healer | 3dca6c9c5f620075ba1bf7ba642417a9c77a71232b56859dbb70313b8f798a33

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2023 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b104f526af7f41066e5026f43a9d33f.exe
Size

929KB
MD5

5b104f526af7f41066e5026f43a9d33f
SHA1

f809df18566b954f3e794498c724f0d7b2cd5dda
SHA256

3dca6c9c5f620075ba1bf7ba642417a9c77a71232b56859dbb70313b8f798a33
SHA512

9bb365623bd75dc91a55043eb883c219ee7c286744dc790ccbea4176759f1ebf5006d98b8155bc4d0be7fd6d9b29f8603fba0dfc0578d0e97cf1071e79ae45b6
SSDEEP

24576:RyEgbgwAgE/qAj631WFfJHadHyYS/aZsQDhv5d:EVxJlWZJHMy6ZXDhv

Score

10^/10

healer redline nrava dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nrava

77.91.124.82:19071

Attributes

auth_value
43fe50e9ee6afb85588e03ac9676e2f7

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023234-33.dat	healer
behavioral2/files/0x0008000000023234-34.dat	healer
behavioral2/memory/2832-35-0x0000000000B80000-0x0000000000B8A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q1769431.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q1769431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q1769431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q1769431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q1769431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q1769431.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023233-43.dat	family_redline
behavioral2/files/0x0007000000023233-44.dat	family_redline
behavioral2/memory/4132-45-0x0000000000B60000-0x0000000000B90000-memory.dmp	family_redline

Executes dropped EXE 7 IoCs

pid	Process
2952	z2074729.exe
1876	z0269939.exe
232	z8121433.exe
4024	z6927607.exe
2832	q1769431.exe
1736	r2471383.exe
4132	s7162717.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q1769431.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2074729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0269939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z8121433.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z6927607.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5b104f526af7f41066e5026f43a9d33f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	q1769431.exe
2832	q1769431.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	q1769431.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2952	4064	5b104f526af7f41066e5026f43a9d33f.exe	80
PID 4064 wrote to memory of 2952	4064	5b104f526af7f41066e5026f43a9d33f.exe	80
PID 4064 wrote to memory of 2952	4064	5b104f526af7f41066e5026f43a9d33f.exe	80
PID 2952 wrote to memory of 1876	2952	z2074729.exe	81
PID 2952 wrote to memory of 1876	2952	z2074729.exe	81
PID 2952 wrote to memory of 1876	2952	z2074729.exe	81
PID 1876 wrote to memory of 232	1876	z0269939.exe	82
PID 1876 wrote to memory of 232	1876	z0269939.exe	82
PID 1876 wrote to memory of 232	1876	z0269939.exe	82
PID 232 wrote to memory of 4024	232	z8121433.exe	83
PID 232 wrote to memory of 4024	232	z8121433.exe	83
PID 232 wrote to memory of 4024	232	z8121433.exe	83
PID 4024 wrote to memory of 2832	4024	z6927607.exe	84
PID 4024 wrote to memory of 2832	4024	z6927607.exe	84
PID 4024 wrote to memory of 1736	4024	z6927607.exe	93
PID 4024 wrote to memory of 1736	4024	z6927607.exe	93
PID 4024 wrote to memory of 1736	4024	z6927607.exe	93
PID 232 wrote to memory of 4132	232	z8121433.exe	95
PID 232 wrote to memory of 4132	232	z8121433.exe	95
PID 232 wrote to memory of 4132	232	z8121433.exe	95

C:\Users\Admin\AppData\Local\Temp\5b104f526af7f41066e5026f43a9d33f.exe
"C:\Users\Admin\AppData\Local\Temp\5b104f526af7f41066e5026f43a9d33f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2074729.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2074729.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0269939.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0269939.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8121433.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8121433.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6927607.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6927607.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1769431.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1769431.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2471383.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2471383.exe
        6⤵
        Executes dropped EXE
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7162717.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7162717.exe
        5⤵
        Executes dropped EXE
        
        PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2074729.exe

Filesize
824KB

MD5
9776a6ca06775f17584e3b896005e8e9

SHA1
21a41a87372b8cf3f376723c059d474d9dd937cd

SHA256
fd559828dd86a9d8ddfb9cac229e26b67619dbb0c2ff206c80664eac9e04625a

SHA512
869f9e475d68981a2e774b01130c87b8bf5212b4e9211222f45ac500415e80bcc9ac8cddbaee0bbaac5a34f1e9d24fae731d2f5e8ea6d732a93b90f7925f6154

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2074729.exe

Filesize
824KB

MD5
9776a6ca06775f17584e3b896005e8e9

SHA1
21a41a87372b8cf3f376723c059d474d9dd937cd

SHA256
fd559828dd86a9d8ddfb9cac229e26b67619dbb0c2ff206c80664eac9e04625a

SHA512
869f9e475d68981a2e774b01130c87b8bf5212b4e9211222f45ac500415e80bcc9ac8cddbaee0bbaac5a34f1e9d24fae731d2f5e8ea6d732a93b90f7925f6154

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0269939.exe

Filesize
598KB

MD5
3da5e4a1b4603ce3cc0834e7c7ddf337

SHA1
a13cd11eec62f47f6e6cc036ae6b726c689907f0

SHA256
87c3d21b3b67a0343f27b540508991efa3bb8ab7b64a90533f72275db80c3c18

SHA512
6ce6699fc8945437dca1cc6b1537f24e14234f31a5452cb1cdc74032d97d40f2500a097ca67d4fdaa63e1dc60a1219006401da522831e5d618e1ecc91a2b649c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0269939.exe

Filesize
598KB

MD5
3da5e4a1b4603ce3cc0834e7c7ddf337

SHA1
a13cd11eec62f47f6e6cc036ae6b726c689907f0

SHA256
87c3d21b3b67a0343f27b540508991efa3bb8ab7b64a90533f72275db80c3c18

SHA512
6ce6699fc8945437dca1cc6b1537f24e14234f31a5452cb1cdc74032d97d40f2500a097ca67d4fdaa63e1dc60a1219006401da522831e5d618e1ecc91a2b649c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8121433.exe

Filesize
373KB

MD5
250024927b086c86a4c7c354bf26ac4b

SHA1
824b696c0d548de82534367549add69fc465b79d

SHA256
77bdf9e4fe94af9bf1110d584fd93fc3d6d04010cde276ee83adb749c0a57dae

SHA512
863a2bfa6b12c6f6bbbb56abf28e0142088fe6ebe2d6cba04a29c36a9c134cc4cc273031feae52092c631f97c4d25009556eb512b6349e8598c034e51bbcede6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8121433.exe

Filesize
373KB

MD5
250024927b086c86a4c7c354bf26ac4b

SHA1
824b696c0d548de82534367549add69fc465b79d

SHA256
77bdf9e4fe94af9bf1110d584fd93fc3d6d04010cde276ee83adb749c0a57dae

SHA512
863a2bfa6b12c6f6bbbb56abf28e0142088fe6ebe2d6cba04a29c36a9c134cc4cc273031feae52092c631f97c4d25009556eb512b6349e8598c034e51bbcede6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7162717.exe

Filesize
173KB

MD5
385994fdc4212059e8631a473a7c710a

SHA1
2be1d6f61efb12051e33131f67cc6eeae96a18f3

SHA256
7535b44d42c304275f57288bb947e5ecc77b97b4adfa1e418270474c949b444c

SHA512
bcf70845682ac82356baec7d81c9f549c61f7ccb91b69860c73dce4fd0793291359b94bf3da9855037963c7efe454281e66dabcae785cc3f362df794acf33fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7162717.exe

Filesize
173KB

MD5
385994fdc4212059e8631a473a7c710a

SHA1
2be1d6f61efb12051e33131f67cc6eeae96a18f3

SHA256
7535b44d42c304275f57288bb947e5ecc77b97b4adfa1e418270474c949b444c

SHA512
bcf70845682ac82356baec7d81c9f549c61f7ccb91b69860c73dce4fd0793291359b94bf3da9855037963c7efe454281e66dabcae785cc3f362df794acf33fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6927607.exe

