healer | 16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132

Analysis

max time kernel
144s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe
Size

3.1MB
MD5

b0c402d3ffde0431353328b720814663
SHA1

382eed9c15c8508e1c96d2176e2f9209eca1b27e
SHA256

16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132
SHA512

2de984feabfcde9adff04848294d08ffe52e4179ecb6b56433e216e96f41f8ccdbccf25046cfaff99f7fb0d1cd3ea743ec9569e50f61e2e3a020121011b4d0c8
SSDEEP

49152:SqFTg0pXxVm8qBiU6a3vj459/z73GJgfVKSOFHdaiDM:SqFTi8VL5X/fvoHdND

Score

10^/10

healer redline ramon dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ramon

77.91.124.82:19071

Attributes

auth_value
3197576965d9513f115338c233015b40

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/4408-25-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4536	x5616068.exe
2656	x5324075.exe
3764	g5541461.exe
3260	i0022949.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AppLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5616068.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5324075.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 3764 set thread context of 4408	3764	g5541461.exe	101

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4408	AppLaunch.exe
4408	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	AppLaunch.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1728	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	92
PID 1920 wrote to memory of 1728	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	92
PID 1920 wrote to memory of 1728	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	92
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 1920 wrote to memory of 2124	1920	16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe	93
PID 2124 wrote to memory of 4536	2124	AppLaunch.exe	96
PID 2124 wrote to memory of 4536	2124	AppLaunch.exe	96
PID 2124 wrote to memory of 4536	2124	AppLaunch.exe	96
PID 4536 wrote to memory of 2656	4536	x5616068.exe	98
PID 4536 wrote to memory of 2656	4536	x5616068.exe	98
PID 4536 wrote to memory of 2656	4536	x5616068.exe	98
PID 2656 wrote to memory of 3764	2656	x5324075.exe	99
PID 2656 wrote to memory of 3764	2656	x5324075.exe	99
PID 2656 wrote to memory of 3764	2656	x5324075.exe	99
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 3764 wrote to memory of 4408	3764	g5541461.exe	101
PID 2656 wrote to memory of 3260	2656	x5324075.exe	102
PID 2656 wrote to memory of 3260	2656	x5324075.exe	102
PID 2656 wrote to memory of 3260	2656	x5324075.exe	102

C:\Users\Admin\AppData\Local\Temp\16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe
"C:\Users\Admin\AppData\Local\Temp\16dce0cb4a096d566fade0b3761d95c7d45d25227a6de8aef60893b029310132.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5616068.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5616068.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5324075.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5324075.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5541461.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5541461.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3764
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0022949.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0022949.exe
        5⤵
        Executes dropped EXE
        
        PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5616068.exe

Filesize
730KB

MD5
5be6b458cd539f780032b626ae9b44ab

SHA1
523838ba0dc65323cc43d4111c3ebcd08edfa71a

SHA256
fe508b0b89bd181b75214ddad4365f70753def42557a9ffc1efc91b738d64b6b

SHA512
2d6668a6417ea5691a92609e1083dddebf64d7f6a41302dc129a20651dad0f9a025fc4255d06317009d0d081282d719811893186709341bd80a82ba4e3410006

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5616068.exe

Filesize
730KB

MD5
5be6b458cd539f780032b626ae9b44ab

SHA1
523838ba0dc65323cc43d4111c3ebcd08edfa71a

SHA256
fe508b0b89bd181b75214ddad4365f70753def42557a9ffc1efc91b738d64b6b

SHA512
2d6668a6417ea5691a92609e1083dddebf64d7f6a41302dc129a20651dad0f9a025fc4255d06317009d0d081282d719811893186709341bd80a82ba4e3410006

