e56710c27c0f789ededb71e3c2e2

SHA512
28983d513e1cce2af0521b3d2365929b5b5b47abf5285197e627f0863987ec8b35c5fd03ad9eaa04234924a91afb15d3685741c75779ff3b77e2cf0fd17f8ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8212281.exe

Filesize
217KB

MD5
1e91ee24af179de82653b16931eb4ce7

SHA1
f624b0a3f19fb238ad5bab299d76bc201d848235

SHA256
768f1ea6a0fecfc9e9e06d3b60832f8f86f3e56710c27c0f789ededb71e3c2e2

SHA512
28983d513e1cce2af0521b3d2365929b5b5b47abf5285197e627f0863987ec8b35c5fd03ad9eaa04234924a91afb15d3685741c75779ff3b77e2cf0fd17f8ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1403652.exe

Filesize
140KB

MD5
8f6cbd407dffba25f4bc8645d72d271c

SHA1
43bccbe1978f4026307dc0ef693ebd5c540d3de4

SHA256
45aacafc3272cbf8f495c5531d6a6001c0f998b1f37ae6127e298d2e870a8d2a

SHA512
8e7adf6e290613debe49367b7fec810d575ef0a6ea79cb0cc2f888e9012ae80e8fb4a84aa2de783d3ef5b73cced2a177af7dfea8d89f7f2734f4a53142d7cfa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1403652.exe

Filesize
140KB

MD5
8f6cbd407dffba25f4bc8645d72d271c

SHA1
43bccbe1978f4026307dc0ef693ebd5c540d3de4

SHA256
45aacafc3272cbf8f495c5531d6a6001c0f998b1f37ae6127e298d2e870a8d2a

SHA512
8e7adf6e290613debe49367b7fec810d575ef0a6ea79cb0cc2f888e9012ae80e8fb4a84aa2de783d3ef5b73cced2a177af7dfea8d89f7f2734f4a53142d7cfa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h2563877.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h2563877.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/2468-160-0x00007FFB540E0000-0x00007FFB54BA1000-memory.dmp

Filesize
10.8MB

Download
memory/2468-158-0x00007FFB540E0000-0x00007FFB54BA1000-memory.dmp

Filesize
10.8MB

Download
memory/2468-157-0x00000000004B0000-0x00000000004BA000-memory.dmp

Filesize
40KB

Download
memory/3752-165-0x00000000744F0000-0x0000000074CA0000-memory.dmp

Filesize
7.7MB

Download
memory/3752-164-0x00000000003E0000-0x0000000000410000-memory.dmp

Filesize
192KB

Download
memory/3752-166-0x0000000005430000-0x0000000005A48000-memory.dmp

Filesize
6.1MB

Download
memory/3752-167-0x0000000004F60000-0x000000000506A000-memory.dmp

Filesize
1.0MB

Download
memory/3752-168-0x0000000002620000-0x0000000002630000-memory.dmp

Filesize
64KB

Download
memory/3752-169-0x0000000004EA0000-0x0000000004EB2000-memory.dmp

Filesize
72KB

Download
memory/3752-170-0x0000000004F00000-0x0000000004F3C000-memory.dmp

Filesize
240KB

Download
memory/3752-171-0x00000000744F0000-0x0000000074CA0000-memory.dmp

Filesize
7.7MB

Download
memory/3752-172-0x0000000002620000-0x0000000002630000-memory.dmp

Filesize
64KB

Download