healer | dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JC_dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c.exe
Size

826KB
MD5

47c2c9104941b7a59626e84048763c75
SHA1

b1f506c4fb8898f81a47ccc052b5528f27283d7b
SHA256

dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c
SHA512

580dcc9c63146e46f7c2119c8dfe786a7fc3c42dc8e7900f927877b40ea44bfdc3c187a32dd658810a9b04a560e79024f6446752007eea20df503c419508cf14
SSDEEP

24576:Zydz4XOiWFAriGOMDcA/huO53yNh9DgC3V:MdznFrADuttkC

Score

10^/10

healer redline domka dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

domka

77.91.124.82:19071

Attributes

auth_value
74e19436acac85e44d691aebcc617529

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023146-33.dat	healer
behavioral2/files/0x0008000000023146-34.dat	healer
behavioral2/memory/3576-35-0x0000000000D50000-0x0000000000D5A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a5715727.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5715727.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5715727.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5715727.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5715727.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5715727.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 7 IoCs

pid	Process
4272	v1802846.exe
552	v8437379.exe
464	v9820422.exe
2988	v1875062.exe
3576	a5715727.exe
1472	b0632306.exe
2452	c9028803.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5715727.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JC_dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1802846.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v8437379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9820422.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v1875062.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3576	a5715727.exe
3576	a5715727.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	a5715727.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4272	116	JC_dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c.exe	79
PID 116 wrote to memory of 4272	116	JC_dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c.exe	79
PID 116 wrote to memory of 4272	116	JC_dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c.exe	79
PID 4272 wrote to memory of 552	4272	v1802846.exe	80
PID 4272 wrote to memory of 552	4272	v1802846.exe	80
PID 4272 wrote to memory of 552	4272	v1802846.exe	80
PID 552 wrote to memory of 464	552	v8437379.exe	81
PID 552 wrote to memory of 464	552	v8437379.exe	81
PID 552 wrote to memory of 464	552	v8437379.exe	81
PID 464 wrote to memory of 2988	464	v9820422.exe	82
PID 464 wrote to memory of 2988	464	v9820422.exe	82
PID 464 wrote to memory of 2988	464	v9820422.exe	82
PID 2988 wrote to memory of 3576	2988	v1875062.exe	83
PID 2988 wrote to memory of 3576	2988	v1875062.exe	83
PID 2988 wrote to memory of 1472	2988	v1875062.exe	84
PID 2988 wrote to memory of 1472	2988	v1875062.exe	84
PID 2988 wrote to memory of 1472	2988	v1875062.exe	84
PID 464 wrote to memory of 2452	464	v9820422.exe	85
PID 464 wrote to memory of 2452	464	v9820422.exe	85
PID 464 wrote to memory of 2452	464	v9820422.exe	85

C:\Users\Admin\AppData\Local\Temp\JC_dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c.exe
"C:\Users\Admin\AppData\Local\Temp\JC_dee6b248820a13f72f772958cfc8d3c642f3f536e1c23273fd92526e8d08a84c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1802846.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1802846.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8437379.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8437379.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9820422.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9820422.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1875062.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1875062.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5715727.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5715727.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0632306.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0632306.exe
        6⤵
        Executes dropped EXE
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9028803.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9028803.exe
        5⤵
        Executes dropped EXE
        
        PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1802846.exe

Filesize
722KB

MD5
06e4d998c2bbc0385ba307813cfe2ba9

SHA1
30fd118b1192c1edccfd6d79ebedb11bee275002

SHA256
c8b300c5061c4c380689140f447e4a34de30273a28099f123d3f766301def538

SHA512
c8e7ee046b060d5cf029e7abcc25f64ad1893692f9272cc0bca87c7adcaba4ae48ff8acee335add9783308130ede8c320ad2fb88fb9a308019099871312c58d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1802846.exe