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5324075.exe

Filesize
564KB

MD5
b237e9fa81d0c1f710575c94d00b317a

SHA1
e7f96894185af1990a6d5da435ee90e74a51de64

SHA256
71bd979e71b8c92adef9842c5dc665b941fc54c18c936d120e99bc8e811b8dda

SHA512
a85e5c805d91068b91e366d0fc6c02e6540e07bf56ed08bc439686a8006c5211436e223d455011f065efcee3ac861f22bfa359928aabc6f6f423c456e45fb92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5324075.exe

Filesize
564KB

MD5
b237e9fa81d0c1f710575c94d00b317a

SHA1
e7f96894185af1990a6d5da435ee90e74a51de64

SHA256
71bd979e71b8c92adef9842c5dc665b941fc54c18c936d120e99bc8e811b8dda

SHA512
a85e5c805d91068b91e366d0fc6c02e6540e07bf56ed08bc439686a8006c5211436e223d455011f065efcee3ac861f22bfa359928aabc6f6f423c456e45fb92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5541461.exe

Filesize
1.6MB

MD5
71d68b0d79691788af1461551a6bd776

SHA1
946c357cc64191b3dfe552c6488b464ae09c6288

SHA256
086ad82fbf725369cdc3120f3b6d4fedc092d348f099afd907a0bd6fb97715bf

SHA512
ada6404c41c312a340401b808b3a89a7a1fa0242ce5a1f75b04d672c42f9258b4a68d0cd02cc553f59ec1d07c26d99f2ca3457bd8e8785fef55483d670382ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5541461.exe

Filesize
1.6MB

MD5
71d68b0d79691788af1461551a6bd776

SHA1
946c357cc64191b3dfe552c6488b464ae09c6288

SHA256
086ad82fbf725369cdc3120f3b6d4fedc092d348f099afd907a0bd6fb97715bf

SHA512
ada6404c41c312a340401b808b3a89a7a1fa0242ce5a1f75b04d672c42f9258b4a68d0cd02cc553f59ec1d07c26d99f2ca3457bd8e8785fef55483d670382ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0022949.exe

Filesize
174KB

MD5
ada3b731661ba761899dbfa2329f38c7

SHA1
718216a83135c047af8ed017fc876b8f08aadae7

SHA256
508ffd661239990d84b655b43d74872bcd469f1a37be6f083fa5ce7bcfe05f23

SHA512
7eb22774982ba6571b77bb2e8dfb7828f381fe9e015b87b4f5662e89d7b44fe4db3cccf5e67ebe9fda9023f8ba2c059574ef190b7e48978c30c9ff2162e02f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0022949.exe

Filesize
174KB

MD5
ada3b731661ba761899dbfa2329f38c7

SHA1
718216a83135c047af8ed017fc876b8f08aadae7

SHA256
508ffd661239990d84b655b43d74872bcd469f1a37be6f083fa5ce7bcfe05f23

SHA512
7eb22774982ba6571b77bb2e8dfb7828f381fe9e015b87b4f5662e89d7b44fe4db3cccf5e67ebe9fda9023f8ba2c059574ef190b7e48978c30c9ff2162e02f71

Download Submit
memory/2124-3-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2124-2-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2124-1-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2124-0-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/2124-31-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/3260-30-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3260-36-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/3260-44-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/3260-40-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3260-32-0x0000000003210000-0x0000000003216000-memory.dmp

Filesize
24KB

Download
memory/3260-34-0x0000000005E00000-0x0000000006418000-memory.dmp

Filesize
6.1MB

Download
memory/3260-35-0x0000000005910000-0x0000000005A1A000-memory.dmp

Filesize
1.0MB

Download
memory/3260-29-0x0000000000D80000-0x0000000000DB0000-memory.dmp

Filesize
192KB

Download
memory/3260-37-0x0000000005850000-0x0000000005862000-memory.dmp

Filesize
72KB

Download
memory/3260-38-0x00000000058B0000-0x00000000058EC000-memory.dmp

Filesize
240KB

Download
memory/3260-39-0x0000000005A20000-0x0000000005A6C000-memory.dmp

Filesize
304KB

Download
memory/4408-33-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4408-41-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4408-43-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4408-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download