healer | a4ee2cfc1cbd9e298141bbfde343af98dd6f8ef9f72edae72e40689f894d76a8

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 828KB
Sample230831-rjed2afa71
SHA256 a4ee2cfc1cbd9e298141bbfde343af98dd6f8ef9f72edae72e40689f894d76a8
MD5 9451cabb6a19f7a4610bc7abc27feddb
SHA1 fa064a2352b283669be8a781a7059d8005d22b79
SHA512 11d9c87bf9021ff09baf3fd54714d87cc6c3557742d8dc5f47d36af25ee53b8c607642cb18636227fbebe812ed45ecac42d09d2c6e0b67df0e323ded19afa499
SSDEEP 12288:nMrAy90jey2SiHFSumTGMYjvPJMIop5Nh+WKJlWUCucfRF583SYTYKcqst2c6A:nyRN5XeEjZMFXh+WKoxLfRL8CDqa56A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline sruta dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

sruta

77.91.124.82:19071

Attributes

auth_value
c556edcd49703319eca74247de20c236

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231d0-33.dat	healer
behavioral2/files/0x00070000000231d0-34.dat	healer
behavioral2/memory/1600-35-0x0000000000FE0000-0x0000000000FEA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a1848296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1848296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1848296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1848296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1848296.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1848296.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

pid	Process
1512	v4337748.exe
2952	v7777234.exe
3452	v0112683.exe
2020	v1365745.exe
1600	a1848296.exe
3092	b7311188.exe
224	c2413523.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1848296.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4337748.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7777234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v0112683.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v1365745.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1600	a1848296.exe
1600	a1848296.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	a1848296.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1512	1656	file.exe	82
PID 1656 wrote to memory of 1512	1656	file.exe	82
PID 1656 wrote to memory of 1512	1656	file.exe	82
PID 1512 wrote to memory of 2952	1512	v4337748.exe	83
PID 1512 wrote to memory of 2952	1512	v4337748.exe	83
PID 1512 wrote to memory of 2952	1512	v4337748.exe	83
PID 2952 wrote to memory of 3452	2952	v7777234.exe	84
PID 2952 wrote to memory of 3452	2952	v7777234.exe	84
PID 2952 wrote to memory of 3452	2952	v7777234.exe	84
PID 3452 wrote to memory of 2020	3452	v0112683.exe	85
PID 3452 wrote to memory of 2020	3452	v0112683.exe	85
PID 3452 wrote to memory of 2020	3452	v0112683.exe	85
PID 2020 wrote to memory of 1600	2020	v1365745.exe	86
PID 2020 wrote to memory of 1600	2020	v1365745.exe	86
PID 2020 wrote to memory of 3092	2020	v1365745.exe	92
PID 2020 wrote to memory of 3092	2020	v1365745.exe	92
PID 2020 wrote to memory of 3092	2020	v1365745.exe	92
PID 3452 wrote to memory of 224	3452	v0112683.exe	93
PID 3452 wrote to memory of 224	3452	v0112683.exe	93
PID 3452 wrote to memory of 224	3452	v0112683.exe	93

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4337748.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4337748.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7777234.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7777234.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0112683.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0112683.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1365745.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1365745.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1848296.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1848296.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7311188.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7311188.exe
        6⤵
        Executes dropped EXE
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2413523.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2413523.exe
        5⤵
        Executes dropped EXE
        
        PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v4337748.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4337748.exe
Size 723KB
SHA256 c4b7d00b4a04beaea9fd20281ca859d3f34f8827f98d4f1bd6022f06502e03ee
MD5 08f9a3b5fe3bf3bff4060a042f4765c3
SHA1 dc2d582c97d6ebac0f162e6e90dc9e9d60d2ba64
SHA512 5d5b9275ce48ebcf76ed96e5b94c94fc55eef2bb91846e18ade6a3cfd6f74e9e02c618b7534c83b464d6b8561604ee194919c2604c3b615bb393bf565d3c0235
SSDEEP 12288:8Mriy901VlKLmOVOHJjvPJMIBpcKTSBPAHWtJaW7CuwKRF/8372THKc0st2Z6/:WyLLpgpjZMifSJAHW/bWLKRN8rU0aM6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

