healer | f7dfaa9e79da582285f964c17f202631b50c186b56fbe2c417d1cb042b2ba655

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe
Size

389KB
MD5

047a5e67b8325b5f7f14d6300d2525fa
SHA1

e765cf5f8a5e1e80bad8f737cd658ffaea69ed78
SHA256

f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b
SHA512

da5583b2adff91294d280d78d4b3b598aab8b169e79bbc638f1042fcf44ab00b357c20b5b9dc7319482dba7632bd238653da8c0458af3b25a95a684ae46f57cd
SSDEEP

6144:KAy+bnr+Np0yN90QEQmynqq5AvfcQr4UliD4EYjxgt2jfsmdrHq/LDxMMJOkeb:UMrhy90WP64Ul84jSt2jfHrKjDxMMbM

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1980406.exe	healer
behavioral21/memory/3576-14-0x0000000000140000-0x000000000014A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p1980406.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p1980406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p1980406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p1980406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p1980406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p1980406.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p1980406.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3481787.exe	family_redline
behavioral21/memory/1896-20-0x0000000000F70000-0x0000000000FA0000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

z5687166.exep1980406.exer3481787.exe

pid process

2100 z5687166.exe
3576 p1980406.exe
1896 r3481787.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p1980406.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p1980406.exe

pid	process
2100	z5687166.exe
3576	p1980406.exe
1896	r3481787.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p1980406.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z5687166.exef5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5687166.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p1980406.exe

pid process

3576 p1980406.exe
3576 p1980406.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p1980406.exe

description pid process

Token: SeDebugPrivilege 3576 p1980406.exe

pid	process
3576	p1980406.exe
3576	p1980406.exe

description	pid	process
Token: SeDebugPrivilege	3576	p1980406.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exez5687166.exe

description	pid	process	target process
PID 1104 wrote to memory of 2100	1104	f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe	z5687166.exe
PID 1104 wrote to memory of 2100	1104	f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe	z5687166.exe
PID 1104 wrote to memory of 2100	1104	f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe	z5687166.exe
PID 2100 wrote to memory of 3576	2100	z5687166.exe	p1980406.exe
PID 2100 wrote to memory of 3576	2100	z5687166.exe	p1980406.exe
PID 2100 wrote to memory of 1896	2100	z5687166.exe	r3481787.exe
PID 2100 wrote to memory of 1896	2100	z5687166.exe	r3481787.exe
PID 2100 wrote to memory of 1896	2100	z5687166.exe	r3481787.exe

C:\Users\Admin\AppData\Local\Temp\f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe
"C:\Users\Admin\AppData\Local\Temp\f5c9c18ccaa6f832b0b5e79345b5442c799774303bf84ea96f45d3c21b2a1f6b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5687166.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5687166.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2100

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1980406.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1980406.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3481787.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3481787.exe
3⤵
- Executes dropped EXE
PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5687166.exe
Filesize
206KB

MD5
82508e684b0244b131384ad84bd736ed

SHA1
3c80d10f1bad612d93b99bfc4ab1407dba6c101d

SHA256
2f9713625553da98a31d2c7cc5fa0ba1aafe7e56045cc660ab24e00c0b7eca4d

SHA512
10b6232edc6c64acc7aab72a2c31bb8c8654bcc7c603b43321b9898a05d4abee803890b13951aadfc913e955781272485a7f74452c979fc576f4d6f20a179a8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1980406.exe
Filesize
14KB

MD5
acf71ede3fa4498bb7397d170fa7f878

SHA1
dd69c1172a9bf2f7d37b10a9fad59e1e1359c3ca

SHA256
a093e4e6d1e4d36ac0a4d04ed691dd962d5a6cc576395d79680eb7dc46650d09

SHA512
d7e45ef34b57273bf22af623e860fad167329dcb0d94feccda24d0d019b1bb7a8596162afefc6add472cf0fada895fcbb0febeb60e030006725ba9299ddc2355

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r3481787.exe
Filesize
173KB

MD5
bfb4ba8d200b626ae3d3a6d9ca32061b

SHA1
d95ffa9926a751678bf632a7ccc558e1e8bfd0c5

SHA256
9358dd428789b3d65d74482772d34eef690cad71a78453ded32673a5bebccf3f

SHA512
c63c0198c363675e50866d3ac051c051ce53b758f364e66a15749422ce6efb1e689e68cb7c5936f64b4e5550623a16ffedc8ee84e553c78571f9db7a712fe3fe

Download Submit
memory/1896-21-0x0000000001820000-0x0000000001826000-memory.dmp

Filesize
24KB

Download
memory/1896-20-0x0000000000F70000-0x0000000000FA0000-memory.dmp

Filesize
192KB

Download
memory/1896-24-0x000000000AD30000-0x000000000AD42000-memory.dmp

Filesize
72KB

Download
memory/1896-23-0x000000000AE40000-0x000000000AF4A000-memory.dmp

Filesize
1.0MB

Download
memory/1896-25-0x000000000AD90000-0x000000000ADCC000-memory.dmp

Filesize
240KB

Download
memory/1896-26-0x00000000032A0000-0x00000000032EC000-memory.dmp

Filesize
304KB

Download
memory/1896-22-0x000000000B350000-0x000000000B968000-memory.dmp

Filesize
6.1MB

Download
memory/3576-15-0x00007FFA58263000-0x00007FFA58265000-memory.dmp

Filesize
8KB

Download
memory/3576-14-0x0000000000140000-0x000000000014A000-memory.dmp

Filesize
40KB

Download