healer | f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe
Size

389KB
MD5

073f84f40946716ae47ea59af7fc3979
SHA1

f39ce1dd5b30a263986c6831bc7bf4b662b3ce5c
SHA256

4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675
SHA512

7a9758b20b794cac8a5a9e8dae5fb55f6cfb5b69e8ab5ab804088e67975436826746e5fe18473f56e4544bf148c35dc1a1029768bf3262e58372afbc7d9ca93a
SSDEEP

6144:KGy+bnr+xp0yN90QESFxnVkONlvhYZbG7qMh+hn0E3+YIu5ly4RChw/:yMrFy90wSONcbG75w3+YNly2Chw/

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4607821.exe	healer
behavioral11/memory/552-14-0x0000000000D10000-0x0000000000D1A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p4607821.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p4607821.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p4607821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p4607821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p4607821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p4607821.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p4607821.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1698980.exe	family_redline
behavioral11/memory/3236-20-0x0000000000C00000-0x0000000000C30000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

z0401173.exep4607821.exer1698980.exe

pid process

4292 z0401173.exe
552 p4607821.exe
3236 r1698980.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p4607821.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p4607821.exe

pid	process
4292	z0401173.exe
552	p4607821.exe
3236	r1698980.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p4607821.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exez0401173.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0401173.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p4607821.exe

pid process

552 p4607821.exe
552 p4607821.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p4607821.exe

description pid process

Token: SeDebugPrivilege 552 p4607821.exe

pid	process
552	p4607821.exe
552	p4607821.exe

description	pid	process
Token: SeDebugPrivilege	552	p4607821.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exez0401173.exe

description	pid	process	target process
PID 1588 wrote to memory of 4292	1588	4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe	z0401173.exe
PID 1588 wrote to memory of 4292	1588	4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe	z0401173.exe
PID 1588 wrote to memory of 4292	1588	4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe	z0401173.exe
PID 4292 wrote to memory of 552	4292	z0401173.exe	p4607821.exe
PID 4292 wrote to memory of 552	4292	z0401173.exe	p4607821.exe
PID 4292 wrote to memory of 3236	4292	z0401173.exe	r1698980.exe
PID 4292 wrote to memory of 3236	4292	z0401173.exe	r1698980.exe
PID 4292 wrote to memory of 3236	4292	z0401173.exe	r1698980.exe

C:\Users\Admin\AppData\Local\Temp\4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe
"C:\Users\Admin\AppData\Local\Temp\4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0401173.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0401173.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4607821.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4607821.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1698980.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1698980.exe
    3⤵
    - Executes dropped EXE
    PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0401173.exe

Filesize
206KB

MD5
4e23e3ed92f482907c31141926908a4f

SHA1
6a090640bedf02b74bb7dad0b75c380d444f73fc

SHA256
239a61d49eb6b626bd249926a1a3225d6005efe83cfbf21091cd381af22172d7

SHA512
273e0ad97c40f1f70375251e66ce7f33bf54ae6dc068fdb3156925f59433009a16835ea1e528ab1422c26952b3835f62aff4ef267749978ad0e7725133920e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4607821.exe

Filesize
14KB

MD5
24680878da0cdb572f04dee724eb6374

SHA1
e541d64aadaa8bbc00544fe62476886e15ffbe48

SHA256
1ec13c26ada790637e7432690f135d84911e69be30fffbc673c0e63e2c7d1c3f

SHA512
9196bb471e2a2eac844320afc95198af35c06d7c87dfd39779c69f1856fcec452c30dd61b1117eef825566cfee1e6f2b0962fed07fae269cd502263b008b5779

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1698980.exe

Filesize
173KB

MD5
42d0dd8ee8b60ffcca10b682dccea2a2

SHA1
d6069d38777c71e088d5addc73f6cce3a4bc8bd6

SHA256
b0df05a1010f5da959d2539eb1014155e1859164aac2df73acd63a4990c97be4

SHA512
ef304513350ff736d53cbfd87973cacdfe7251edc94cf57f75bfcfa3bc73f63116cc8bd931e25fe9f75718f344667c8a36706bd0c179e0678423a9c50842aa92

Download Submit
memory/552-14-0x0000000000D10000-0x0000000000D1A000-memory.dmp

Filesize
40KB

Download
memory/552-15-0x00007FF8E84A3000-0x00007FF8E84A5000-memory.dmp

Filesize
8KB

Download
memory/3236-20-0x0000000000C00000-0x0000000000C30000-memory.dmp

Filesize
192KB

Download
memory/3236-21-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

Filesize
24KB

Download
memory/3236-22-0x000000000B040000-0x000000000B658000-memory.dmp

Filesize
6.1MB

Download
memory/3236-23-0x000000000ABB0000-0x000000000ACBA000-memory.dmp

Filesize
1.0MB

Download
memory/3236-24-0x000000000AAF0000-0x000000000AB02000-memory.dmp

Filesize
72KB

Download
memory/3236-25-0x000000000AB50000-0x000000000AB8C000-memory.dmp

Filesize
240KB

Download
memory/3236-26-0x0000000004F50000-0x0000000004F9C000-memory.dmp

Filesize
304KB

Download