healer | c07e47bde15ca1a9c186751db362acd62979d421f39eee1d579b558efe932eb5

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2023, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83b4438508a3f84c7606266a81a3e079.exe
Size 651KB
Sample230907-janmcafd72
SHA256 c07e47bde15ca1a9c186751db362acd62979d421f39eee1d579b558efe932eb5
MD5 83b4438508a3f84c7606266a81a3e079
SHA1 a14fd55c012a1a7dd2cad0bb911800739961657c
SHA512 1f25a4c783d660cc30934eaaafb0159484b7ed93d69cdc423d49378199c0645b77f0371fc6ba70b14b3fd728f8ca0c3df13e0babccf195f486b460e603f11afe
SSDEEP 12288:VMrPy90ylB0bn6fPMSXIqIqykYTxmmn4Sl/Ec3bJkiWCiGNrjmTkqnw1Pr:SyZjRBpyv3n4AschJhrwk91Pr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023285-26.dat	healer
behavioral2/files/0x0008000000023285-27.dat	healer
behavioral2/memory/3532-28-0x00000000008E0000-0x00000000008EA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q4975734.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q4975734.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q4975734.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q4975734.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q4975734.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q4975734.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
700	z0881110.exe
3144	z0265365.exe
4800	z3029295.exe
3532	q4975734.exe
1820	s4665484.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q4975734.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	83b4438508a3f84c7606266a81a3e079.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0881110.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0265365.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z3029295.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3532	q4975734.exe
3532	q4975734.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	q4975734.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 700	1616	83b4438508a3f84c7606266a81a3e079.exe	87
PID 1616 wrote to memory of 700	1616	83b4438508a3f84c7606266a81a3e079.exe	87
PID 1616 wrote to memory of 700	1616	83b4438508a3f84c7606266a81a3e079.exe	87
PID 700 wrote to memory of 3144	700	z0881110.exe	88
PID 700 wrote to memory of 3144	700	z0881110.exe	88
PID 700 wrote to memory of 3144	700	z0881110.exe	88
PID 3144 wrote to memory of 4800	3144	z0265365.exe	89
PID 3144 wrote to memory of 4800	3144	z0265365.exe	89
PID 3144 wrote to memory of 4800	3144	z0265365.exe	89
PID 4800 wrote to memory of 3532	4800	z3029295.exe	90
PID 4800 wrote to memory of 3532	4800	z3029295.exe	90
PID 4800 wrote to memory of 1820	4800	z3029295.exe	93
PID 4800 wrote to memory of 1820	4800	z3029295.exe	93
PID 4800 wrote to memory of 1820	4800	z3029295.exe	93

C:\Users\Admin\AppData\Local\Temp\83b4438508a3f84c7606266a81a3e079.exe
"C:\Users\Admin\AppData\Local\Temp\83b4438508a3f84c7606266a81a3e079.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0881110.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0881110.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0265365.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0265365.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3029295.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3029295.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q4975734.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q4975734.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4665484.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4665484.exe
        5⤵
        Executes dropped EXE
        
        PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z0881110.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0881110.exe
Size 554KB
SHA256 1817c00eae11805bf8be908d55812da1f8e27b5603c7a2ecc33dd7965680e577
MD5 b1073d19a96c38b3e7fcae26d67ba736
SHA1 c48081ba6e4fc81694791d1e2ca06daebf49e47d
SHA512 36a7eb7caf7d35ade48720ba32a96a44ddfddc9435fa6af25b0e27b063b2e51b5708762a090b46511821d625c4a927339a07d47305703d083ce3019bb3475b56
SSDEEP 12288:8Mr+y90EjTfMhZrryqI0/89iWWuG4rC6YH3G01/:6yl3sryfclgrQHJ1/
MD5 SHA1 SHA512 SSDEEP

Submit Download

z0881110.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0881110.exe
Size 554KB
SHA256 1817c00eae11805bf8be908d55812da1f8e27b5603c7a2ecc33dd7965680e577
MD5 b1073d19a96c38b3e7fcae26d67ba736
SHA1 c48081ba6e4fc81694791d1e2ca06daebf49e47d
SHA512 36a7eb7caf7d35ade48720ba32a96a44ddfddc9435fa6af25b0e27b063b2e51b5708762a090b46511821d625c4a927339a07d47305703d083ce3019bb3475b56
SSDEEP 12288:8Mr+y90EjTfMhZrryqI0/89iWWuG4rC6YH3G01/:6yl3sryfclgrQHJ1/
MD5 SHA1 SHA512 SSDEEP

Submit Download

z0265365.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0265365.exe
Size 388KB
SHA256 10f63289548cd836092ea8252096f2e463daeea071490aade8de239390c9afc1
MD5 2468cb0f723fd446265b520459dd4d2f
SHA1 4b96f8c8bc36ab23109ccd4bbab9e6c2410b61b0
SHA512 6f8008d7d82ebfd78946ce1dbe67e106b9424fcf32048e83fd21d92e4ea383f8922194fbd4229cf25ab16e7d5c59255bac5f56ea23d1c5d793b8aaeecd92d128
SSDEEP 6144:K5y+bnr+zp0yN90QEwIOLjegyVY4HmR2MlZdpjiCRuuG4usTbfMgve7HeG:LMrvy90EjryVy9pjiWuuG4rMUYHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

