healer | 3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454

Analysis

max time kernel
168s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe
Size

930KB
MD5

3394188fe863aba4d803171fa66ba0aa
SHA1

3c7db7105023ddc55e8d1c079a94b4230c60d110
SHA256

3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454
SHA512

bdf551c4d90f1fea0d7f858647ee7c2f1b0e47a929c5943e894929b3d4884f6d3bad65b2b8938cd24a5ba1b3ed3706a0d4e76a17b171f723dbc0b7db444dc449
SSDEEP

24576:biuBtZBA0cjN3hC6grx5zZkyB2vyhvI5reEXYdGqki97mI:uuBfC0w3hChrx1eyB2vUA5zXYUqx97T

Score

10^/10

healer redline moner dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

moner

77.91.124.82:19071

Attributes

auth_value
a94cd9e01643e1945b296c28a2f28707

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/556-25-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
372	x5656301.exe
2028	x9892298.exe
1680	g4304859.exe
1648	i0209610.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AppLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5656301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x9892298.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3260 set thread context of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 1680 set thread context of 556	1680	g4304859.exe	100

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
556	AppLaunch.exe
556	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	AppLaunch.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 3260 wrote to memory of 1760	3260	3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe	95
PID 1760 wrote to memory of 372	1760	AppLaunch.exe	96
PID 1760 wrote to memory of 372	1760	AppLaunch.exe	96
PID 1760 wrote to memory of 372	1760	AppLaunch.exe	96
PID 372 wrote to memory of 2028	372	x5656301.exe	97
PID 372 wrote to memory of 2028	372	x5656301.exe	97
PID 372 wrote to memory of 2028	372	x5656301.exe	97
PID 2028 wrote to memory of 1680	2028	x9892298.exe	98
PID 2028 wrote to memory of 1680	2028	x9892298.exe	98
PID 2028 wrote to memory of 1680	2028	x9892298.exe	98
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 1680 wrote to memory of 556	1680	g4304859.exe	100
PID 2028 wrote to memory of 1648	2028	x9892298.exe	101
PID 2028 wrote to memory of 1648	2028	x9892298.exe	101
PID 2028 wrote to memory of 1648	2028	x9892298.exe	101

C:\Users\Admin\AppData\Local\Temp\3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe
"C:\Users\Admin\AppData\Local\Temp\3838e687ca12340cbb5fce2b4dabe55c60480b8f549a53ab5280808d28bb1454.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5656301.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5656301.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9892298.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9892298.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4304859.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4304859.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1680
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0209610.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0209610.exe
        5⤵
        Executes dropped EXE
        
        PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5656301.exe

Filesize
472KB

MD5
0ec825fb56036ca82cbdfc672169e85b

SHA1
1f2ae2473e06d17633b3f02cd8603cef3f7a7be6

SHA256
e6aa22a49140ba1befbad998a16d89038cdb104f580052fc64cb6a323c2ba52a

SHA512
b3768adbd18b1604566459d3346b4d60368bce84c225b9f124df060b26444a681b249e5d753201f2bf176c6b49c3802a3003c2693147bdecb050df22cc80d279

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5656301.exe

Filesize
472KB

MD5
0ec825fb56036ca82cbdfc672169e85b

SHA1
1f2ae2473e06d17633b3f02cd8603cef3f7a7be6

SHA256
e6aa22a49140ba1befbad998a16d89038cdb104f580052fc64cb6a323c2ba52a

SHA512
b3768adbd18b1604566459d3346b4d60368bce84c225b9f124df060b26444a681b249e5d753201f2bf176c6b49c3802a3003c2693147bdecb050df22cc80d279

