healer | bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe
Size

497KB
MD5

b86c688c83ea1a7fd4f3c0030ea16dd0
SHA1

f3f0c529bff95b9d8eab4b3b34255d056cac6952
SHA256

bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c
SHA512

a140ce40462f355d721543e02a44cc759c9ae095b6b2f002046633dfa9fdeb48373d0cf945049379f5bcfe3df5ae04e2acd1ed36d68f6a28db3c66713fe79a30
SSDEEP

12288:3MrZy90oLn5mW+xggEhkbXsbF8QqVUbx3KE:+yL5mRxgGzKynVex3B

Score

10^/10

healer redline stas dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

stas

77.91.124.82:19071

Attributes

auth_value
db6d96c4eade05afc28c31d9ad73a73c

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001469c-26.dat	healer
behavioral1/files/0x000a00000001469c-24.dat	healer
behavioral1/memory/2932-28-0x0000000001310000-0x000000000131A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7991102.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7991102.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
2084	v8044467.exe
2356	v3607374.exe
2932	a7991102.exe
2660	b4104776.exe
2656	c5027616.exe

Loads dropped DLL 9 IoCs

pid	Process
2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe
2084	v8044467.exe
2084	v8044467.exe
2356	v3607374.exe
2356	v3607374.exe
2356	v3607374.exe
2660	b4104776.exe
2084	v8044467.exe
2656	c5027616.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7991102.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8044467.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3607374.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2932	a7991102.exe
2932	a7991102.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	a7991102.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2084	2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe	19
PID 2888 wrote to memory of 2084	2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe	19
PID 2888 wrote to memory of 2084	2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe	19
PID 2888 wrote to memory of 2084	2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe	19
PID 2888 wrote to memory of 2084	2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe	19
PID 2888 wrote to memory of 2084	2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe	19
PID 2888 wrote to memory of 2084	2888	bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe	19
PID 2084 wrote to memory of 2356	2084	v8044467.exe	18
PID 2084 wrote to memory of 2356	2084	v8044467.exe	18
PID 2084 wrote to memory of 2356	2084	v8044467.exe	18
PID 2084 wrote to memory of 2356	2084	v8044467.exe	18
PID 2084 wrote to memory of 2356	2084	v8044467.exe	18
PID 2084 wrote to memory of 2356	2084	v8044467.exe	18
PID 2084 wrote to memory of 2356	2084	v8044467.exe	18
PID 2356 wrote to memory of 2932	2356	v3607374.exe	17
PID 2356 wrote to memory of 2932	2356	v3607374.exe	17
PID 2356 wrote to memory of 2932	2356	v3607374.exe	17
PID 2356 wrote to memory of 2932	2356	v3607374.exe	17
PID 2356 wrote to memory of 2932	2356	v3607374.exe	17
PID 2356 wrote to memory of 2932	2356	v3607374.exe	17
PID 2356 wrote to memory of 2932	2356	v3607374.exe	17
PID 2356 wrote to memory of 2660	2356	v3607374.exe	32
PID 2356 wrote to memory of 2660	2356	v3607374.exe	32
PID 2356 wrote to memory of 2660	2356	v3607374.exe	32
PID 2356 wrote to memory of 2660	2356	v3607374.exe	32
PID 2356 wrote to memory of 2660	2356	v3607374.exe	32
PID 2356 wrote to memory of 2660	2356	v3607374.exe	32
PID 2356 wrote to memory of 2660	2356	v3607374.exe	32
PID 2084 wrote to memory of 2656	2084	v8044467.exe	31
PID 2084 wrote to memory of 2656	2084	v8044467.exe	31
PID 2084 wrote to memory of 2656	2084	v8044467.exe	31
PID 2084 wrote to memory of 2656	2084	v8044467.exe	31
PID 2084 wrote to memory of 2656	2084	v8044467.exe	31
PID 2084 wrote to memory of 2656	2084	v8044467.exe	31
PID 2084 wrote to memory of 2656	2084	v8044467.exe	31

C:\Users\Admin\AppData\Local\Temp\bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe
"C:\Users\Admin\AppData\Local\Temp\bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2656

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe

Filesize
217KB

MD5
cb9e393499f6a2be165acb39d6cdd655

SHA1
646c1f3e3fb41a943d3b0d1f83f10b4b92f2148b

SHA256
1ee6b212fc0013dfcc99ff6db48b76f107205683f14bcfc903b5d3b399af7f8f

SHA512
3869ab9ea0ca0e498dbe085db9977b96e583445802de446d3271078eba48ffcb29d6dbd2adbac8ae6b1d0bc76c490fdf071b708bf4c4ed6bf64f5205f97e723b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe

Filesize
98KB

MD5
69fe72bc3e0e95cda3f86aac057d2805

SHA1
b515d27f0aaa3fd38e5b510b62c5d6c50e57234e

SHA256
1851a604e4d7aadd06d48540485709f1cef2ff936da366245ba510784b565a40

SHA512
52a01a2aad05d99044e59887cf85fb1c98a1fb5bf4100e26844bff9773a5b653aaab0b78a5f493974b6ccb285ee94121b23c0f2175fade0a6eda53e4079f1920

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe

Filesize
373KB

MD5
41b0ae85720b22815a78d8f306a6def9

SHA1
cb7397815748e01ba678568f60acc3fed3a31f23

SHA256
387d7ccbbd446c53df5e0f73642cf3f42e373c2f2c53c31541746e15531d584f

SHA512
0f54dbd3b8303aa5db209c2e8729a735e9685134731cc8c282d531101779dfe97d969d01544cd91409c36c5479c8c91b3cc15010f6cbf65eed0c343bdbbcbea5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe

Filesize
92KB

MD5
790db4e4ac95f8d4c5ee54182dd27ade

SHA1
a7c0ef83b3948122471e8e0851eda30d714393bb

SHA256
83bb3e6f65b24cb15f25fdacd182edd0419efd8822e2e1931f2ffeede48614f3

SHA512
a1c3d3dd209e2486227f60f3a722659c337657194f96a2dc2ccdd568465fb4411ae3c847e57f4d505b5a5895961a751626fac5ede6f9a1f302a7c2fa6361dc40

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe

Filesize
16KB

MD5
273287a944e3d95b524db8680d58beb4

SHA1
bbc13ee2bb7b9eb8c1d77d62f92387fb6879b9d8

SHA256
3136a980a76778a44d0df30706738c6b031cec3f581f46d10a94f42eb43beb64

SHA512
0677ac63ba8524bb9564da8dfc80c08b24f47f51161a5a56a236f85ad65670e3abd17d103a2bc278b5a0f36640552eb36298161597094f627e8d3c6cb02bbe23

Download Submit
memory/2656-43-0x0000000000B90000-0x0000000000BC0000-memory.dmp

Filesize
192KB

Download
memory/2656-44-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2932-28-0x0000000001310000-0x000000000131A000-memory.dmp

Filesize
40KB

Download
memory/2932-29-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download
memory/2932-30-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download