z0265365.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0265365.exe
Size 388KB
SHA256 10f63289548cd836092ea8252096f2e463daeea071490aade8de239390c9afc1
MD5 2468cb0f723fd446265b520459dd4d2f
SHA1 4b96f8c8bc36ab23109ccd4bbab9e6c2410b61b0
SHA512 6f8008d7d82ebfd78946ce1dbe67e106b9424fcf32048e83fd21d92e4ea383f8922194fbd4229cf25ab16e7d5c59255bac5f56ea23d1c5d793b8aaeecd92d128
SSDEEP 6144:K5y+bnr+zp0yN90QEwIOLjegyVY4HmR2MlZdpjiCRuuG4usTbfMgve7HeG:LMrvy90EjryVy9pjiWuuG4rMUYHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3029295.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3029295.exe
Size 206KB
SHA256 81ebcbc20e6015a1135ca9db2789b07b97d5fa09c1459b201f85d654ebf4d31e
MD5 973af9a2a292ea1e4c3b15d8b52c9277
SHA1 d32cd4f2572b10f909289290d0accf91db65e6c8
SHA512 ad20f90625b0acf59df00051ba87f549241e5517565cf4b5d63847d797cea330608973f2b1551c5dd5cc487e4e27e254b06c8cc52251656e03f1cce15afa647a
SSDEEP 6144:K3y+bnr+Vp0yN90QEGNM8+l42D+9TkBc3:JMrxy90SdUoB88
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3029295.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3029295.exe
Size 206KB
SHA256 81ebcbc20e6015a1135ca9db2789b07b97d5fa09c1459b201f85d654ebf4d31e
MD5 973af9a2a292ea1e4c3b15d8b52c9277
SHA1 d32cd4f2572b10f909289290d0accf91db65e6c8
SHA512 ad20f90625b0acf59df00051ba87f549241e5517565cf4b5d63847d797cea330608973f2b1551c5dd5cc487e4e27e254b06c8cc52251656e03f1cce15afa647a
SSDEEP 6144:K3y+bnr+Vp0yN90QEGNM8+l42D+9TkBc3:JMrxy90SdUoB88
MD5 SHA1 SHA512 SSDEEP

Submit Download

q4975734.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q4975734.exe
Size 12KB
SHA256 cb760204ca5099235015584495d1d45f58957e6aeb919e3b05ba7d5a07c05402
MD5 7e05e8ca9241a5a0be38babf54ecbac1
SHA1 e9f793fd8d5630b524da4d51d0a7a958b7e07e68
SHA512 09575846d4bce3d3291eeb76c28e078e4115bd4c9830fe17f6f252e194e03180e3061a954256dccc3e68f8635ed78809286ebc3db29022f448ac551e7c4e3fdb
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

q4975734.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q4975734.exe
Size 12KB
SHA256 cb760204ca5099235015584495d1d45f58957e6aeb919e3b05ba7d5a07c05402
MD5 7e05e8ca9241a5a0be38babf54ecbac1
SHA1 e9f793fd8d5630b524da4d51d0a7a958b7e07e68
SHA512 09575846d4bce3d3291eeb76c28e078e4115bd4c9830fe17f6f252e194e03180e3061a954256dccc3e68f8635ed78809286ebc3db29022f448ac551e7c4e3fdb
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

s4665484.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4665484.exe
Size 176KB
SHA256 03fd0d84a66ddd3bb18a4b3535f90c0444d1be85f7f0faf5606661236ea55525
MD5 fa29b81fe8880b1d4129e4052b968295
SHA1 e7031645abf2ebb87dc1deb1594adf239075f98b
SHA512 2f8ec4e500bacd11f2aee343f6eb56ea937829e2e82fcb0f518a8334fa43056a446bff30fdfd44fe53f826031e07b3e578c29c490d767b9b04df8ab1efe8bb1d
SSDEEP 3072:0P7NPifVI0pMLGKOmT0xLbE2FE0CBFOshR0cJj8e8hv:e7sVI0pMLG/bxFE0GhR0cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

s4665484.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4665484.exe
Size 176KB
SHA256 03fd0d84a66ddd3bb18a4b3535f90c0444d1be85f7f0faf5606661236ea55525
MD5 fa29b81fe8880b1d4129e4052b968295
SHA1 e7031645abf2ebb87dc1deb1594adf239075f98b
SHA512 2f8ec4e500bacd11f2aee343f6eb56ea937829e2e82fcb0f518a8334fa43056a446bff30fdfd44fe53f826031e07b3e578c29c490d767b9b04df8ab1efe8bb1d
SSDEEP 3072:0P7NPifVI0pMLGKOmT0xLbE2FE0CBFOshR0cJj8e8hv:e7sVI0pMLG/bxFE0GhR0cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1820-37-0x00000000051D0000-0x00000000057E8000-memory.dmp

Download

memory/1820-35-0x00000000000A0000-0x00000000000D0000-memory.dmp

Download

memory/1820-36-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/1820-38-0x0000000004CC0000-0x0000000004DCA000-memory.dmp

Download

memory/1820-39-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Download

memory/1820-40-0x0000000004B50000-0x0000000004B62000-memory.dmp

Download

memory/1820-41-0x0000000004BF0000-0x0000000004C2C000-memory.dmp

Download

memory/1820-42-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/1820-43-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Download

memory/3532-31-0x00007FFC788F0000-0x00007FFC793B1000-memory.dmp

Download

memory/3532-29-0x00007FFC788F0000-0x00007FFC793B1000-memory.dmp

Download

memory/3532-28-0x00000000008E0000-0x00000000008EA000-memory.dmp

Download