healer | 0186a161747fce2c87cc2272d77460431ebbd06e7b508427e96197c0e3bee86f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce5cb7c706098dd7b911f4d4cf26f674.exe
Size

830KB
MD5

ce5cb7c706098dd7b911f4d4cf26f674
SHA1

6676b0a029686938db1fe7843c83cd5389e3799c
SHA256

0186a161747fce2c87cc2272d77460431ebbd06e7b508427e96197c0e3bee86f
SHA512

b6319ce8ceab8cd5b7814e2d0217fbda25f8020c7959cebaf51a93b4ba22302270a0faacb226885d6eeec22fa6962dffa3564a0a52d441d96df4458a436d2ec1
SSDEEP

12288:cMrAy90mBG6scR90ByHdXAUDyox3CVsHi0Z4xHx/2/FzXHGPs4duNiO4EBmxmMZ5:synJfRbXAAyoxHi0ZE4dSUv4EBmP5

Score

10^/10

healer redline jaja dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

jaja

77.91.124.73:19071

Attributes

auth_value
3670179d176ca399ed08e7914610b43c

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000002323c-33.dat	healer
behavioral2/files/0x000700000002323c-34.dat	healer
behavioral2/memory/1656-35-0x0000000000460000-0x000000000046A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5078621.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5078621.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5078621.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5078621.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a5078621.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5078621.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

pid	Process
4836	v6100738.exe
4684	v5027868.exe
968	v7258890.exe
4828	v6591179.exe
1656	a5078621.exe
2324	b5100817.exe
5028	c4839145.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5078621.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5027868.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v7258890.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v6591179.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ce5cb7c706098dd7b911f4d4cf26f674.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6100738.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	a5078621.exe
1656	a5078621.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	a5078621.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4836	4104	ce5cb7c706098dd7b911f4d4cf26f674.exe	83
PID 4104 wrote to memory of 4836	4104	ce5cb7c706098dd7b911f4d4cf26f674.exe	83
PID 4104 wrote to memory of 4836	4104	ce5cb7c706098dd7b911f4d4cf26f674.exe	83
PID 4836 wrote to memory of 4684	4836	v6100738.exe	84
PID 4836 wrote to memory of 4684	4836	v6100738.exe	84
PID 4836 wrote to memory of 4684	4836	v6100738.exe	84
PID 4684 wrote to memory of 968	4684	v5027868.exe	85
PID 4684 wrote to memory of 968	4684	v5027868.exe	85
PID 4684 wrote to memory of 968	4684	v5027868.exe	85
PID 968 wrote to memory of 4828	968	v7258890.exe	86
PID 968 wrote to memory of 4828	968	v7258890.exe	86
PID 968 wrote to memory of 4828	968	v7258890.exe	86
PID 4828 wrote to memory of 1656	4828	v6591179.exe	87
PID 4828 wrote to memory of 1656	4828	v6591179.exe	87
PID 4828 wrote to memory of 2324	4828	v6591179.exe	93
PID 4828 wrote to memory of 2324	4828	v6591179.exe	93
PID 4828 wrote to memory of 2324	4828	v6591179.exe	93
PID 968 wrote to memory of 5028	968	v7258890.exe	96
PID 968 wrote to memory of 5028	968	v7258890.exe	96
PID 968 wrote to memory of 5028	968	v7258890.exe	96

C:\Users\Admin\AppData\Local\Temp\ce5cb7c706098dd7b911f4d4cf26f674.exe
"C:\Users\Admin\AppData\Local\Temp\ce5cb7c706098dd7b911f4d4cf26f674.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6100738.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6100738.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5027868.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5027868.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7258890.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7258890.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6591179.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6591179.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5078621.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5078621.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5100817.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5100817.exe
        6⤵
        Executes dropped EXE
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4839145.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4839145.exe
        5⤵
        Executes dropped EXE
        
        PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6100738.exe

Filesize
724KB

MD5
d14cedb5b334b2c8fdd3061d62acebda

SHA1
2fcb82aa083a404ae1d9bda9cb92d38494934fe5

SHA256
876835474be62b65d8cb96c5c5fc80829708872e38ed241ab73990f6e8201434

SHA512
76204e86b50e4e5e703e838d31d6548c97d31423bf5d4ada72da816fbd4b68379ffbbfb72575d37cd9d3833a176783699810a29f33aabbee4f7c219dedbcf91e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6100738.exe

