healer | c8fadf09d5b23c2338703fa5f6d2c637c5c0b1ee062284cd0fc0de803025056b

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 564KB
Sample230815-s2f61sdd7s
SHA256 c8fadf09d5b23c2338703fa5f6d2c637c5c0b1ee062284cd0fc0de803025056b
MD5 0a04df8434f185fd12122014c7cdca07
SHA1 5103bb52ea1cc8d863be460a3d7a1ffcec7fde4d
SHA512 28e920582d052482edc1b43e38c6e52845c64b722859427dc3e909cd66bf3cb3873e589a6cde87b87ede8cd56ed60a6d59f60e58aba25f1b3c3ac24fad3f2ba9
SSDEEP 12288:0MrAy90s6u76yy3rhfBRb3Hon8V0GBbT7faSoFLN:EyHV763rhD+8V0GJT7jqR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline meson dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

meson

77.91.124.54:19071

Attributes

auth_value
47ca57ebe5c142c9ad4650f71bf57877

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023287-152.dat	healer
behavioral2/files/0x0008000000023287-153.dat	healer
behavioral2/memory/5056-154-0x0000000000F20000-0x0000000000F2A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	r1475849.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	r1475849.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	r1475849.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	r1475849.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	r1475849.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	r1475849.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1800	z5328791.exe
220	z4454215.exe
5056	r1475849.exe
4588	s1557099.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	r1475849.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z4454215.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5328791.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	r1475849.exe
5056	r1475849.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	r1475849.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1800	3704	file.exe	82
PID 3704 wrote to memory of 1800	3704	file.exe	82
PID 3704 wrote to memory of 1800	3704	file.exe	82
PID 1800 wrote to memory of 220	1800	z5328791.exe	83
PID 1800 wrote to memory of 220	1800	z5328791.exe	83
PID 1800 wrote to memory of 220	1800	z5328791.exe	83
PID 220 wrote to memory of 5056	220	z4454215.exe	84
PID 220 wrote to memory of 5056	220	z4454215.exe	84
PID 220 wrote to memory of 4588	220	z4454215.exe	92
PID 220 wrote to memory of 4588	220	z4454215.exe	92
PID 220 wrote to memory of 4588	220	z4454215.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5328791.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5328791.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4454215.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4454215.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1475849.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1475849.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s1557099.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s1557099.exe
      4⤵
      Executes dropped EXE
      PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z5328791.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5328791.exe
Size 432KB
SHA256 dab86aba45eb33f969c94ca330684f8cc39b8e6f90f0349b670b4c99ee7f5c08
MD5 c3676fc03c86727fc8a35a2b801df5a6
SHA1 a8562d76b8a7af50239e5978e1c7c6c8b1701dbf
SHA512 b44de553b5e70384b02a3d91aad1bdd51a4f57e1c6598b6a8eb2baf57c0b445746f26e39cec0ff08db723cacfd9b3b95b8a4f9952f3f9bf680b3fe0be0b4a087
SSDEEP 6144:KKy+bnr+Rcp0yN90QER0rhZ7/Xnv4gb3doU0XBRVw+YQf2NP2kb9gl1cSAcdxrY8:iMryy90krhdfdb3donXVWGob+cfM7
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5328791.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5328791.exe
Size 432KB
SHA256 dab86aba45eb33f969c94ca330684f8cc39b8e6f90f0349b670b4c99ee7f5c08
MD5 c3676fc03c86727fc8a35a2b801df5a6
SHA1 a8562d76b8a7af50239e5978e1c7c6c8b1701dbf
SHA512 b44de553b5e70384b02a3d91aad1bdd51a4f57e1c6598b6a8eb2baf57c0b445746f26e39cec0ff08db723cacfd9b3b95b8a4f9952f3f9bf680b3fe0be0b4a087
SSDEEP 6144:KKy+bnr+Rcp0yN90QER0rhZ7/Xnv4gb3doU0XBRVw+YQf2NP2kb9gl1cSAcdxrY8:iMryy90krhdfdb3donXVWGob+cfM7
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4454215.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4454215.exe
Size 206KB
SHA256 7fc08f146321e54b154423615aa6520e4f1080880652034f0c5878080e6009c8
MD5 bfe26fdecb462f833c3ff24d4ad069ad
SHA1 e1dd2a712e34d2cb0ed3bc7d9cf8fdc44caa93a0
SHA512 50d5301b4208c3b57902f51c597afca73622967045fd28207ca7dcdc1cc6add532b724ce895f8a363748f7d014017a792122960d725fd6625d3ba699fb096590
SSDEEP 3072:KKy+bnr+O1w5GWp1icKAArDZz4N9GhbkrNEk1ARGXEpaIe7ewTEvLP0oD:KKy+bnr+Dp0yN90QE5RGyaFX8L
MD5 SHA1 SHA512 SSDEEP