Filesize
722KB

MD5
06e4d998c2bbc0385ba307813cfe2ba9

SHA1
30fd118b1192c1edccfd6d79ebedb11bee275002

SHA256
c8b300c5061c4c380689140f447e4a34de30273a28099f123d3f766301def538

SHA512
c8e7ee046b060d5cf029e7abcc25f64ad1893692f9272cc0bca87c7adcaba4ae48ff8acee335add9783308130ede8c320ad2fb88fb9a308019099871312c58d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8437379.exe

Filesize
498KB

MD5
b5abffbf38abce180db5c155b28ba4a3

SHA1
530cbb34ea7e6a270d43590883503235f1a644ad

SHA256
1f4cc4cbacca197080f486bd0a355cfe958621d94e6e667dc45d018215877ab8

SHA512
bb677264b1fbd4e0461e9ea7593f8f361b594e204981b5d0ac4704bfe07c6106a0dc7009bbd83f412f69a38b3832f9b4bf52006e8bd136c5868035e1efaac91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8437379.exe

Filesize
498KB

MD5
b5abffbf38abce180db5c155b28ba4a3

SHA1
530cbb34ea7e6a270d43590883503235f1a644ad

SHA256
1f4cc4cbacca197080f486bd0a355cfe958621d94e6e667dc45d018215877ab8

SHA512
bb677264b1fbd4e0461e9ea7593f8f361b594e204981b5d0ac4704bfe07c6106a0dc7009bbd83f412f69a38b3832f9b4bf52006e8bd136c5868035e1efaac91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9820422.exe

Filesize
373KB

MD5
07166714d30b24479f52548331deda0f

SHA1
bddf9552b48761bf53ee4438c4e8b5e808a4dae5

SHA256
2664d686d5a544c305fc201df7f6fa73ea5fdc0d14ddfdcc963b2b47da53f64e

SHA512
c950a734395f25327f8abee350b8dba9f7ef98ca0b2b8badd21cad343a09b17fc85765612c115a67c3007dfe768cdfaec3830e7bcda191b41e422f1553f436e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9820422.exe

Filesize
373KB

MD5
07166714d30b24479f52548331deda0f

SHA1
bddf9552b48761bf53ee4438c4e8b5e808a4dae5

SHA256
2664d686d5a544c305fc201df7f6fa73ea5fdc0d14ddfdcc963b2b47da53f64e

SHA512
c950a734395f25327f8abee350b8dba9f7ef98ca0b2b8badd21cad343a09b17fc85765612c115a67c3007dfe768cdfaec3830e7bcda191b41e422f1553f436e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9028803.exe

Filesize
174KB

MD5
e05c8ef1e82c9c9cd824697219d6ed09

SHA1
03589d20d8caa423263e3baa11f4f819de7ebad6

SHA256
aa30e1db3f572ef65ba1080eb6a6581ee56d6bd7b6b60b7867fbe869d3a59459

SHA512
e637f0a81af96b77d9f5fe1eed056a5bddf102c22de48f3e304a34b86b85944ae789aa5f88e61afbc5fb6dd078f1e416760bdb1ecda89efe96e256b7baadbebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9028803.exe

Filesize
174KB

MD5
e05c8ef1e82c9c9cd824697219d6ed09

SHA1
03589d20d8caa423263e3baa11f4f819de7ebad6

SHA256
aa30e1db3f572ef65ba1080eb6a6581ee56d6bd7b6b60b7867fbe869d3a59459

SHA512
e637f0a81af96b77d9f5fe1eed056a5bddf102c22de48f3e304a34b86b85944ae789aa5f88e61afbc5fb6dd078f1e416760bdb1ecda89efe96e256b7baadbebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1875062.exe

Filesize
217KB

MD5
41d8c68a4d47134d137a8642e26138c6

SHA1
cee9033311b09c73e821e4d7057fcc5053dc7735

SHA256
b2ffb7b05b19682bc69e9dc0cf9388c6d966a9f22dfc4a219f9ff4f8cb8cc8cf

SHA512
1e30e9a038efa2981b2ab9df1f5366e419becff772c2eb6045bffa507704fcfe00f8c17f845b15775bd568459c4a5bd08c2d7491ac9ca44c251031c254cf545c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1875062.exe

