healer | b2e3ef893eb456057652ab4434c1204484055bd056354e8672fc45f069c32800

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe
Size

1.0MB
MD5

774a173c2d0a5266b73ba5527e606bbe
SHA1

13173b00db1bff7e45c00be7327ae24bbb6e2ca6
SHA256

80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452
SHA512

076a9ad2a5d639f932936bc5d614fe0b2bdbfe162134eecbd706ef3ff979930e3efa7a2561935b445ee3f5e6e837c3e1fea8cd4b280d2f73f412106df05f8639
SSDEEP

12288:dMrly90aVXB6zrLW/kRNgMwsBpdTgep1Ez7O92GtV4zCpGr1DUzAWXZnQ2P++3qG:kylXB6XOALgepYO4GcFrQXZnBP+uqSh

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral17/memory/4424-34-0x0000000000490000-0x00000000004CE000-memory.dmp	healer
behavioral17/files/0x0007000000023435-38.dat	healer
behavioral17/memory/3968-41-0x0000000000C20000-0x0000000000C2A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a3946096.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3946096.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b9970516.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b9970516.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b9970516.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b9970516.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b9970516.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3946096.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3946096.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3946096.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3946096.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b9970516.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral17/memory/2348-46-0x0000000000960000-0x00000000009EC000-memory.dmp	family_redline
behavioral17/memory/2348-53-0x0000000000960000-0x00000000009EC000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
3504	v8090310.exe
4792	v9647761.exe
1172	v8497582.exe
4424	a3946096.exe
3968	b9970516.exe
2348	c0603818.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a3946096.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3946096.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b9970516.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8497582.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8090310.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9647761.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4424	a3946096.exe
4424	a3946096.exe
3968	b9970516.exe
3968	b9970516.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	a3946096.exe
Token: SeDebugPrivilege	3968	b9970516.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3504	2944	80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe	82
PID 2944 wrote to memory of 3504	2944	80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe	82
PID 2944 wrote to memory of 3504	2944	80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe	82
PID 3504 wrote to memory of 4792	3504	v8090310.exe	84
PID 3504 wrote to memory of 4792	3504	v8090310.exe	84
PID 3504 wrote to memory of 4792	3504	v8090310.exe	84
PID 4792 wrote to memory of 1172	4792	v9647761.exe	85
PID 4792 wrote to memory of 1172	4792	v9647761.exe	85
PID 4792 wrote to memory of 1172	4792	v9647761.exe	85
PID 1172 wrote to memory of 4424	1172	v8497582.exe	86
PID 1172 wrote to memory of 4424	1172	v8497582.exe	86
PID 1172 wrote to memory of 4424	1172	v8497582.exe	86
PID 1172 wrote to memory of 3968	1172	v8497582.exe	98
PID 1172 wrote to memory of 3968	1172	v8497582.exe	98
PID 4792 wrote to memory of 2348	4792	v9647761.exe	99
PID 4792 wrote to memory of 2348	4792	v9647761.exe	99
PID 4792 wrote to memory of 2348	4792	v9647761.exe	99

C:\Users\Admin\AppData\Local\Temp\80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe
"C:\Users\Admin\AppData\Local\Temp\80ada740ebfd0573ea8825fc2b499a0d326897ebf254fc015852802a58a05452.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8090310.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8090310.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9647761.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9647761.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8497582.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8497582.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3946096.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3946096.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9970516.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9970516.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0603818.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0603818.exe
      4⤵
      Executes dropped EXE
      PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8090310.exe

Filesize
905KB

MD5
38c200369a04519fac5b3dcf4ebff331

SHA1
ff91709a4270db05e8dc066f98b4183a934b3dfd

SHA256
9a0a6c0da259644cdffc971f307aa355c30e2f3b3b5432a1cc160833657d7cb9

SHA512
d4fa2fb01a1971560c29a4a8d3e31924477f17f43befd56cd872b011200937dcf55adf9da65a214fa2f358f5b398ef205303052b7474dde41a06ae48a0199eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9647761.exe

Filesize
722KB

MD5
e6bbcdaa2e24195d332b8d33f5c3c735

SHA1
18e3f00e89839e508ce56af566b8342c0694ca98

SHA256
9b0ce5a11bf7d6a365ddf391615dd64ff0bbb20d7233b2e47daf2969ad665c9d

SHA512
f2816aa283529403bf734ae4a54b95ac65bcdab49d63f8f7ba8c32f0cdc7f0e8f2db78c7ce991956cc3f4dfd03d3a2e53da5b71437f6465b8e4a5e206892a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0603818.exe

Filesize
490KB

MD5
5970af2c3b0603e1dd319e8842c90b23

SHA1
61ec8e4179e9e6a897dca4f2000f59f164095a8a

SHA256
8bfdcc0c67963381921087eb22dda3b54c37eaf799fdc0dbfc25ea0fd6b987c5

SHA512
20279989de39b520f929579aeebf9c2bc1ae90189922611b7fbfc7a682c0b788883350978ef8b616b6a7fac30196ffce35c6910318701e3edba20fb9b91190d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8497582.exe

Filesize
324KB

MD5
c311fe993ae5852b8d3884a385443b91

SHA1
cf3c1b692e6fb7953c200ab5aa9952dc8e898070

SHA256
06f50cc8c2530511d29e83c704132b3981d1bd93c70e5c01a79107894ba06ed0

SHA512
d62ba67a09721def6306f70e27dcedc236ee7fbcf4fecae2e461adcdc93a96e089129a278cde956edf29d9de2b00975144263fabe56e0a50e0ec91adf21c48c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a3946096.exe

Filesize
292KB

MD5
849938a7566cc3392c8de12b3f58e43f

SHA1
45f699e0713aa0b80ed12d1ce1e1d46e77b03e98

SHA256
36d27a57c260e9e2cda09be256605aa4e0e95ede7c7764951e1d575f6192c706

SHA512
86192b5aa19d7b5c0902200f3b849d22749b07dc2ca174a5a5a4a37c0aeafd6088e51a0e7a8335dda498099e74345be08b8c7f63bd1e36c9e07d09867e907e48

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9970516.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/2348-58-0x000000000A6A0000-0x000000000A6B2000-memory.dmp

Filesize
72KB

Download
memory/2348-59-0x000000000A6C0000-0x000000000A6FC000-memory.dmp

Filesize
240KB

Download
memory/2348-60-0x000000000A730000-0x000000000A77C000-memory.dmp

Filesize
304KB

Download
memory/2348-46-0x0000000000960000-0x00000000009EC000-memory.dmp

Filesize
560KB

Download
memory/2348-57-0x000000000A580000-0x000000000A68A000-memory.dmp

Filesize
1.0MB

Download
memory/2348-53-0x0000000000960000-0x00000000009EC000-memory.dmp

Filesize
560KB

Download
memory/2348-55-0x0000000002390000-0x0000000002396000-memory.dmp

Filesize
24KB

Download
memory/2348-56-0x0000000009F60000-0x000000000A578000-memory.dmp

Filesize
6.1MB

Download
memory/3968-41-0x0000000000C20000-0x0000000000C2A000-memory.dmp

Filesize
40KB

Download
memory/4424-35-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4424-34-0x0000000000490000-0x00000000004CE000-memory.dmp

Filesize
248KB

Download
memory/4424-28-0x0000000000490000-0x00000000004CE000-memory.dmp

Filesize
248KB

Download