Submit Download

z4454215.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4454215.exe
Size 206KB
SHA256 7fc08f146321e54b154423615aa6520e4f1080880652034f0c5878080e6009c8
MD5 bfe26fdecb462f833c3ff24d4ad069ad
SHA1 e1dd2a712e34d2cb0ed3bc7d9cf8fdc44caa93a0
SHA512 50d5301b4208c3b57902f51c597afca73622967045fd28207ca7dcdc1cc6add532b724ce895f8a363748f7d014017a792122960d725fd6625d3ba699fb096590
SSDEEP 3072:KKy+bnr+O1w5GWp1icKAArDZz4N9GhbkrNEk1ARGXEpaIe7ewTEvLP0oD:KKy+bnr+Dp0yN90QE5RGyaFX8L
MD5 SHA1 SHA512 SSDEEP

Submit Download

r1475849.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1475849.exe
Size 11KB
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

r1475849.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r1475849.exe
Size 11KB
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

s1557099.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s1557099.exe
Size 174KB
SHA256 fa4c0400f2100f27843122d6626e53b3fd8cf4af1ba43ab99f637716bfedf691
MD5 71755da2ad6d04e34af57974394904bd
SHA1 12eb990abdd6a067fede8dbfdf53b6076415d6ba
SHA512 a8d9dc9cd3a931a3124345f37bf77e79b01847f91a788d629bdec3e0553eb136fc16d3a888fbbeeb2d3a048ab227314da926a7fa02205156101bd34f32c83106
SSDEEP 3072:tIjpNoqjrI0YoID6OVAe2HuNz+E0qFYcUfzQQJ88e8ha:qjpxrI0YoID4uNz+E0KUfzQQ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

s1557099.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s1557099.exe
Size 174KB
SHA256 fa4c0400f2100f27843122d6626e53b3fd8cf4af1ba43ab99f637716bfedf691
MD5 71755da2ad6d04e34af57974394904bd
SHA1 12eb990abdd6a067fede8dbfdf53b6076415d6ba
SHA512 a8d9dc9cd3a931a3124345f37bf77e79b01847f91a788d629bdec3e0553eb136fc16d3a888fbbeeb2d3a048ab227314da926a7fa02205156101bd34f32c83106
SSDEEP 3072:tIjpNoqjrI0YoID6OVAe2HuNz+E0qFYcUfzQQJ88e8ha:qjpxrI0YoID4uNz+E0KUfzQQ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4588-162-0x0000000074790000-0x0000000074F40000-memory.dmp

Download

memory/4588-161-0x0000000000D70000-0x0000000000DA0000-memory.dmp

Download

memory/4588-163-0x0000000005DA0000-0x00000000063B8000-memory.dmp

Download

memory/4588-164-0x0000000005890000-0x000000000599A000-memory.dmp

Download

memory/4588-166-0x0000000005770000-0x0000000005780000-memory.dmp

Download

memory/4588-165-0x00000000031A0000-0x00000000031B2000-memory.dmp

Download

memory/4588-167-0x0000000005780000-0x00000000057BC000-memory.dmp

Download

memory/4588-168-0x0000000074790000-0x0000000074F40000-memory.dmp

Download

memory/4588-169-0x0000000005770000-0x0000000005780000-memory.dmp

Download

memory/5056-157-0x00007FFD520B0000-0x00007FFD52B71000-memory.dmp

Download

memory/5056-155-0x00007FFD520B0000-0x00007FFD52B71000-memory.dmp

Download

memory/5056-154-0x0000000000F20000-0x0000000000F2A000-memory.dmp

Download