healer | 2352d5e7b3535e16521b1e97d65dd97f4606ea2c909a5fe9c682d3f4dfc003ef

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2023, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb7ca371fdf7384276f0f981c1c76c26.exe
Size 497KB
Sample230906-pck7wsfc49
SHA256 2352d5e7b3535e16521b1e97d65dd97f4606ea2c909a5fe9c682d3f4dfc003ef
MD5 bb7ca371fdf7384276f0f981c1c76c26
SHA1 4a5fb111c5b1daadd79958a10bfe11c9e155a21d
SHA512 47e73ce2f00cf470c7e51816e539821cae2caa72d8e2c2f12e6f3488ec29eadf058ed5d7fa5b1f8788d56c0dc217e0abf77d014299fadd15b58377be8c876b64
SSDEEP 12288:PMrDy90+xIqidcQZocpMUwcUcFz6dli1Gn1tDylT+:EyPx8dXCUwf2z6ri1G1ty1+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline nrava dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nrava

77.91.124.82:19071

Attributes

auth_value
43fe50e9ee6afb85588e03ac9676e2f7

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x000900000002313b-19.dat	healer
behavioral2/files/0x000900000002313b-20.dat	healer
behavioral2/memory/4948-21-0x0000000000E00000-0x0000000000E0A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3512030.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3512030.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3512030.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3512030.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3512030.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3512030.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023132-29.dat	family_redline
behavioral2/files/0x0009000000023132-30.dat	family_redline
behavioral2/memory/656-31-0x0000000000BA0000-0x0000000000BD0000-memory.dmp	family_redline

Executes dropped EXE 5 IoCs

pid	Process
4324	v6828946.exe
3252	v4639861.exe
4948	a3512030.exe
4328	b9429854.exe
656	c0828407.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3512030.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6828946.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4639861.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bb7ca371fdf7384276f0f981c1c76c26.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	a3512030.exe
4948	a3512030.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	a3512030.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4324	3668	bb7ca371fdf7384276f0f981c1c76c26.exe	83
PID 3668 wrote to memory of 4324	3668	bb7ca371fdf7384276f0f981c1c76c26.exe	83
PID 3668 wrote to memory of 4324	3668	bb7ca371fdf7384276f0f981c1c76c26.exe	83
PID 4324 wrote to memory of 3252	4324	v6828946.exe	85
PID 4324 wrote to memory of 3252	4324	v6828946.exe	85
PID 4324 wrote to memory of 3252	4324	v6828946.exe	85
PID 3252 wrote to memory of 4948	3252	v4639861.exe	86
PID 3252 wrote to memory of 4948	3252	v4639861.exe	86
PID 3252 wrote to memory of 4328	3252	v4639861.exe	88
PID 3252 wrote to memory of 4328	3252	v4639861.exe	88
PID 3252 wrote to memory of 4328	3252	v4639861.exe	88
PID 4324 wrote to memory of 656	4324	v6828946.exe	92
PID 4324 wrote to memory of 656	4324	v6828946.exe	92
PID 4324 wrote to memory of 656	4324	v6828946.exe	92

C:\Users\Admin\AppData\Local\Temp\bb7ca371fdf7384276f0f981c1c76c26.exe
"C:\Users\Admin\AppData\Local\Temp\bb7ca371fdf7384276f0f981c1c76c26.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6828946.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6828946.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4639861.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4639861.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3512030.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3512030.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9429854.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9429854.exe
      4⤵
      Executes dropped EXE
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0828407.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0828407.exe
    3⤵
    - Executes dropped EXE
    PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v6828946.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6828946.exe
Size 373KB
SHA256 aeab0c5609b0387b52374f879da07150d2f5b69147eee5a04b979b1b4e65e2e1
MD5 b79da43af84892f2f4450ad5b0c1e6a1
SHA1 8422ffe3953b61e1cd702cd96ea2fbfbce24f761
SHA512 d7b0b1d56bc9334a9069920ca99b57734316e5fcaf4581ba5215ff8be93d635f6466fda1c11b4a4fd719eef088f6b5d40cfc963987da64a3c25198e4fd8d67e1
SSDEEP 6144:KKy+bnr+Jp0yN90QE9cpt0oGKkadc2cFZ9FdliDErf/Z0jK2TcwseAjc:6Mrly90zcpCUlc2cFzFdliDGW1TcJeCc
MD5 SHA1 SHA512 SSDEEP