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9892298.exe

Filesize
306KB

MD5
b76fadacdfdffce0f41e3fd1494229ae

SHA1
1b845988eadc20a9008ad9cbea15cd8d9272bcf4

SHA256
c16891989a7e672093005ca84b0da3284f87f341da43cf381618afcc5a6eda9a

SHA512
80c12eb66f3150bdff127f2b478e35790a797086d4ca1fdca3e6c11f8753cb0f7b73acb04c9f74bb428ffcf5b9f085dbfe6b4778e442ee9b2254da2541fa3ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9892298.exe

Filesize
306KB

MD5
b76fadacdfdffce0f41e3fd1494229ae

SHA1
1b845988eadc20a9008ad9cbea15cd8d9272bcf4

SHA256
c16891989a7e672093005ca84b0da3284f87f341da43cf381618afcc5a6eda9a

SHA512
80c12eb66f3150bdff127f2b478e35790a797086d4ca1fdca3e6c11f8753cb0f7b73acb04c9f74bb428ffcf5b9f085dbfe6b4778e442ee9b2254da2541fa3ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4304859.exe

Filesize
213KB

MD5
67f23b2b46feed3830fb82884eb6c660

SHA1
8ebd250d25c83c4d39bdb918074282c0470b55f1

SHA256
a921eca64190dc5ea754c147059bd043585ef5b7108995b5e29dd2309084a34b

SHA512
2e3f186f3cd31e9d6725d916b1a2a3e152fa884f26ab589d7ab544b1f0f5080854aa3348814a866cb800b25c3eeee5156ec313d4bbb693284fa8cb7690272b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4304859.exe

Filesize
213KB

MD5
67f23b2b46feed3830fb82884eb6c660

SHA1
8ebd250d25c83c4d39bdb918074282c0470b55f1

SHA256
a921eca64190dc5ea754c147059bd043585ef5b7108995b5e29dd2309084a34b

SHA512
2e3f186f3cd31e9d6725d916b1a2a3e152fa884f26ab589d7ab544b1f0f5080854aa3348814a866cb800b25c3eeee5156ec313d4bbb693284fa8cb7690272b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0209610.exe

Filesize
174KB

MD5
286c6bd722b92b7b596a54155d8f1509

SHA1
0dbc3a75118847926a414e7f361859ce97d5294d

SHA256
e1799539d399ee0d594955ccbcf6d23c2fc0d82b6cf403ad14b2a02087690b45

SHA512
054992262c112d20b3ef8c176ec2cf15ca3f06e5f5d0c757d247f5ca180b4e891f2095c77f05a3a18875631a1d060bff5b1b89023672678221b7060132b40936

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0209610.exe

Filesize
174KB

MD5
286c6bd722b92b7b596a54155d8f1509

SHA1
0dbc3a75118847926a414e7f361859ce97d5294d

SHA256
e1799539d399ee0d594955ccbcf6d23c2fc0d82b6cf403ad14b2a02087690b45

SHA512
054992262c112d20b3ef8c176ec2cf15ca3f06e5f5d0c757d247f5ca180b4e891f2095c77f05a3a18875631a1d060bff5b1b89023672678221b7060132b40936

Download Submit
memory/556-30-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/556-40-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/556-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/556-44-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-33-0x0000000005C40000-0x0000000006258000-memory.dmp

Filesize
6.1MB

Download
memory/1648-35-0x00000000055C0000-0x00000000055D2000-memory.dmp

Filesize
72KB

Download
memory/1648-42-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/1648-31-0x0000000005560000-0x0000000005566000-memory.dmp

Filesize
24KB

Download
memory/1648-32-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-41-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-34-0x0000000005730000-0x000000000583A000-memory.dmp

Filesize
1.0MB

Download
memory/1648-29-0x0000000000C40000-0x0000000000C70000-memory.dmp

Filesize
192KB

Download
memory/1648-36-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/1648-37-0x0000000005660000-0x000000000569C000-memory.dmp

Filesize
240KB

Download
memory/1648-38-0x00000000056A0000-0x00000000056EC000-memory.dmp

Filesize
304KB

Download
memory/1760-39-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1760-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1760-3-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1760-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1760-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download