healer | 45e94c10bbc148cc1f0e810ef4a64b3b2814960515bbe6c69d8570dde960e0b2

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe
Size

1.2MB
MD5

913372a73a1f952c41762a0ea1f91a37
SHA1

d02ec459307a0847637f788a5e2e33c732f42f31
SHA256

21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32
SHA512

733128ca43a63c485b28a8f2215b0b4848acfa0929692b588130adaa5cf2291b30bbb08232b85704ff5739ed87f43cf251a18882343a486e99eb9ab06856ef4b
SSDEEP

24576:yy82uVKaX0hGaGcr+Osx1QVB1ZyuItcIZ2v8i09g3K/03u:Z82qKu+9+fQVBOcIHx9F

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral4/memory/1172-41-0x0000000000690000-0x00000000006CE000-memory.dmp	healer
behavioral4/files/0x000700000002343c-46.dat	healer
behavioral4/memory/3288-48-0x0000000000350000-0x000000000035A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7096172.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b1349231.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b1349231.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a7096172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7096172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7096172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7096172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7096172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b1349231.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b1349231.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b1349231.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b1349231.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/memory/3036-53-0x0000000001FF0000-0x000000000207C000-memory.dmp	family_redline
behavioral4/memory/3036-60-0x0000000001FF0000-0x000000000207C000-memory.dmp	family_redline

Executes dropped EXE 7 IoCs

pid	Process
4796	v1186983.exe
1664	v2757613.exe
5020	v4922420.exe
2084	v5164567.exe
1172	a7096172.exe
3288	b1349231.exe
3036	c9378338.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a7096172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7096172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b1349231.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1186983.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2757613.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v4922420.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v5164567.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1172	a7096172.exe
1172	a7096172.exe
3288	b1349231.exe
3288	b1349231.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	a7096172.exe
Token: SeDebugPrivilege	3288	b1349231.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4796	3956	21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe	85
PID 3956 wrote to memory of 4796	3956	21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe	85
PID 3956 wrote to memory of 4796	3956	21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe	85
PID 4796 wrote to memory of 1664	4796	v1186983.exe	86
PID 4796 wrote to memory of 1664	4796	v1186983.exe	86
PID 4796 wrote to memory of 1664	4796	v1186983.exe	86
PID 1664 wrote to memory of 5020	1664	v2757613.exe	87
PID 1664 wrote to memory of 5020	1664	v2757613.exe	87
PID 1664 wrote to memory of 5020	1664	v2757613.exe	87
PID 5020 wrote to memory of 2084	5020	v4922420.exe	88
PID 5020 wrote to memory of 2084	5020	v4922420.exe	88
PID 5020 wrote to memory of 2084	5020	v4922420.exe	88
PID 2084 wrote to memory of 1172	2084	v5164567.exe	89
PID 2084 wrote to memory of 1172	2084	v5164567.exe	89
PID 2084 wrote to memory of 1172	2084	v5164567.exe	89
PID 2084 wrote to memory of 3288	2084	v5164567.exe	95
PID 2084 wrote to memory of 3288	2084	v5164567.exe	95
PID 5020 wrote to memory of 3036	5020	v4922420.exe	96
PID 5020 wrote to memory of 3036	5020	v4922420.exe	96
PID 5020 wrote to memory of 3036	5020	v4922420.exe	96

C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe
"C:\Users\Admin\AppData\Local\Temp\21feb39957e192116f1449fe8d8fdf2104aaaef3e4f6a5e516adc72ef63dbd32.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe
        5⤵
        Executes dropped EXE
        
        PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1186983.exe

Filesize
1.0MB

MD5
a958b8f529f8714ab8f649accc09d9f9

SHA1
8ec0f0c1dddaed3b89fdd493d43949bb35b6d19c

SHA256
3bccd82842a40854bdc9bfc3fd8dc5b93707f759c1938f2e0174165af52ba8b1

SHA512
b4346955ea9e979e59ca6857df7ccf52e5a60cec74ddeac38dfd2d604e74a7b82f61adee9453693697f5d97e434937f895776b39797c95aa7c47c2eaae8d99ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2757613.exe