v4337748.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4337748.exe
Size 723KB
SHA256 c4b7d00b4a04beaea9fd20281ca859d3f34f8827f98d4f1bd6022f06502e03ee
MD5 08f9a3b5fe3bf3bff4060a042f4765c3
SHA1 dc2d582c97d6ebac0f162e6e90dc9e9d60d2ba64
SHA512 5d5b9275ce48ebcf76ed96e5b94c94fc55eef2bb91846e18ade6a3cfd6f74e9e02c618b7534c83b464d6b8561604ee194919c2604c3b615bb393bf565d3c0235
SSDEEP 12288:8Mriy901VlKLmOVOHJjvPJMIBpcKTSBPAHWtJaW7CuwKRF/8372THKc0st2Z6/:WyLLpgpjZMifSJAHW/bWLKRN8rU0aM6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7777234.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7777234.exe
Size 497KB
SHA256 d32ec82f55016c334e1e5af15765f0d48760d97a0adaffc0091c853013ab3db7
MD5 7d7b8829c810676260554a60845184d6
SHA1 5f88b1b8fe029704eb1da743c608a9e2d4110fa1
SHA512 6c03d4004f283bbe1ed6d61d1e91e5742e34b8898d33ecd31fbca2632c3b56538a0f1fcf0860cb4acaaa54671f3b83f1e41d46b1dee27df4d9da47c381eac16c
SSDEEP 12288:+Mroy90ql62jpKK/KBPVHWnJlWXCuoXRFBS38/:CytVpKJVHWJoSnXRnSs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7777234.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7777234.exe
Size 497KB
SHA256 d32ec82f55016c334e1e5af15765f0d48760d97a0adaffc0091c853013ab3db7
MD5 7d7b8829c810676260554a60845184d6
SHA1 5f88b1b8fe029704eb1da743c608a9e2d4110fa1
SHA512 6c03d4004f283bbe1ed6d61d1e91e5742e34b8898d33ecd31fbca2632c3b56538a0f1fcf0860cb4acaaa54671f3b83f1e41d46b1dee27df4d9da47c381eac16c
SSDEEP 12288:+Mroy90ql62jpKK/KBPVHWnJlWXCuoXRFBS38/:CytVpKJVHWJoSnXRnSs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

v0112683.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0112683.exe
Size 372KB
SHA256 327fd7e92e3a01ecb913674aaefaa6dbd6174fe2761108aa240e4b59ae41ca04
MD5 902ee12fceedd635f71b7b7b1e3e7b8f
SHA1 e2ca499f23fe748e8d31896f878a50f876dab5a9
SHA512 eb0fb688ff2452adb4ee5bebca94265b8fd09e96908aa5836eb770ae2f0559862135c13b1a92ddd7b6574f6e1b07fb3b216f62279ede67cf04008e09234d4b27
SSDEEP 6144:KMy+bnr+Lp0yN90QEsQ/J//SYPW8+1/XdQwh6+DDnE+eCrS1Rmn8jCdEFo10eFLy:kMrLy90TR//LO8+1/n7nnJAmUCuWl5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

