healer | 5917339910bda68a91f92247578c308113ee6fce121896237213a864c446fcd8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe
Size

921KB
MD5

44cbb98318d10e181dbecfc6c7930c92
SHA1

8b8dbb3697aa7d64447e563c66fa3e7ff4b7984f
SHA256

30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4
SHA512

291b45439409caba17d76e554f9b10764a1249799832c1aac668e74edd303830a306a1c47a8875b6e03e840b2cda9784febabfac2cab523898c554d197c45a15
SSDEEP

24576:ny81+rfI0+ZZypDGLOnY6n3yUkcm4ifIPIik:yg+rfI3ypD35niUs4PIi

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral7/memory/2972-28-0x00000000005A0000-0x00000000005DE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k5169616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5169616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5169616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5169616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5169616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5169616.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/memory/3756-35-0x0000000000720000-0x00000000007AC000-memory.dmp	family_redline
behavioral7/memory/3756-42-0x0000000000720000-0x00000000007AC000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1836	y5305162.exe
3356	y1617966.exe
2972	k5169616.exe
3756	l6331740.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k5169616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5169616.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5305162.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y1617966.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	k5169616.exe
2972	k5169616.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	k5169616.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1836	2888	30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe	83
PID 2888 wrote to memory of 1836	2888	30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe	83
PID 2888 wrote to memory of 1836	2888	30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe	83
PID 1836 wrote to memory of 3356	1836	y5305162.exe	85
PID 1836 wrote to memory of 3356	1836	y5305162.exe	85
PID 1836 wrote to memory of 3356	1836	y5305162.exe	85
PID 3356 wrote to memory of 2972	3356	y1617966.exe	86
PID 3356 wrote to memory of 2972	3356	y1617966.exe	86
PID 3356 wrote to memory of 2972	3356	y1617966.exe	86
PID 3356 wrote to memory of 3756	3356	y1617966.exe	90
PID 3356 wrote to memory of 3756	3356	y1617966.exe	90
PID 3356 wrote to memory of 3756	3356	y1617966.exe	90

C:\Users\Admin\AppData\Local\Temp\30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe
"C:\Users\Admin\AppData\Local\Temp\30fb90dbd15d7cf28cd8c2c3ac256de3f63d31799b3d6452d6448ff5fc3a88b4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5305162.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5305162.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1617966.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1617966.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5169616.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5169616.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6331740.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6331740.exe
      4⤵
      Executes dropped EXE
      PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5305162.exe

Filesize
766KB

MD5
142b2563a130640853430901606b99af

SHA1
12ac772d03a0eb98dd34bd6aecd823a1cff00ca1

SHA256
f0b5555b9348081b0c8f3e4e61c16aafe0b8af10b2f6e02b4b090e4f45ffa20d

SHA512
876d8bf6c59edf1910b6994e288aa855e8df45519ef1199655ebb522675c6630ac92cbea721b81131315cb4294663908a3832ff551716c0ee1b8f11c22cf18dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1617966.exe

Filesize
582KB

MD5
8e7f899b8ab608038500e0c78a70115e

SHA1
a3e291f1dcbe51eacf6f8cdea24b9f7a0be812d6

SHA256
be3ab99dcc950d8bfb7d79f9e58f05759f4c3a71de593e3658e1efbe5eae0db8

SHA512
ce73151d53a857fc52e0cefb6de9c49ea76e3da110b2e7738649156bb1bd4eaa1e5ae3b16ecb616c6fa51a0d47957a3152b40912857c7c446ba5f70c95a3f707

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5169616.exe

Filesize
294KB

MD5
a90830ec8a9d52853a0ad94fe435522b

SHA1
cffc1af38e50ae1572ba08d281c158f8946feaf3

SHA256
bc481e30776d05343a46b4fb4b47f71091c18605e3ab797907d7629e1b0091f7

SHA512
dd15dc41f4667cc1ade3c37b8bbfb52d3ba8bfdcac782b203302bba6fcc8c373693ee9afaa257b71cdede3eef87e2edd705d5f387fbd8cd7a75b16f9d0c77de8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6331740.exe

Filesize
493KB

MD5
0ec5b6d7f5b4c71c52af2eeb8a41e197

SHA1
b908a2657af8267385fb7038a7e476792eeba7c1

SHA256
ab74ba8710093b55fae108b29b5b1dadff926dbe95682cb0cc9068f8e9330de0

SHA512
ce9d56698d41d09a4b582d54ccc8da11130670f3f0ba0e278970ab2254e509c0e79ead8ebff7ac3cf44c7e4fac2c9bc75b8c81609aeae0cb518aee8b3555ada9

Download Submit
memory/2972-21-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2972-22-0x00000000005A0000-0x00000000005DE000-memory.dmp

Filesize
248KB

Download
memory/2972-28-0x00000000005A0000-0x00000000005DE000-memory.dmp

Filesize
248KB

Download
memory/2972-29-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3756-35-0x0000000000720000-0x00000000007AC000-memory.dmp

Filesize
560KB

Download
memory/3756-42-0x0000000000720000-0x00000000007AC000-memory.dmp

Filesize
560KB

Download
memory/3756-44-0x00000000023F0000-0x00000000023F6000-memory.dmp

Filesize
24KB

Download
memory/3756-45-0x0000000005170000-0x0000000005788000-memory.dmp

Filesize
6.1MB

Download
memory/3756-46-0x0000000004BD0000-0x0000000004CDA000-memory.dmp

Filesize
1.0MB

Download
memory/3756-47-0x0000000004D00000-0x0000000004D12000-memory.dmp

Filesize
72KB

Download
memory/3756-48-0x0000000004D20000-0x0000000004D5C000-memory.dmp

Filesize
240KB

Download
memory/3756-49-0x0000000004D90000-0x0000000004DDC000-memory.dmp

Filesize
304KB

Download