healer | dc3a1c0a9e91f9db2fff71c534b9b0e94067f24c7823bdabecfbdb495e4fe76a

Analysis

max time kernel
126s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe
Size

1.5MB
MD5

32d48c8cdbfd96746a7f1c55f20a4947
SHA1

7c8dc77a635685a78606165716662958487c72a3
SHA256

e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71
SHA512

e5ac29b64ac187f5cffc8a4a96fe617b138f847076a3bcd35a4c68eab59f103a0fdba0fca685592270942c08c2e7785521fe416bce4057f748ffcce89159c19d
SSDEEP

24576:7yPZKhpcvJxHm4U5sa6uyHWkAN+dX0xecCgTOffPGzedaNycCe0XM7fl1h6MlzY:uyGvJxG4Cc7J7gqffP/tcCtXmflnP

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral10/memory/224-28-0x00000000004F0000-0x00000000004FA000-memory.dmp	healer
behavioral10/files/0x0007000000023425-35.dat	healer
behavioral10/memory/4400-37-0x0000000000870000-0x000000000087A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b0686319.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b0686319.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6801018.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6801018.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6801018.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b0686319.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b0686319.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b0686319.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6801018.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6801018.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6801018.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b0686319.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral10/memory/2720-42-0x0000000000510000-0x0000000000540000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
2644	v0520560.exe
1476	v0565861.exe
1516	v0689812.exe
224	a6801018.exe
4400	b0686319.exe
2720	c7618530.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6801018.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6801018.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b0686319.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0520560.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0565861.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v0689812.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
224	a6801018.exe
224	a6801018.exe
4400	b0686319.exe
4400	b0686319.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	a6801018.exe
Token: SeDebugPrivilege	4400	b0686319.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2644	4228	e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe	84
PID 4228 wrote to memory of 2644	4228	e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe	84
PID 4228 wrote to memory of 2644	4228	e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe	84
PID 2644 wrote to memory of 1476	2644	v0520560.exe	85
PID 2644 wrote to memory of 1476	2644	v0520560.exe	85
PID 2644 wrote to memory of 1476	2644	v0520560.exe	85
PID 1476 wrote to memory of 1516	1476	v0565861.exe	86
PID 1476 wrote to memory of 1516	1476	v0565861.exe	86
PID 1476 wrote to memory of 1516	1476	v0565861.exe	86
PID 1516 wrote to memory of 224	1516	v0689812.exe	87
PID 1516 wrote to memory of 224	1516	v0689812.exe	87
PID 1516 wrote to memory of 224	1516	v0689812.exe	87
PID 1516 wrote to memory of 4400	1516	v0689812.exe	89
PID 1516 wrote to memory of 4400	1516	v0689812.exe	89
PID 1476 wrote to memory of 2720	1476	v0565861.exe	90
PID 1476 wrote to memory of 2720	1476	v0565861.exe	90
PID 1476 wrote to memory of 2720	1476	v0565861.exe	90

C:\Users\Admin\AppData\Local\Temp\e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe
"C:\Users\Admin\AppData\Local\Temp\e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0520560.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0520560.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0565861.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0565861.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0689812.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0689812.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6801018.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6801018.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0686319.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0686319.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7618530.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7618530.exe
      4⤵
      Executes dropped EXE
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0520560.exe

Filesize
1.3MB

MD5
5a006d527dde72f0bc51a3fdee4b1cdd

SHA1
cf0962f8ee0635e59e92221584a875e45a047480

SHA256
0c06bebf8e11d8d2467f90c5b26a5d24797cf65590877d5e30e804d07792187c

SHA512
89dc2c221b39c8b72e420e5f547b04a5e58a6102f6afe75acd7607897bb99fb9451d53bee131fa1cffa128defc07d58ef39b256a0779dbeec082ed90468fa40c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0565861.exe

Filesize
1.2MB

MD5
2d2f98038a94c1b5a27dabb43516b481

SHA1
c38e7390d73496ee51ebcd6d2c998efde21d196b

SHA256
e7b28986d5e5ddba7a489d10bb1cd93e41add21f3e8e0b472f885b5d393d112f

SHA512
40da19e60229855024459fe45c2f0c645ed7bc208af82478948a5f2474d25f039e958ce8437cf10f66e17685c7976b1e2d64a5e8e2c5a8fec3150ae828ce8ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7618530.exe

Filesize
692KB

MD5
8c07c258604ef2c6253686dc2ebe6937

SHA1
b91099c9103265611e877f398dccfa6edaaefd25

SHA256
b59ecca695cc3aac7d02df5329cadec0168779df455dce2bb69711c06aae6389

SHA512
367d8bfb15eb92ffd750649e75abc2976d8ed3a82c050f053c3622daa57e9a70e312caab2bd63e464ca0878d75928cbaf39406d4d3a05d06e7ec057dd227f2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0689812.exe

Filesize
621KB

MD5
9c8172d995e82f94df848aa37a96bb73

SHA1
2e5ccafda1f76202b5c90c8a52ea12042b0e1565

SHA256
85399056e1683ef7185f77951310e5f7eba10a2df94382523ad09c479950b3f0

SHA512
7bb100316a12017d934dc3cb1bbbbc3e5d0171775da4d8c2f79e14f265fc5f153c68f16aef5160b20626a0e6a0d0cb9bcc3f5591378ba2d9d9b24fb0a064eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6801018.exe

Filesize
530KB

MD5
231fa67dcb2a7c6190da502d02a7ae9f

SHA1
1d2ba9ec8de8d4a8dde062739313e126c7fd756a

SHA256
369898f70baee653a53774650f75ff74ed4c0ce7ec690de9511e3e7b6f1e43ae

SHA512
b3253446c2ce9af7123c67ac54ae3f7f4202ad8ea32885bac3e0b60089a05b1f2066e57a1216496f79de415d4ba8a606243d030fda741e44b41c24295bf9b00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0686319.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/224-28-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/2720-42-0x0000000000510000-0x0000000000540000-memory.dmp

Filesize
192KB

Download
memory/2720-47-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2720-48-0x0000000004BF0000-0x0000000005208000-memory.dmp

Filesize
6.1MB

Download
memory/2720-49-0x0000000005220000-0x000000000532A000-memory.dmp

Filesize
1.0MB

Download
memory/2720-50-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2720-51-0x0000000005380000-0x00000000053BC000-memory.dmp

Filesize
240KB

Download
memory/2720-52-0x0000000005420000-0x000000000546C000-memory.dmp

Filesize
304KB

Download
memory/4400-37-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download