healer | b2e3ef893eb456057652ab4434c1204484055bd056354e8672fc45f069c32800

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52.exe
Size

1.2MB
MD5

71e8215f45ecb1d3b3b28bc579b27922
SHA1

8e7aae40eb5db95d0481bf9b72eb4a7d106e7849
SHA256

9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52
SHA512

2f4298bf325b4c68594b7c8132380c0cb5f29381c59d95235251c2f42dd8c8b989852c587f6d93ebfb3dfc9247af584d5c9253489cdaae32ae98147bb5f3b055
SSDEEP

24576:VyyC6D5dkr0Rke7qmSYMn6nJq+u/jQPGiEXP5JQ0kvLI8cLaMaV8ceZVyMKwk05j:w0gr0RNqmTMn8JGjyG9ScT2aZVyek

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral18/memory/1428-41-0x00000000006C0000-0x00000000006FE000-memory.dmp	healer
behavioral18/files/0x0007000000023419-46.dat	healer
behavioral18/memory/2176-48-0x0000000000F00000-0x0000000000F0A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8356638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8356638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8356638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8356638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b3075474.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b3075474.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b3075474.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a8356638.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b3075474.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b3075474.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b3075474.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8356638.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral18/memory/4612-53-0x0000000001F80000-0x000000000200C000-memory.dmp	family_redline
behavioral18/memory/4612-60-0x0000000001F80000-0x000000000200C000-memory.dmp	family_redline

Executes dropped EXE 7 IoCs

pid	Process
4580	v6358775.exe
4772	v2959190.exe
2800	v3996029.exe
1212	v5535719.exe
1428	a8356638.exe
2176	b3075474.exe
4612	c7127075.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a8356638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8356638.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b3075474.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6358775.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2959190.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v3996029.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v5535719.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1428	a8356638.exe
1428	a8356638.exe
2176	b3075474.exe
2176	b3075474.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	a8356638.exe
Token: SeDebugPrivilege	2176	b3075474.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4580	116	9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52.exe	83
PID 116 wrote to memory of 4580	116	9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52.exe	83
PID 116 wrote to memory of 4580	116	9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52.exe	83
PID 4580 wrote to memory of 4772	4580	v6358775.exe	84
PID 4580 wrote to memory of 4772	4580	v6358775.exe	84
PID 4580 wrote to memory of 4772	4580	v6358775.exe	84
PID 4772 wrote to memory of 2800	4772	v2959190.exe	86
PID 4772 wrote to memory of 2800	4772	v2959190.exe	86
PID 4772 wrote to memory of 2800	4772	v2959190.exe	86
PID 2800 wrote to memory of 1212	2800	v3996029.exe	87
PID 2800 wrote to memory of 1212	2800	v3996029.exe	87
PID 2800 wrote to memory of 1212	2800	v3996029.exe	87
PID 1212 wrote to memory of 1428	1212	v5535719.exe	88
PID 1212 wrote to memory of 1428	1212	v5535719.exe	88
PID 1212 wrote to memory of 1428	1212	v5535719.exe	88
PID 1212 wrote to memory of 2176	1212	v5535719.exe	92
PID 1212 wrote to memory of 2176	1212	v5535719.exe	92
PID 2800 wrote to memory of 4612	2800	v3996029.exe	93
PID 2800 wrote to memory of 4612	2800	v3996029.exe	93
PID 2800 wrote to memory of 4612	2800	v3996029.exe	93

C:\Users\Admin\AppData\Local\Temp\9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52.exe
"C:\Users\Admin\AppData\Local\Temp\9e8418826f07274a00f90b02756f693711350696a60867c9adff98b6c0268e52.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6358775.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6358775.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2959190.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2959190.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3996029.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3996029.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5535719.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5535719.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8356638.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8356638.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3075474.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3075474.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7127075.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7127075.exe
        5⤵
        Executes dropped EXE
        
        PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6358775.exe

Filesize
1.0MB

MD5
bb3db59eea1df96380edfe10ea55b5f4

SHA1
64a4227004fc84f2653fa31cbd7bc0d4c3a1d9c1

SHA256
9a9a452c6475ecaa9bcd866384134ff1adfe53dc87dceefcdc4c4c3a5dfa42b6

SHA512
f5170408fd453750bf84107ef39b1756dd5f11a1277ad6732c0f10a7bb2087d569b60f325cf8bf16cccb01ea46c591cf6e189613d7653fc7180232f6ac94e292

