healer | b0775c8fcdd8ebb0123f9b03757952498595475777fac3bbde3e90ed10d13558

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe
Size

921KB
MD5

1beb0795600816557ce325b1c1b59324
SHA1

acd5093044581410d96d772542ffdc6894a135d6
SHA256

41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404
SHA512

0b3f9aa94ef91c59bf2247bddb2c481a4cf5bc5bc51a27c48d7ba016027f9b653ee92f77a3575e60061db0201b334e11cfef11e942ebf984dfc6cb7d68545958
SSDEEP

24576:Jyp6CnbbnjhaWAaqWc5YbDUAmuHVunxx:8P8faql54Dl3V

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral6/memory/3620-28-0x00000000005B0000-0x00000000005EE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k7883988.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k7883988.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k7883988.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k7883988.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k7883988.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k7883988.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral6/memory/3492-35-0x0000000001FF0000-0x000000000207C000-memory.dmp	family_redline
behavioral6/memory/3492-42-0x0000000001FF0000-0x000000000207C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1524	y5659372.exe
1232	y6482541.exe
3620	k7883988.exe
3492	l9973435.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k7883988.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k7883988.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5659372.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y6482541.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3620	k7883988.exe
3620	k7883988.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	k7883988.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1524	3608	41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe	85
PID 3608 wrote to memory of 1524	3608	41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe	85
PID 3608 wrote to memory of 1524	3608	41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe	85
PID 1524 wrote to memory of 1232	1524	y5659372.exe	86
PID 1524 wrote to memory of 1232	1524	y5659372.exe	86
PID 1524 wrote to memory of 1232	1524	y5659372.exe	86
PID 1232 wrote to memory of 3620	1232	y6482541.exe	87
PID 1232 wrote to memory of 3620	1232	y6482541.exe	87
PID 1232 wrote to memory of 3620	1232	y6482541.exe	87
PID 1232 wrote to memory of 3492	1232	y6482541.exe	98
PID 1232 wrote to memory of 3492	1232	y6482541.exe	98
PID 1232 wrote to memory of 3492	1232	y6482541.exe	98

C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe
"C:\Users\Admin\AppData\Local\Temp\41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe
      4⤵
      Executes dropped EXE
      PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5659372.exe

Filesize
765KB

MD5
95e4a8f41bca6bb2d6a28fefff8a6f14

SHA1
5e8cc68b5720ee13aeb6419a1fa41bc09b99ec3d

SHA256
bb6484b52078d8b2107fd568f7d0c871021ac1c82ec70d295e602e8f50bcb7c8

SHA512
e390a6d632aad87666985827761e4c69ac39899845e1f6abb13cda37d1ec1fa8a4ffa0992d885e5415a372a4c5f7755d61ec5122aee4724d9161301041c8ea51

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6482541.exe

Filesize
582KB

MD5
ae7dcaf31955b10f6ecba5f649dd83e2

SHA1
38a7be9d4965aa1866db417951a2a5217f0ebe92

SHA256
b8e5590b23a408b05b4bfe00e5eb1c7b8b657f1e9ab6565c6a6d30147ab4f5cb

SHA512
d7d6aacde25996ddbd08df92f8e1306ea24abfeb290e985303e7009b889337c2aa2f1080cca2366627feb10de24c903b8cc5db35d2c181fb3837a308072c82bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7883988.exe

Filesize
294KB

MD5
dd329a91731d29291b0e49aac30b1ade

SHA1
2e11d485b3a6752b765f9ca9a230b9f611e96579

SHA256
6e283bcf7c2fcb9c137ccc493a52dfe1299bb1879c5bd53fed57d015b23724b8

SHA512
833ce95679282a3d51dc2d99ae7044ee9db27b0dde6741db74fdd8b8982da303d8ca58c733aff6397fb788067513040a7157227ff2749833bf18f40e7d36e2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9973435.exe

Filesize
492KB

MD5
1e8e5d3012e149936d72e9d2d0ca74d7

SHA1
bef43c6355793a6a89d9904dd3ffef9515975d2f

SHA256
baed1016d2a42a5e79500e392455218b03840fcfc6b4117ac07cf7580a98b2dd

SHA512
93ae2c02a62d985386537943088f252beb26231d7567813695c9664f841a506877329a32b0cd7063327dc22f02348b2192b74760b325f64cb413ab4d9e34aa63

Download Submit
memory/3492-45-0x00000000080A0000-0x00000000086B8000-memory.dmp

Filesize
6.1MB

Download
memory/3492-35-0x0000000001FF0000-0x000000000207C000-memory.dmp

Filesize
560KB

Download
memory/3492-42-0x0000000001FF0000-0x000000000207C000-memory.dmp

Filesize
560KB

Download
memory/3492-44-0x00000000023D0000-0x00000000023D6000-memory.dmp

Filesize
24KB

Download
memory/3492-46-0x00000000086C0000-0x00000000087CA000-memory.dmp

Filesize
1.0MB

Download
memory/3492-47-0x00000000087F0000-0x0000000008802000-memory.dmp

Filesize
72KB

Download
memory/3492-48-0x0000000008810000-0x000000000884C000-memory.dmp

Filesize
240KB

Download
memory/3492-49-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download
memory/3620-29-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/3620-28-0x00000000005B0000-0x00000000005EE000-memory.dmp

Filesize
248KB

Download
memory/3620-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3620-21-0x00000000005B0000-0x00000000005EE000-memory.dmp

Filesize
248KB

Download