Filesize
217KB

MD5
41d8c68a4d47134d137a8642e26138c6

SHA1
cee9033311b09c73e821e4d7057fcc5053dc7735

SHA256
b2ffb7b05b19682bc69e9dc0cf9388c6d966a9f22dfc4a219f9ff4f8cb8cc8cf

SHA512
1e30e9a038efa2981b2ab9df1f5366e419becff772c2eb6045bffa507704fcfe00f8c17f845b15775bd568459c4a5bd08c2d7491ac9ca44c251031c254cf545c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5715727.exe

Filesize
19KB

MD5
c8c5e07f5ad3cf21b2adbe9b81d8d517

SHA1
fb569828dad1e75ffc27fedaaa9e74996fb57a10

SHA256
3c545f9d57c1de206a4734d2dfdcfa471fa2c3cc59dc0deb191e7fe5016e5fc3

SHA512
81834e690131a709b7e2a23dcf124fd796cd08762f55f81aef900881161cb0e6962d14916b4d5d8cc49ce13ddf4ae9fec8431500fabe37f3f34f94f665220817

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5715727.exe

Filesize
19KB

MD5
c8c5e07f5ad3cf21b2adbe9b81d8d517

SHA1
fb569828dad1e75ffc27fedaaa9e74996fb57a10

SHA256
3c545f9d57c1de206a4734d2dfdcfa471fa2c3cc59dc0deb191e7fe5016e5fc3

SHA512
81834e690131a709b7e2a23dcf124fd796cd08762f55f81aef900881161cb0e6962d14916b4d5d8cc49ce13ddf4ae9fec8431500fabe37f3f34f94f665220817

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0632306.exe

Filesize
140KB

MD5
4865cce1a7f64d95e7a0d7f0e0696a01

SHA1
7fb8d7fd32bca384c69a243427818af5807386ed

SHA256
cdc55f22b05b4a80da31666ebb15fd8e92cdc951cd62fae445f061ff54a01683

SHA512
e18c9ee85f79e1f14d265f2a485f54566f5ec92d4022ec4a46d891e1f3e41b1c786a2b57c303cb7fcca70899f6394fcb58bbed8848655cacee1c23bd361d0bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0632306.exe

Filesize
140KB

MD5
4865cce1a7f64d95e7a0d7f0e0696a01

SHA1
7fb8d7fd32bca384c69a243427818af5807386ed

SHA256
cdc55f22b05b4a80da31666ebb15fd8e92cdc951cd62fae445f061ff54a01683

SHA512
e18c9ee85f79e1f14d265f2a485f54566f5ec92d4022ec4a46d891e1f3e41b1c786a2b57c303cb7fcca70899f6394fcb58bbed8848655cacee1c23bd361d0bb5

Download Submit
memory/2452-46-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2452-45-0x0000000000EE0000-0x0000000000F10000-memory.dmp

Filesize
192KB

Download
memory/2452-47-0x0000000005E90000-0x00000000064A8000-memory.dmp

Filesize
6.1MB

Download
memory/2452-48-0x0000000005980000-0x0000000005A8A000-memory.dmp

Filesize
1.0MB

Download
memory/2452-50-0x0000000005870000-0x0000000005882000-memory.dmp

Filesize
72KB

Download
memory/2452-49-0x0000000005860000-0x0000000005870000-memory.dmp

Filesize
64KB

Download
memory/2452-51-0x00000000058D0000-0x000000000590C000-memory.dmp

Filesize
240KB

Download
memory/2452-52-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2452-53-0x0000000005860000-0x0000000005870000-memory.dmp

Filesize
64KB

Download
memory/3576-38-0x00007FFB82240000-0x00007FFB82D01000-memory.dmp

Filesize
10.8MB

Download
memory/3576-36-0x00007FFB82240000-0x00007FFB82D01000-memory.dmp

Filesize
10.8MB

Download
memory/3576-35-0x0000000000D50000-0x0000000000D5A000-memory.dmp

Filesize
40KB

Download