healer | 82d1eca76037f568efb55ba04db39dbaad07d12a6fe618a601317562ac1dbdfe

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe
Size

389KB
MD5

8a93f2fead052a76fbae72166ac8fb12
SHA1

d3717ab4c59cc8ede584e2ce79bc768d62a03dc3
SHA256

bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2
SHA512

cade714bb097b4e24cf985f5156bf55ac4e3390c812055e4e5f10c118e4b2e40d9b449e8b2f236ca9b3095382f884e7f49ce17779362f1cb7a44255c7839711a
SSDEEP

6144:KZy+bnr+wp0yN90QE/Yd+B4GwMEbYWOYNdGGxPYuQX/ceXe:fMrIy90TFIYPixAuocj

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral12/files/0x000800000002325a-12.dat	healer
behavioral12/memory/2484-15-0x00000000008F0000-0x00000000008FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p0739731.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p0739731.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x000700000002325b-18.dat	family_redline
behavioral12/memory/1296-20-0x0000000000310000-0x0000000000340000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
4960	z4360316.exe
2484	p0739731.exe
1296	r8147143.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p0739731.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4360316.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	p0739731.exe
2484	p0739731.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	p0739731.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4960	1904	bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe	90
PID 1904 wrote to memory of 4960	1904	bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe	90
PID 1904 wrote to memory of 4960	1904	bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe	90
PID 4960 wrote to memory of 2484	4960	z4360316.exe	91
PID 4960 wrote to memory of 2484	4960	z4360316.exe	91
PID 4960 wrote to memory of 1296	4960	z4360316.exe	92
PID 4960 wrote to memory of 1296	4960	z4360316.exe	92
PID 4960 wrote to memory of 1296	4960	z4360316.exe	92

C:\Users\Admin\AppData\Local\Temp\bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe
"C:\Users\Admin\AppData\Local\Temp\bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe
    3⤵
    - Executes dropped EXE
    PID:1296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4360316.exe

Filesize
206KB

MD5
e6b4ba6f5d76a4719f406cd3aca3b9a7

SHA1
77a6d0a2e77a71534c848a111573f6af326ce5dc

SHA256
96356b86475b7fbf7dce2734b64e0ed95cba6b5a7be0efcb71bf469965457adb

SHA512
ae8b1d3801243dc81ad6288cc449d90ced08d8a34039a8fd07b09557a6fd52213cb08b334f63e1dcdd0110de12dfc7d9ff24e2886bec6175927a385baf1d0486

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p0739731.exe

Filesize
14KB

MD5
84983a334ac089ec14cf05f1c0605bef

SHA1
6836067a70683845a7e773d1f28f1cb9e4138d15

SHA256
e4c23c0d96badfd1ea7612225bd61898a296a585b69230989ee61ecd87fcc57b

SHA512
0ea33bab35c21d5612219337945079d3cac74552c776e379bdbeac809538f600b5a2eb17a6877f7fd1956fad3cdea651fd0b9abde76c5be8a2c1fbc686225080

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r8147143.exe

Filesize
173KB

MD5
36fe0ab069c8ee215f9b18e10bb5a184

SHA1
42a3650d4fbda059640555bce0be87544556870d

SHA256
f492ece3bdadd718f42d07315e318b307757c406025d07bfaf56e619232eb9de

SHA512
a201e8d2a5fdd44f2aea01b9ba1ea51ae6c75c40979a912212bea270b223d2f686b271879a5cca2cab01fb3bdbc01d5719bdf4fe7691c878fc3dbd05b79ab06e

Download Submit
memory/1296-20-0x0000000000310000-0x0000000000340000-memory.dmp

Filesize
192KB

Download
memory/1296-21-0x0000000004B30000-0x0000000004B36000-memory.dmp

Filesize
24KB

Download
memory/1296-22-0x000000000A740000-0x000000000AD58000-memory.dmp

Filesize
6.1MB

Download
memory/1296-23-0x000000000A2C0000-0x000000000A3CA000-memory.dmp

Filesize
1.0MB

Download
memory/1296-24-0x0000000004B50000-0x0000000004B62000-memory.dmp

Filesize
72KB

Download
memory/1296-25-0x0000000004B70000-0x0000000004BAC000-memory.dmp

Filesize
240KB

Download
memory/1296-26-0x000000000A1E0000-0x000000000A22C000-memory.dmp

Filesize
304KB

Download
memory/2484-14-0x00007FFC3D7F3000-0x00007FFC3D7F5000-memory.dmp

Filesize
8KB

Download
memory/2484-15-0x00000000008F0000-0x00000000008FA000-memory.dmp

Filesize
40KB

Download