healer | 9cdf38cb0da9f91a8db0766d4de59676c4231ec590e9b3b29405e7880ce35c64

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2023, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a83da008a50c181d242cdf446df21ffd.exe
Size 743KB
Sample230910-qxcxpahd69
SHA256 9cdf38cb0da9f91a8db0766d4de59676c4231ec590e9b3b29405e7880ce35c64
MD5 a83da008a50c181d242cdf446df21ffd
SHA1 eff0cc10facf05ed7fae76c5d81efa9cb1e1a5bc
SHA512 a66f8e3b26b97e3505b99c34c7f4294d6c439fc142b594579c4a9347f4dcbff44df616976a738205874641dac7c94b4ac7c263a91fd26ff5a71c2e7673ab3315
SSDEEP 12288:HMrmy901k6EO9Ay0s7pgCy+L66GMOxr1LKb8cLlCPVn2VN0u9eKFP/I49cX4dowW:VyCk6D9Ay0s1vxLV1OZ1LyLlM0D0u9ex
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline virad dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/4144-21-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4772	x5361143.exe
2344	x8602746.exe
3276	g5021231.exe
1268	i1216688.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8602746.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a83da008a50c181d242cdf446df21ffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5361143.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 4144	3276	g5021231.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	3276	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4144	AppLaunch.exe
4144	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	AppLaunch.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4772	1676	a83da008a50c181d242cdf446df21ffd.exe	83
PID 1676 wrote to memory of 4772	1676	a83da008a50c181d242cdf446df21ffd.exe	83
PID 1676 wrote to memory of 4772	1676	a83da008a50c181d242cdf446df21ffd.exe	83
PID 4772 wrote to memory of 2344	4772	x5361143.exe	84
PID 4772 wrote to memory of 2344	4772	x5361143.exe	84
PID 4772 wrote to memory of 2344	4772	x5361143.exe	84
PID 2344 wrote to memory of 3276	2344	x8602746.exe	85
PID 2344 wrote to memory of 3276	2344	x8602746.exe	85
PID 2344 wrote to memory of 3276	2344	x8602746.exe	85
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 3276 wrote to memory of 4144	3276	g5021231.exe	88
PID 2344 wrote to memory of 1268	2344	x8602746.exe	92
PID 2344 wrote to memory of 1268	2344	x8602746.exe	92
PID 2344 wrote to memory of 1268	2344	x8602746.exe	92

C:\Users\Admin\AppData\Local\Temp\a83da008a50c181d242cdf446df21ffd.exe
"C:\Users\Admin\AppData\Local\Temp\a83da008a50c181d242cdf446df21ffd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5361143.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5361143.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8602746.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8602746.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5021231.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5021231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 136
        5⤵
        Program crash
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1216688.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1216688.exe
      4⤵
      Executes dropped EXE
      PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3276 -ip 3276
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5361143.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5361143.exe
Size 480KB
SHA256 11862c6a54796fb87c670916bd37e89ebb20c44a1dec59ef6ddc9982e4d4f0cd
MD5 7b96aca62fa8e23e3950e1c4aab904d3
SHA1 943a40549b92f641fb235e2ece8f4b01d679b855
SHA512 02ba4f55595c9129dfb34fcb4f50c81501a9225fc02248275c77f180a3524bf0f2846422c48778b66469537ac6a1019458141b9fe5729ebe4576aafc9eb9b0be
SSDEEP 12288:xMrMy9096gWMo966iuOSr2LKbxcLlCAVn3VNQu9J:ty3zF9VvOc2LtLlt1DQu9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5361143.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5361143.exe
Size 480KB
SHA256 11862c6a54796fb87c670916bd37e89ebb20c44a1dec59ef6ddc9982e4d4f0cd
MD5 7b96aca62fa8e23e3950e1c4aab904d3
SHA1 943a40549b92f641fb235e2ece8f4b01d679b855
SHA512 02ba4f55595c9129dfb34fcb4f50c81501a9225fc02248275c77f180a3524bf0f2846422c48778b66469537ac6a1019458141b9fe5729ebe4576aafc9eb9b0be
SSDEEP 12288:xMrMy9096gWMo966iuOSr2LKbxcLlCAVn3VNQu9J:ty3zF9VvOc2LtLlt1DQu9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8602746.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8602746.exe
Size 314KB
SHA256 cf8f9dd816369ce78f6c2da9ec2968682e224beac92f6cba00d25e123090196f
MD5 ea64063defe1008919a4cc1bbde56278
SHA1 1defbded74c793e5dd1caefaab1b27f71108bded
SHA512 6ea8289ffbf3ed9d24c46a5e0a1fb8176b62b197e9fd5028a5a1f80285005a97daeb9040f7bab375c455df6af5af6f20e83971a7eb23d9d6dd645346c5e4a26a
SSDEEP 6144:Kay+bnr+bp0yN90QEWp9gEncE/j69hGdbroYAKoUlc/9RauLFz:+Mr/y90g3g2cbhKroLKblc7agz
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8602746.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8602746.exe
Size 314KB
SHA256 cf8f9dd816369ce78f6c2da9ec2968682e224beac92f6cba00d25e123090196f
MD5 ea64063defe1008919a4cc1bbde56278
SHA1 1defbded74c793e5dd1caefaab1b27f71108bded
SHA512 6ea8289ffbf3ed9d24c46a5e0a1fb8176b62b197e9fd5028a5a1f80285005a97daeb9040f7bab375c455df6af5af6f20e83971a7eb23d9d6dd645346c5e4a26a
SSDEEP 6144:Kay+bnr+bp0yN90QEWp9gEncE/j69hGdbroYAKoUlc/9RauLFz:+Mr/y90g3g2cbhKroLKblc7agz
MD5 SHA1 SHA512 SSDEEP