Filesize
724KB

MD5
d14cedb5b334b2c8fdd3061d62acebda

SHA1
2fcb82aa083a404ae1d9bda9cb92d38494934fe5

SHA256
876835474be62b65d8cb96c5c5fc80829708872e38ed241ab73990f6e8201434

SHA512
76204e86b50e4e5e703e838d31d6548c97d31423bf5d4ada72da816fbd4b68379ffbbfb72575d37cd9d3833a176783699810a29f33aabbee4f7c219dedbcf91e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5027868.exe

Filesize
498KB

MD5
19edbdc7ba8510c35e98c3ae53a5e20c

SHA1
6a8201d6befa0de536e9e1a00d4493c138cdc8ea

SHA256
f7c0cf770b03390876f0be58b050847041b0768b37eb5a45d0ac6a7bf18e952f

SHA512
733d7ff3f038819a1b03871f290d4374d6e9db18a3b67fe7b6a89fbbd0b9d8f01412e4bd007905020310fe74bb9ca1ad5e7807397ae0ea9d06e604dc56179cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5027868.exe

Filesize
498KB

MD5
19edbdc7ba8510c35e98c3ae53a5e20c

SHA1
6a8201d6befa0de536e9e1a00d4493c138cdc8ea

SHA256
f7c0cf770b03390876f0be58b050847041b0768b37eb5a45d0ac6a7bf18e952f

SHA512
733d7ff3f038819a1b03871f290d4374d6e9db18a3b67fe7b6a89fbbd0b9d8f01412e4bd007905020310fe74bb9ca1ad5e7807397ae0ea9d06e604dc56179cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7258890.exe

Filesize
373KB

MD5
010d182c05941c326bbed9421233473a

SHA1
770c8cda5a4ada3c94f80982a165673e5a4331ca

SHA256
a6f744f3156ff94c2ec413b7477849944dd479d2ecc7f56ea4958182cc80b050

SHA512
b12d97bce061dc29dd44614be32d9917e0be6b78063b2c2d2aa4d69eaf4b4add2783704054824b0e66f163767f18c247ad14684f5e7ddb7efdafb481bcbd2716

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7258890.exe

Filesize
373KB

MD5
010d182c05941c326bbed9421233473a

SHA1
770c8cda5a4ada3c94f80982a165673e5a4331ca

SHA256
a6f744f3156ff94c2ec413b7477849944dd479d2ecc7f56ea4958182cc80b050

SHA512
b12d97bce061dc29dd44614be32d9917e0be6b78063b2c2d2aa4d69eaf4b4add2783704054824b0e66f163767f18c247ad14684f5e7ddb7efdafb481bcbd2716

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4839145.exe

Filesize
175KB

MD5
11295c5c5f9d894fefd1b9aff34c8591

SHA1
5484d99a9ed52fcfcd429e72c193edfbb4190adb

SHA256
7080e108753e747201a6cedcf6cf56a657b0dbb7e6a3a5939c27c4810f1f5c68

SHA512
78671d18f1abb883e88fb6bd8ace01b48acfdca27619654c73735cbdba9dfb0fbbfb158b8d984517a626fc40ea4abf927b9bd1617b4f674000dd6fd6bb8853ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c4839145.exe

Filesize
175KB

MD5
11295c5c5f9d894fefd1b9aff34c8591

SHA1
5484d99a9ed52fcfcd429e72c193edfbb4190adb

SHA256
7080e108753e747201a6cedcf6cf56a657b0dbb7e6a3a5939c27c4810f1f5c68

SHA512
78671d18f1abb883e88fb6bd8ace01b48acfdca27619654c73735cbdba9dfb0fbbfb158b8d984517a626fc40ea4abf927b9bd1617b4f674000dd6fd6bb8853ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6591179.exe