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2959190.exe

Filesize
909KB

MD5
209c8e0c8e3e1001cb812be59c8a2cc2

SHA1
786903379ef92b8da7c21879c07fc195726a791c

SHA256
22e93a4b9b088c2734e2e683ed4aeb9835e6bb7c2715e64d73239994afba93e9

SHA512
d1b68a2f26e338c3f367bafc0c6488a9fcfcda44582b5bacbb7473f1a795250e458f5adc7c63b2c138e82879853d349be50b24b79c3f74f8a6b05507f91b0214

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3996029.exe

Filesize
726KB

MD5
b70af505efaf18e5111b7f0872af4327

SHA1
657b1fa0e8d7471d41f15c42f5667f66cf75444d

SHA256
1a48f593f8655695612dfd5829661808652b01d27d84591307fe340ff93d4cfc

SHA512
7b3fbb54fdee78a92d6988bcedfed62a3a898bbb923cc47959ed783b546649f9a3d26158ac30e951c3afe77b2927613f8c2abb22eeefb423bb4e90634ff2cac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7127075.exe

Filesize
492KB

MD5
fbf0c53dbe9d08426544a73809b99663

SHA1
8a69324d6cec182396da32e1d1225142b51d891a

SHA256
69ed32190d50c45e26723f296ae93ce4cc32ae1e2a13d5268c15b5224e31c0a1

SHA512
bb37e0c38cd128a48453223af82e8965b5dfa007b79a80ba015a12089ade1f29553eaa20b53afaa558396e4a670bbfdecc4263b728f364096820f61d55a8e057

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5535719.exe

Filesize
326KB

MD5
960a0885cbbfa23cd3a310929248ec8d

SHA1
0e0b415f6ea22a9fa4ff6b25d2cfd1b8e73442cb

SHA256
4af789aec86e09f8bc7af1b818c791f3733d5900a706b52d25634e4a60f723b3

SHA512
f1414072f542f27aa057ccd493243e725943396fcf25fffcdd654f2dad19dc66b4302d19d65032c460a3436d9687cc97a0fc8cfd6007e8f07142ba91595434fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8356638.exe

Filesize
295KB

MD5
7e9f2cb217f3e911cbf490e250a81d85

SHA1
161b42b6e4d08f752be8b70bc1b1e405f71b9d15

SHA256
62f459126461c28fdfe1c4bae75d7d14ef9742a56c08f4b7679b86e20bf79eaa

SHA512
28f1929ee1905381f6f608bb6b446e09ec03b73f6a5475fe8b8a28fc7566561a3fb058c8242f0219958571d1b6d495422a7c215d71947d8b54841fb2ff7cefae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3075474.exe

Filesize
11KB

MD5
7dec748a03906160dfe516141a43e841

SHA1
2078f0c87593907a7a4acade058838878324e062

SHA256
5ba4774ca85ec41c74081da5ff04c679e4bc6b846e43a9a913d1fdc753673baa

SHA512
e6e1dcb78200ebb571865286d46052f6c901ebb3b7b34b8a0f81cb9c78bd33ab2e088ab6ac91fcd0729abcbddd09e19a236e4d3d3a2456bdffb185b5c231eb16

Download Submit
memory/1428-35-0x00000000006C0000-0x00000000006FE000-memory.dmp

Filesize
248KB

Download
memory/1428-41-0x00000000006C0000-0x00000000006FE000-memory.dmp

Filesize
248KB

Download
memory/1428-42-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2176-48-0x0000000000F00000-0x0000000000F0A000-memory.dmp

Filesize
40KB

Download
memory/4612-53-0x0000000001F80000-0x000000000200C000-memory.dmp

Filesize
560KB

Download
memory/4612-60-0x0000000001F80000-0x000000000200C000-memory.dmp

Filesize
560KB

Download
memory/4612-62-0x00000000024E0000-0x00000000024E6000-memory.dmp

Filesize
24KB

Download
memory/4612-63-0x0000000006DC0000-0x00000000073D8000-memory.dmp

Filesize
6.1MB

Download
memory/4612-64-0x00000000073E0000-0x00000000074EA000-memory.dmp

Filesize
1.0MB

Download
memory/4612-65-0x0000000006CF0000-0x0000000006D02000-memory.dmp

Filesize
72KB

Download
memory/4612-66-0x0000000006D10000-0x0000000006D4C000-memory.dmp

Filesize
240KB

Download
memory/4612-67-0x00000000074F0000-0x000000000753C000-memory.dmp

Filesize
304KB

Download