Filesize
905KB

MD5
7fcac3187ef0a3ae980b457751d7ed0b

SHA1
b1e9d35b1d9164b28ed5f99398308f32a332dcaf

SHA256
afd1d16929b077f25b929310df449fd8772f653027596fa55ad4da17983df2ce

SHA512
46227177614ab96a48f3cf811d61a15eac2b58b7eade042f0f5e50544e21abfda13af520e3d19ad9b162d0a1e3e918a6240d1f88a657bda7c5b6654864380642

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4922420.exe

Filesize
722KB

MD5
e99aa1030c7a763e8bb5ddc13a871fc3

SHA1
63925d0f25f3dc55a0dad0397741001098712ff8

SHA256
7d9e8e6a8fbf325966e5cad26f6bc2daf9fcb9bb3ea399dfb48eaf0c0e5328e2

SHA512
1d650cfc66f4e028986dc4b0fc6d1e64ddc923656bb08a701a4cf4c9df994d8380cc57d36b6fda3635b0f9e9de4ff5a7ba9fd3fd7dd41643a0b20d83e5ccd0ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9378338.exe

Filesize
492KB

MD5
644fd9967279d0b37d985915fe87f280

SHA1
fd78c2dd18e32d4f9b35023c4fae6a8e60e2669a

SHA256
6b2f8a6639b2f6e13d4bab219c1513284203270411bccfafe0b323031133e3c4

SHA512
72cfeb5e13f35f3cbf538cf3b37478275e6aaed9169e8518e6bf68f8b873c1bf096d11a6a06f6c507722db29031a6b0de14bbf9dc705514bc7277f78749f7ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5164567.exe

Filesize
326KB

MD5
f001ba8d5cc9b4cdc2c6497b35d24389

SHA1
adf5afbe53307a4cbce6f61eb41a5f8b392bd1ba

SHA256
76a6001a778dd220a1bac72a373be37cffa37128e87f0ee2191af1ea0edd989b

SHA512
fcd79f323497c2ccbc1e25eeab1e739041c2fe0c0303e09cb9f37545db947415bdd3df81a8f249414a5fd6b731f1ce855fc3ee7fd3f4fd96827f698538b1233c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a7096172.exe

Filesize
295KB

MD5
fd699b4ed20dc242c93c08fd0e200e56

SHA1
8744ac80d4cba3be5c2a6df20895af9a7c3f204d

SHA256
276677627decf1682d9cb3545327eaaec22fe5e36fff15b57f1614b21022a092

SHA512
3b5e4a05286d12e7c9c8bfe587e80deacdd44c2b9832370eb45765623703335ef5cd216aaea0cd61bb5cbb55584dad0793faab3c1aa85cad644358238e28ab19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1349231.exe

Filesize
11KB

MD5
e14ac2d9095b9b27f28389369cc810f3

SHA1
d59499d0beae0be39746cc389ee2cd0d7b90672b

SHA256
a2f4bacc055531ada6d5fce84091eabde8bc920c5ac8b2f3026cb21948b6c915

SHA512
9de2f8665c58eb5c552d5cbce27c5a9748b591954e028d9029742cc68f55379490e0c379ff64508036be481fa45a6c91db20b803c38b0ab3588107b9003da17d

Download Submit
memory/1172-35-0x0000000000690000-0x00000000006CE000-memory.dmp

Filesize
248KB

Download
memory/1172-42-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1172-41-0x0000000000690000-0x00000000006CE000-memory.dmp

Filesize
248KB

Download
memory/3036-53-0x0000000001FF0000-0x000000000207C000-memory.dmp

Filesize
560KB

Download
memory/3036-60-0x0000000001FF0000-0x000000000207C000-memory.dmp

Filesize
560KB

Download
memory/3036-62-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/3036-63-0x0000000007390000-0x00000000079A8000-memory.dmp

Filesize
6.1MB

Download
memory/3036-64-0x0000000006D70000-0x0000000006E7A000-memory.dmp

Filesize
1.0MB

Download
memory/3036-65-0x0000000006CF0000-0x0000000006D02000-memory.dmp

Filesize
72KB

Download
memory/3036-66-0x0000000006D10000-0x0000000006D4C000-memory.dmp

Filesize
240KB

Download
memory/3036-67-0x0000000005A00000-0x0000000005A4C000-memory.dmp

Filesize
304KB

Download
memory/3288-48-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download