Submit Download

v6828946.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6828946.exe
Size 373KB
SHA256 aeab0c5609b0387b52374f879da07150d2f5b69147eee5a04b979b1b4e65e2e1
MD5 b79da43af84892f2f4450ad5b0c1e6a1
SHA1 8422ffe3953b61e1cd702cd96ea2fbfbce24f761
SHA512 d7b0b1d56bc9334a9069920ca99b57734316e5fcaf4581ba5215ff8be93d635f6466fda1c11b4a4fd719eef088f6b5d40cfc963987da64a3c25198e4fd8d67e1
SSDEEP 6144:KKy+bnr+Jp0yN90QE9cpt0oGKkadc2cFZ9FdliDErf/Z0jK2TcwseAjc:6Mrly90zcpCUlc2cFzFdliDGW1TcJeCc
MD5 SHA1 SHA512 SSDEEP

Submit Download

c0828407.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0828407.exe
Size 174KB
SHA256 e141852d6f621aed3c2851ee6f4ad70a2cd094c419079621bfef198d495d96f1
MD5 b334c554ec9113c8c5cda5741a37129c
SHA1 ce8ea45ba9801bf5b2d3e96372467c1cb28713e6
SHA512 7027e5e99e0744f05bebc1bab4566558b25991b401df98f9f94caac8ea31865522c9c064802118ae442e4580ff2f84e37c79ee9760923b0b441174b31d4a5772
SSDEEP 3072:dZIsEt70Y4jI0iQ9/xOc0hqdRBDtsaE0GMW5owC+CJ38e8h8:dZIVtKjI0iQ9/9RYaE0kowC+CB
MD5 SHA1 SHA512 SSDEEP

Submit Download

c0828407.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c0828407.exe
Size 174KB
SHA256 e141852d6f621aed3c2851ee6f4ad70a2cd094c419079621bfef198d495d96f1
MD5 b334c554ec9113c8c5cda5741a37129c
SHA1 ce8ea45ba9801bf5b2d3e96372467c1cb28713e6
SHA512 7027e5e99e0744f05bebc1bab4566558b25991b401df98f9f94caac8ea31865522c9c064802118ae442e4580ff2f84e37c79ee9760923b0b441174b31d4a5772
SSDEEP 3072:dZIsEt70Y4jI0iQ9/xOc0hqdRBDtsaE0GMW5owC+CJ38e8h8:dZIVtKjI0iQ9/9RYaE0kowC+CB
MD5 SHA1 SHA512 SSDEEP

Submit Download

v4639861.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4639861.exe
Size 217KB
SHA256 57193f0119d92ff3e8830a34b5a0b77b8172fca6791ebf1088957c89d26ba85d
MD5 7b0ddbd8ccbce16cd57a47701f10f524
SHA1 268d4f2aa792fdd98225d6d0ee226c2f6836f7d4
SHA512 a7d685e92f1705aa68649a9e7681d453179d58cf68fe32ecdc6eba0a758c1786a65fb5dd56e14b3db896d0b5ed9cdb977246708d2f7a27b85f9e29266d6107d7
SSDEEP 3072:Kvy+bnr+O105GWp1icKAArDZz4N9GhbkrNEk1C2udkeuDsfnVb/GoA:Kvy+bnr+Pp0yN90QEhdluDEnx/B
MD5 SHA1 SHA512 SSDEEP