Filesize
217KB

MD5
e86c029e38a78f8c42395a8bde3ef396

SHA1
26b4c1c81696b5f9ebbaa52cac88330261f8afb8

SHA256
8261a831006df7b577b7bbe9c6dabb05e8fb7bc0a6a7c53939c028d8f8457f2d

SHA512
df596b9040b1e78b414f72add5592e1c2852b128884dc32c89b2e68528eb9e39169b8606b0d35d5c0df6c56a89d566fa0a342edf9be8139788a2680b927ceda9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6591179.exe

Filesize
217KB

MD5
e86c029e38a78f8c42395a8bde3ef396

SHA1
26b4c1c81696b5f9ebbaa52cac88330261f8afb8

SHA256
8261a831006df7b577b7bbe9c6dabb05e8fb7bc0a6a7c53939c028d8f8457f2d

SHA512
df596b9040b1e78b414f72add5592e1c2852b128884dc32c89b2e68528eb9e39169b8606b0d35d5c0df6c56a89d566fa0a342edf9be8139788a2680b927ceda9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5078621.exe

Filesize
15KB

MD5
1df32d04abd004af77d399fa2224b6ef

SHA1
f8661e9048580c9755213a8350bb6b553bad366d

SHA256
60f11ca061922a04b76f9bf7d4056b3e9a2e108a41bd46ce6eb0ca4c81e5c2dc

SHA512
e2577f140918305411fae2abc741f0a560bebcb01a810fc295ebd04da8f0a8b95ab8e591e734a67297c14c295220461bb85934979ecbf255b6079cee7b476bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5078621.exe

Filesize
15KB

MD5
1df32d04abd004af77d399fa2224b6ef

SHA1
f8661e9048580c9755213a8350bb6b553bad366d

SHA256
60f11ca061922a04b76f9bf7d4056b3e9a2e108a41bd46ce6eb0ca4c81e5c2dc

SHA512
e2577f140918305411fae2abc741f0a560bebcb01a810fc295ebd04da8f0a8b95ab8e591e734a67297c14c295220461bb85934979ecbf255b6079cee7b476bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5100817.exe

Filesize
141KB

MD5
69fc5eac17d5b4dc7e7975bffb0b9295

SHA1
46bc1c35ada99c9fbf69d9195f343e08feff8afe

SHA256
37a3842dc9b36a601a347b8fe87a45f1afb933139ee45e1ff7389f4043e2531c

SHA512
17aedc8efb75414a2b76d5e8917c4e8ecf9c3fc43d71aab01ff1d11d47e2974348a9c101c9e87c4af718a3394b6e2d59694cbeeecdc99d099ae410c3425d1ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5100817.exe

Filesize
141KB

MD5
69fc5eac17d5b4dc7e7975bffb0b9295

SHA1
46bc1c35ada99c9fbf69d9195f343e08feff8afe

SHA256
37a3842dc9b36a601a347b8fe87a45f1afb933139ee45e1ff7389f4043e2531c

SHA512
17aedc8efb75414a2b76d5e8917c4e8ecf9c3fc43d71aab01ff1d11d47e2974348a9c101c9e87c4af718a3394b6e2d59694cbeeecdc99d099ae410c3425d1ecc

Download Submit
memory/1656-38-0x00007FFBD15B0000-0x00007FFBD2071000-memory.dmp

Filesize
10.8MB

Download
memory/1656-36-0x00007FFBD15B0000-0x00007FFBD2071000-memory.dmp

Filesize
10.8MB

Download
memory/1656-35-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/5028-45-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/5028-46-0x0000000074110000-0x00000000748C0000-memory.dmp

Filesize
7.7MB

Download
memory/5028-47-0x0000000005990000-0x0000000005FA8000-memory.dmp

Filesize
6.1MB

Download
memory/5028-48-0x0000000005480000-0x000000000558A000-memory.dmp

Filesize
1.0MB

Download
memory/5028-49-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/5028-50-0x00000000051E0000-0x00000000051F2000-memory.dmp

Filesize
72KB

Download
memory/5028-51-0x0000000005370000-0x00000000053AC000-memory.dmp

Filesize
240KB

Download
memory/5028-52-0x0000000074110000-0x00000000748C0000-memory.dmp

Filesize
7.7MB

Download
memory/5028-53-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download