v0112683.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0112683.exe
Size 372KB
SHA256 327fd7e92e3a01ecb913674aaefaa6dbd6174fe2761108aa240e4b59ae41ca04
MD5 902ee12fceedd635f71b7b7b1e3e7b8f
SHA1 e2ca499f23fe748e8d31896f878a50f876dab5a9
SHA512 eb0fb688ff2452adb4ee5bebca94265b8fd09e96908aa5836eb770ae2f0559862135c13b1a92ddd7b6574f6e1b07fb3b216f62279ede67cf04008e09234d4b27
SSDEEP 6144:KMy+bnr+Lp0yN90QEsQ/J//SYPW8+1/XdQwh6+DDnE+eCrS1Rmn8jCdEFo10eFLy:kMrLy90TR//LO8+1/n7nnJAmUCuWl5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2413523.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2413523.exe
Size 176KB
SHA256 3208a31697c9290343ad88387daae01f15c4d15612be8900a2a4c0038c195af1
MD5 9e10faa42c5b7fd76d7de5165a104ebe
SHA1 43415b8f16096e41d51579b6130591fb88dfb50d
SHA512 cd535e9d7c93d8e8f090d088c84668438c86211d5a10a3cc8fa2d4d96775de64fa4f2ed38d384a90c5c8ff0171a99a547fadbcadcda76cd4b47cc72c13763800
SSDEEP 3072:1hg4vliHjI05aBkbOVCFlAsNN4E0sW+1QlQneUJE8e8hA:1C44jI05aBkF4E0KQlQneUC
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2413523.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c2413523.exe
Size 176KB
SHA256 3208a31697c9290343ad88387daae01f15c4d15612be8900a2a4c0038c195af1
MD5 9e10faa42c5b7fd76d7de5165a104ebe
SHA1 43415b8f16096e41d51579b6130591fb88dfb50d
SHA512 cd535e9d7c93d8e8f090d088c84668438c86211d5a10a3cc8fa2d4d96775de64fa4f2ed38d384a90c5c8ff0171a99a547fadbcadcda76cd4b47cc72c13763800
SSDEEP 3072:1hg4vliHjI05aBkbOVCFlAsNN4E0sW+1QlQneUJE8e8hA:1C44jI05aBkF4E0KQlQneUC
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1365745.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1365745.exe
Size 217KB
SHA256 2f1f474c48ca164d5156c44a04cc688f424b89ff1fa5a3c1dd2c6a7596c954fc
MD5 73822e49163b9dd032e9693ff6b2e1ce
SHA1 7e5bb4ff5383ed20776713f8392169824e0bf328
SHA512 35aa9579953344cea0aefd75f517eb83cfbf633fab7f0bb7f33a3f86f81b82283ae959074b5602c2b0f7e0cf1611920595b785d1d687013be8ea3f40c9f15eb5
SSDEEP 6144:Kjy+bnr+Mp0yN90QEwjVH6+yiMv1YYKk:ZMrQy90CjVH6+yi3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1365745.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1365745.exe
Size 217KB
SHA256 2f1f474c48ca164d5156c44a04cc688f424b89ff1fa5a3c1dd2c6a7596c954fc
MD5 73822e49163b9dd032e9693ff6b2e1ce
SHA1 7e5bb4ff5383ed20776713f8392169824e0bf328
SHA512 35aa9579953344cea0aefd75f517eb83cfbf633fab7f0bb7f33a3f86f81b82283ae959074b5602c2b0f7e0cf1611920595b785d1d687013be8ea3f40c9f15eb5
SSDEEP 6144:Kjy+bnr+Mp0yN90QEwjVH6+yiMv1YYKk:ZMrQy90CjVH6+yi3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1848296.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1848296.exe
Size 18KB
SHA256 1c76a65acfeb10daef52175fc9f5a564ebec235de94f55f8c968a9c448b0c02d
MD5 d0043ab29aa66dce824a1bdd90ee89fd
SHA1 001370983ec43b7488a3278df4bb8cc909304b59
SHA512 04e03acc72c58e18d2be6df8eb0cb97502f4fa26fba924263c81edf7bd49158c591503a6e94d843e6e4894d732fc34c8b9833faacd7bd0fffb7f0bd2b00e3f39
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1848296.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1848296.exe
Size 18KB
SHA256 1c76a65acfeb10daef52175fc9f5a564ebec235de94f55f8c968a9c448b0c02d
MD5 d0043ab29aa66dce824a1bdd90ee89fd
SHA1 001370983ec43b7488a3278df4bb8cc909304b59
SHA512 04e03acc72c58e18d2be6df8eb0cb97502f4fa26fba924263c81edf7bd49158c591503a6e94d843e6e4894d732fc34c8b9833faacd7bd0fffb7f0bd2b00e3f39
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7311188.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7311188.exe
Size 141KB
SHA256 e54e1eab937609081f1fa903b10e85a8e396e75c12e0e74cf88b78daecacac54
MD5 c192b66f7fe315fc049e63f5450e0729
SHA1 6ed197de1500be26628afcaf980b0570a5b64c7e
SHA512 32c11eaa517e21b8eda0a45dc13f1abbd9a2fb57d8bd336f63ff1f4f30750e6f12dac229c42a43fc2cd7dc8babd5dce8359545c3d203ac34b7a51ad3ca2c30ef
SSDEEP 3072:BDrwPGYSintx3j9D20C4TS30T8A2L2UxJbhEANN8Z4PXjuCp:d5YSiK0stZtuCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7311188.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7311188.exe
Size 141KB
SHA256 e54e1eab937609081f1fa903b10e85a8e396e75c12e0e74cf88b78daecacac54
MD5 c192b66f7fe315fc049e63f5450e0729
SHA1 6ed197de1500be26628afcaf980b0570a5b64c7e
SHA512 32c11eaa517e21b8eda0a45dc13f1abbd9a2fb57d8bd336f63ff1f4f30750e6f12dac229c42a43fc2cd7dc8babd5dce8359545c3d203ac34b7a51ad3ca2c30ef
SSDEEP 3072:BDrwPGYSintx3j9D20C4TS30T8A2L2UxJbhEANN8Z4PXjuCp:d5YSiK0stZtuCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-46-0x0000000074300000-0x0000000074AB0000-memory.dmp

Download

memory/224-45-0x0000000000370000-0x00000000003A0000-memory.dmp

Download

memory/224-47-0x000000000A660000-0x000000000AC78000-memory.dmp

Download

memory/224-48-0x000000000A1E0000-0x000000000A2EA000-memory.dmp

Download

memory/224-49-0x0000000002550000-0x0000000002560000-memory.dmp

Download

memory/224-50-0x000000000A120000-0x000000000A132000-memory.dmp

Download

memory/224-51-0x000000000A180000-0x000000000A1BC000-memory.dmp

Download

memory/224-52-0x0000000074300000-0x0000000074AB0000-memory.dmp

Download

memory/224-53-0x0000000002550000-0x0000000002560000-memory.dmp

Download

memory/1600-38-0x00007FFE5D580000-0x00007FFE5E041000-memory.dmp

Download

memory/1600-36-0x00007FFE5D580000-0x00007FFE5E041000-memory.dmp

Download

memory/1600-35-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

Download