Submit Download

v4639861.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4639861.exe
Size 217KB
SHA256 57193f0119d92ff3e8830a34b5a0b77b8172fca6791ebf1088957c89d26ba85d
MD5 7b0ddbd8ccbce16cd57a47701f10f524
SHA1 268d4f2aa792fdd98225d6d0ee226c2f6836f7d4
SHA512 a7d685e92f1705aa68649a9e7681d453179d58cf68fe32ecdc6eba0a758c1786a65fb5dd56e14b3db896d0b5ed9cdb977246708d2f7a27b85f9e29266d6107d7
SSDEEP 3072:Kvy+bnr+O105GWp1icKAArDZz4N9GhbkrNEk1C2udkeuDsfnVb/GoA:Kvy+bnr+Pp0yN90QEhdluDEnx/B
MD5 SHA1 SHA512 SSDEEP

Submit Download

a3512030.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3512030.exe
Size 15KB
SHA256 68db50c45ee96724ea04b734d3343845ce043368b9648d128d875537846445ef
MD5 428c065b9fffccbcf36096967ddf4ad5
SHA1 11829475b871010c6daec6fca43067363852166a
SHA512 f55b11ca3e507c176fc9ce828306e825759f15070aa236a70c0b0113abaff61eedfa7b36c5338af2ec56a2e751fe48b5591d525f643256ceee39a50cc23b8c14
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

a3512030.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3512030.exe
Size 15KB
SHA256 68db50c45ee96724ea04b734d3343845ce043368b9648d128d875537846445ef
MD5 428c065b9fffccbcf36096967ddf4ad5
SHA1 11829475b871010c6daec6fca43067363852166a
SHA512 f55b11ca3e507c176fc9ce828306e825759f15070aa236a70c0b0113abaff61eedfa7b36c5338af2ec56a2e751fe48b5591d525f643256ceee39a50cc23b8c14
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b9429854.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9429854.exe
Size 140KB
SHA256 1ceac770bdd2ec9d4c746da95e415b5c75ee14907c352ae3b08b0508b4c92a36
MD5 86bc19c5507307aa263b53b4d1a4c498
SHA1 a82418cc1234c1c2219b753c5d61b9ec9aa18e9d
SHA512 433f4dea9c51995c42e663f6aa33a9f82b18638f3e59d0b23b0b3606459b73c4b3709bdd9e0df175f8786deb43d6405ba21567876cfbcdcf63dde737a636e875
SSDEEP 3072:BTrwPG9SiG103j9DR0CrlIM00tob89UoxqhLPNg8Z4PbjfCp:x59SO108OfSfCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

b9429854.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b9429854.exe
Size 140KB
SHA256 1ceac770bdd2ec9d4c746da95e415b5c75ee14907c352ae3b08b0508b4c92a36
MD5 86bc19c5507307aa263b53b4d1a4c498
SHA1 a82418cc1234c1c2219b753c5d61b9ec9aa18e9d
SHA512 433f4dea9c51995c42e663f6aa33a9f82b18638f3e59d0b23b0b3606459b73c4b3709bdd9e0df175f8786deb43d6405ba21567876cfbcdcf63dde737a636e875
SSDEEP 3072:BTrwPG9SiG103j9DR0CrlIM00tob89UoxqhLPNg8Z4PbjfCp:x59SO108OfSfCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-31-0x0000000000BA0000-0x0000000000BD0000-memory.dmp

Download

memory/656-32-0x0000000073CD0000-0x0000000074480000-memory.dmp

Download

memory/656-33-0x0000000005BA0000-0x00000000061B8000-memory.dmp

Download

memory/656-34-0x0000000005690000-0x000000000579A000-memory.dmp

Download

memory/656-35-0x0000000005470000-0x0000000005480000-memory.dmp

Download

memory/656-36-0x0000000005420000-0x0000000005432000-memory.dmp

Download

memory/656-37-0x00000000055C0000-0x00000000055FC000-memory.dmp

Download

memory/656-38-0x0000000073CD0000-0x0000000074480000-memory.dmp

Download

memory/656-39-0x0000000005470000-0x0000000005480000-memory.dmp

Download

memory/4948-24-0x00007FF9F21F0000-0x00007FF9F2CB1000-memory.dmp

Download

memory/4948-22-0x00007FF9F21F0000-0x00007FF9F2CB1000-memory.dmp

Download

memory/4948-21-0x0000000000E00000-0x0000000000E0A000-memory.dmp

Download