healer | 82d1eca76037f568efb55ba04db39dbaad07d12a6fe618a601317562ac1dbdfe

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe
Size

922KB
MD5

891f1dc06713b9c0c010f03349cc76bb
SHA1

b9898973e542acf5172b5fcb94f52111036cfc52
SHA256

a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119
SHA512

bb1495af08880fb6f402d0bc13582ff0d7cda5010127db0c01ad01ef4e018deb273924acc319e917f41666853233e456a2243db6c9ebb3041fb8c4d052b7c234
SSDEEP

12288:6Mr7y90xRF1KUynJmZMQ/uYVj62Y75r7qtDA75J6aBOoJe0vPd0NOs2g:pyYXaJmZMQGY62YiuJBBOoJe0vPkug

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral10/memory/1292-28-0x0000000000740000-0x000000000077E000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6051821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6051821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6051821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6051821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6051821.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6051821.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral10/memory/3528-35-0x0000000001FE0000-0x000000000206C000-memory.dmp	family_redline
behavioral10/memory/3528-42-0x0000000001FE0000-0x000000000206C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
3416	y2471486.exe
3516	y4922384.exe
1292	k6051821.exe
3528	l8809867.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6051821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6051821.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2471486.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4922384.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1292	k6051821.exe
1292	k6051821.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	k6051821.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3416	1800	a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe	83
PID 1800 wrote to memory of 3416	1800	a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe	83
PID 1800 wrote to memory of 3416	1800	a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe	83
PID 3416 wrote to memory of 3516	3416	y2471486.exe	85
PID 3416 wrote to memory of 3516	3416	y2471486.exe	85
PID 3416 wrote to memory of 3516	3416	y2471486.exe	85
PID 3516 wrote to memory of 1292	3516	y4922384.exe	87
PID 3516 wrote to memory of 1292	3516	y4922384.exe	87
PID 3516 wrote to memory of 1292	3516	y4922384.exe	87
PID 3516 wrote to memory of 3528	3516	y4922384.exe	92
PID 3516 wrote to memory of 3528	3516	y4922384.exe	92
PID 3516 wrote to memory of 3528	3516	y4922384.exe	92

C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe
"C:\Users\Admin\AppData\Local\Temp\a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe
      4⤵
      Executes dropped EXE
      PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2471486.exe

Filesize
767KB

MD5
e5497322f71d635495045cbd61c55b63

SHA1
b1b81f4f470bf4511ac047a3a7fd1029e11775e2

SHA256
d818e38a5f67f74b3830741e825c99bc5af0417574efa86effe15e1a52a5b83a

SHA512
43a4b3f02b6aa72b8c6a3ecb7d831cf321384513573532ce36ecb79acb96b5644019969f823c924daf23f5a9bf6a0b942c6aebeaa529897e0752f3f85f85bb27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4922384.exe

Filesize
583KB

MD5
e3aeed7464a15a54b799c7f7cd1351ad

SHA1
e29bf1925284d025253a83ebcf3f43c8eebaef4c

SHA256
77fd1e8025ac167ebffd85262eea82987650aaf13577cc00c1277fa7a52bd865

SHA512
d65d02e128aa275a01df2a33558b92eb3a9b27a7a2a34b19595f77b62c121d31db0277352d4eea410ef23c49cf837e974d947cece22b73055c67f31bb38459a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6051821.exe

Filesize
295KB

MD5
b233dad928a40509fbd052dc86b3f1d3

SHA1
f33b9970e592903e573c0e8c6c9cf716b197aa11

SHA256
96f5b677852225d7a74cc500300101087cf7ce143bc7eab75952142ecb52f2ad

SHA512
ec01e18789a2aee6fa2ad98fc8567ac27af69e2db8706ec8780793460363a1e1d76ce0351aa90a586c9e9b10146bca7281959b05154abf72f02bf9ad9f59244e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8809867.exe

Filesize
492KB

MD5
e52911bc1933eb3cac93d97fd9cd9634

SHA1
ddd957a746281b351e4b4172762730ada4b3e5d2

SHA256
eec7e6ff5212af652abd5afd062000557f211d334bd7f184617dd65cab4982ac

SHA512
f643fdf1d5b60ddd79b948d25639966a7b5c3e97779021f7979db10628f2935bcdfadcbe6b5927a13552ca4ac49ff6c710c6785bbad65c3672b5e7df162e8187

Download Submit
memory/1292-22-0x0000000000740000-0x000000000077E000-memory.dmp

Filesize
248KB

Download
memory/1292-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1292-28-0x0000000000740000-0x000000000077E000-memory.dmp

Filesize
248KB

Download
memory/1292-29-0x0000000004460000-0x0000000004461000-memory.dmp

Filesize
4KB

Download
memory/3528-35-0x0000000001FE0000-0x000000000206C000-memory.dmp

Filesize
560KB

Download
memory/3528-42-0x0000000001FE0000-0x000000000206C000-memory.dmp

Filesize
560KB

Download
memory/3528-44-0x00000000023C0000-0x00000000023C6000-memory.dmp

Filesize
24KB

Download
memory/3528-45-0x000000000A500000-0x000000000AB18000-memory.dmp

Filesize
6.1MB

Download
memory/3528-46-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

Filesize
1.0MB

Download
memory/3528-47-0x0000000006A70000-0x0000000006A82000-memory.dmp

Filesize
72KB

Download
memory/3528-48-0x0000000006A90000-0x0000000006ACC000-memory.dmp

Filesize
240KB

Download
memory/3528-49-0x0000000009FF0000-0x000000000A03C000-memory.dmp

Filesize
304KB

Download