healer | 2a57fa0e264c30123d79d5a18397ff8ecfce4d9f58a5938c968ad3a9dd12e935

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe
Size

280KB
MD5

7df1e56d4c1a1612ee126463fcf8ceb4
SHA1

774ab26898cfa2ace41b0d5fa53538d318e0fa57
SHA256

a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0
SHA512

a84427f66c991496b014e82a1e52a969da9b627d6dfebdb93b74acdda4907df02b7b7d17b25cb732999e4a01e7f6e327be630b93b6dd6c55ed78e3d920ccae15
SSDEEP

6144:Kby+bnr+Qp0yN90QE7o6FzcJVDQvj6iftPO3pJ8M:JMrQy90xl9x2stgp+M

Score

10^/10

healer redline crazy dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

crazy

83.97.73.129:19068

Attributes

auth_value
66bc4d9682ea090eef64a299ece12fdd

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral18/memory/2340-23-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral18/memory/2748-8-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
4740	a9751033.exe
5104	b2585981.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4740 set thread context of 2748	4740	a9751033.exe	85
PID 5104 set thread context of 2340	5104	b2585981.exe	93

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2600	4740	WerFault.exe	82
908	5104	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2340	AppLaunch.exe
2340	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	AppLaunch.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 4740	512	a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe	82
PID 512 wrote to memory of 4740	512	a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe	82
PID 512 wrote to memory of 4740	512	a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe	82
PID 4740 wrote to memory of 2748	4740	a9751033.exe	85
PID 4740 wrote to memory of 2748	4740	a9751033.exe	85
PID 4740 wrote to memory of 2748	4740	a9751033.exe	85
PID 4740 wrote to memory of 2748	4740	a9751033.exe	85
PID 4740 wrote to memory of 2748	4740	a9751033.exe	85
PID 512 wrote to memory of 5104	512	a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe	91
PID 512 wrote to memory of 5104	512	a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe	91
PID 512 wrote to memory of 5104	512	a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe	91
PID 5104 wrote to memory of 2340	5104	b2585981.exe	93
PID 5104 wrote to memory of 2340	5104	b2585981.exe	93
PID 5104 wrote to memory of 2340	5104	b2585981.exe	93
PID 5104 wrote to memory of 2340	5104	b2585981.exe	93
PID 5104 wrote to memory of 2340	5104	b2585981.exe	93

C:\Users\Admin\AppData\Local\Temp\a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe
"C:\Users\Admin\AppData\Local\Temp\a62a548ffb1dcb9166d2336968bea9011a44039f391a1a7ef70364f4a0e131a0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:512
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a9751033.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a9751033.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 152
    3⤵
    - Program crash
    PID:2600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2585981.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2585981.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 152
    3⤵
    - Program crash
    PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4740 -ip 4740
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5104 -ip 5104
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a9751033.exe

Filesize
302KB

MD5
c0e3f771bcbb789d734e7d3e1b1f4e65

SHA1
02e6e5e508188955181ac98bb1b9c414d2c1aa9e

SHA256
53b6f1fa7f2466210d99ea5bba427014f08b5656339d05d1dc0d120b7c6a3b02

SHA512
c983b76772a50aece42107a39c828abfa768fc33c8865df73de57e1beca2919e8cc7b8afe1d5ae3e7556273519e311d5e49ed6d52eaf895c3c3d7c34608d2118

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b2585981.exe

Filesize
141KB

MD5
cd5a529d645436b72dc72ebc19950ef3

SHA1
5f571b5fce5b5e210e812e28dad02b80bb1f5d80

SHA256
887d08bb7735494fa22a46935055d0c2d612f70e97ecdd07bccf427d8e49efa3

SHA512
b314a9d61340e1cafd67aef45b5151721a6100ca0f7d6ec787e4fc4d83d1cdb571cfafcd1cc1cee681f3016bfb3fc8074681633607221711163e7da2c2e6b123

Download Submit
memory/2340-23-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2748-16-0x000000000A900000-0x000000000AA0A000-memory.dmp

Filesize
1.0MB

Download
memory/2748-14-0x0000000002BE0000-0x0000000002BE6000-memory.dmp

Filesize
24KB

Download
memory/2748-15-0x000000000AE10000-0x000000000B428000-memory.dmp

Filesize
6.1MB

Download
memory/2748-13-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

Filesize
4KB

Download
memory/2748-18-0x000000000A7F0000-0x000000000A802000-memory.dmp

Filesize
72KB

Download
memory/2748-8-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2748-20-0x000000000A850000-0x000000000A88C000-memory.dmp

Filesize
240KB

Download
memory/2748-21-0x0000000073F20000-0x00000000746D0000-memory.dmp

Filesize
7.7MB

Download
memory/2748-28-0x0000000004D50000-0x0000000004D9C000-memory.dmp

Filesize
304KB

Download
memory/2748-30-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

Filesize
4KB

Download
memory/2748-31-0x0000000073F20000-0x00000000746D0000-memory.dmp

Filesize
7.7MB

Download
memory/4740-7-0x0000000000177000-0x0000000000178000-memory.dmp

Filesize
4KB

Download