Filesize
217KB

MD5
9e741982fc516cfba207f3a69bf09907

SHA1
6ad15a0c162ef882842bd8845db99cecde7c96f6

SHA256
d51050a457db29f15f4064de4d346157af19aeee736ab95dfba5dcff44bca252

SHA512
ee79f9cd28a33e2fe9420786895372aa1749e01217d31584df0c0b53bca7d0f38bbb5b3e5c5d6dc5fac5b6e0e90b618659d2bc479ac6eef1b19eb91a17857cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6927607.exe

Filesize
217KB

MD5
9e741982fc516cfba207f3a69bf09907

SHA1
6ad15a0c162ef882842bd8845db99cecde7c96f6

SHA256
d51050a457db29f15f4064de4d346157af19aeee736ab95dfba5dcff44bca252

SHA512
ee79f9cd28a33e2fe9420786895372aa1749e01217d31584df0c0b53bca7d0f38bbb5b3e5c5d6dc5fac5b6e0e90b618659d2bc479ac6eef1b19eb91a17857cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1769431.exe

Filesize
15KB

MD5
8b6ca6d4b2a3f34b64a9e8d93eb26f44

SHA1
02a0bfc468d56b85fc8e6b9a0f34419f776ec2c1

SHA256
7e1b71a1570549f35dfae074f93991d6692646f27e81dc70b4bed3016ae60fbb

SHA512
2d96fdddef62d5993e2bbc72b1321d524a812a846ab8a518ba811f2028ed70d579db39125dc6e0c397662deeb47a5a42f1c1db9081abaa0479a673e15d679a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1769431.exe

Filesize
15KB

MD5
8b6ca6d4b2a3f34b64a9e8d93eb26f44

SHA1
02a0bfc468d56b85fc8e6b9a0f34419f776ec2c1

SHA256
7e1b71a1570549f35dfae074f93991d6692646f27e81dc70b4bed3016ae60fbb

SHA512
2d96fdddef62d5993e2bbc72b1321d524a812a846ab8a518ba811f2028ed70d579db39125dc6e0c397662deeb47a5a42f1c1db9081abaa0479a673e15d679a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2471383.exe

Filesize
140KB

MD5
396b22e9d2be0e7a657f37718051a2f1

SHA1
29d475ec75f10ef5db361e14ebe2826b5bc3ead5

SHA256
65141165731a29a797fd70252b04b9cad6bc6c050905899827c1090c986cca43

SHA512
96af6c8260a744d9f500b51e0f61cf01582927e45c61e5428bfa5a83f4861b3a90c10edf1e18fb1168920dfb960797f6232c13bd4b1d25211eff021749b37dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2471383.exe

Filesize
140KB

MD5
396b22e9d2be0e7a657f37718051a2f1

SHA1
29d475ec75f10ef5db361e14ebe2826b5bc3ead5

SHA256
65141165731a29a797fd70252b04b9cad6bc6c050905899827c1090c986cca43

SHA512
96af6c8260a744d9f500b51e0f61cf01582927e45c61e5428bfa5a83f4861b3a90c10edf1e18fb1168920dfb960797f6232c13bd4b1d25211eff021749b37dd9

Download Submit
memory/2832-38-0x00007FF895990000-0x00007FF896451000-memory.dmp

Filesize
10.8MB

Download
memory/2832-36-0x00007FF895990000-0x00007FF896451000-memory.dmp

Filesize
10.8MB

Download
memory/2832-35-0x0000000000B80000-0x0000000000B8A000-memory.dmp

Filesize
40KB

Download
memory/4132-45-0x0000000000B60000-0x0000000000B90000-memory.dmp

Filesize
192KB

Download
memory/4132-46-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/4132-47-0x0000000005B10000-0x0000000006128000-memory.dmp

Filesize
6.1MB

Download
memory/4132-48-0x0000000005600000-0x000000000570A000-memory.dmp

Filesize
1.0MB

Download
memory/4132-49-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/4132-50-0x00000000054F0000-0x0000000005502000-memory.dmp

Filesize
72KB

Download
memory/4132-51-0x0000000005550000-0x000000000558C000-memory.dmp

Filesize
240KB

Download
memory/4132-52-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/4132-53-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download