Submit Download

g5021231.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5021231.exe
Size 219KB
SHA256 94b7178350ab1e5c814e60c8040084497d568003523e647dd0c364a78adb29f2
MD5 8dcfc55b46e527ba90dbb040396f0d13
SHA1 626586b6e3f6320f1a244babdefda61149b06f96
SHA512 ea7be6e5fa2fcd0f3065d00e77272b754426ef5213f1c0681ad4019e84c63d1ea2aa4d54a0c6a79ac1bcdb56d64e0efce63bd7181e2ba1fd74d7b8529a317853
SSDEEP 6144:votRVcUvtKqCVkYdkEktqoigAONpCbLGrBi:vovtHCOPfxsarBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

g5021231.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5021231.exe
Size 219KB
SHA256 94b7178350ab1e5c814e60c8040084497d568003523e647dd0c364a78adb29f2
MD5 8dcfc55b46e527ba90dbb040396f0d13
SHA1 626586b6e3f6320f1a244babdefda61149b06f96
SHA512 ea7be6e5fa2fcd0f3065d00e77272b754426ef5213f1c0681ad4019e84c63d1ea2aa4d54a0c6a79ac1bcdb56d64e0efce63bd7181e2ba1fd74d7b8529a317853
SSDEEP 6144:votRVcUvtKqCVkYdkEktqoigAONpCbLGrBi:vovtHCOPfxsarBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

i1216688.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1216688.exe
Size 174KB
SHA256 59ba53db96caeffcab570d7fc848de3d1fa37be90296ec061f1fa36feafa67f6
MD5 b50d0732da7f6322d7375a60182fe2db
SHA1 834f2bdd90694bb35f559ab6368227dd866ee204
SHA512 c4c327b716a5816254c659cea8dcdcddce84d59ff348a77e2db3e145818d623bb841bf326357c7b1d8850d25e55fd984bf95a89449672fa68bd6347fde362a9c
SSDEEP 3072:tw1a8OzGI0tR3TROjAr+jRC0+E0q6GPcWKdufXQtSoJ48e8hr:tw12GI0tR3T6+E0RfWKdufXQtSoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

i1216688.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1216688.exe
Size 174KB
SHA256 59ba53db96caeffcab570d7fc848de3d1fa37be90296ec061f1fa36feafa67f6
MD5 b50d0732da7f6322d7375a60182fe2db
SHA1 834f2bdd90694bb35f559ab6368227dd866ee204
SHA512 c4c327b716a5816254c659cea8dcdcddce84d59ff348a77e2db3e145818d623bb841bf326357c7b1d8850d25e55fd984bf95a89449672fa68bd6347fde362a9c
SSDEEP 3072:tw1a8OzGI0tR3TROjAr+jRC0+E0q6GPcWKdufXQtSoJ48e8hr:tw12GI0tR3T6+E0RfWKdufXQtSoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1268-26-0x0000000000180000-0x00000000001B0000-memory.dmp

Download

memory/1268-27-0x0000000073D60000-0x0000000074510000-memory.dmp

Download

memory/1268-28-0x00000000051C0000-0x00000000057D8000-memory.dmp

Download

memory/1268-29-0x0000000004CB0000-0x0000000004DBA000-memory.dmp

Download

memory/1268-30-0x0000000004A90000-0x0000000004AA0000-memory.dmp

Download

memory/1268-31-0x0000000004A00000-0x0000000004A12000-memory.dmp

Download

memory/1268-32-0x0000000004BA0000-0x0000000004BDC000-memory.dmp

Download

memory/1268-36-0x0000000073D60000-0x0000000074510000-memory.dmp

Download

memory/1268-37-0x0000000004A90000-0x0000000004AA0000-memory.dmp

Download

memory/4144-22-0x0000000073D60000-0x0000000074510000-memory.dmp

Download

memory/4144-21-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4144-33-0x0000000073D60000-0x0000000074510000-memory.dmp

Download

memory/4144-35-0x0000000073D60000-0x0000000074510000-memory.dmp

Download