healer | e22a5cadeacc1a9d95354d85bdc17f6ab2dc5d23efe7df6d3d4683fb7b881a52

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exe
Size

921KB
MD5

21150b773bfe5ce3cb16ea03e18d03e0
SHA1

4b374d61fa92d29f777a82c7a42d558c697f1a44
SHA256

7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555
SHA512

20bf20fd9c3de71ba4fe46d2b31b5169c6268de44a9e3fa96711c0d93f335a583d836935aafb49efade44e7c1a7587c544af3fc5511123aa6115cbec7d6f1d97
SSDEEP

24576:CyFllbMVwT/Q0K3wHNpWhHUZn7CEYfbu:p3lbMVwTIENpYHInXq

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral14/memory/1724-28-0x0000000000590000-0x00000000005CE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k8462227.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k8462227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8462227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8462227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8462227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8462227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8462227.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral14/memory/3836-35-0x0000000002060000-0x00000000020EC000-memory.dmp	family_redline
behavioral14/memory/3836-42-0x0000000002060000-0x00000000020EC000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y8742565.exey6192832.exek8462227.exel4474769.exe

pid process

3464 y8742565.exe
1372 y6192832.exe
1724 k8462227.exe
3836 l4474769.exe

pid	process
3464	y8742565.exe
1372	y6192832.exe
1724	k8462227.exe
3836	l4474769.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k8462227.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k8462227.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8462227.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exey8742565.exey6192832.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8742565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y6192832.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k8462227.exe

pid process

1724 k8462227.exe
1724 k8462227.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k8462227.exe

description pid process

Token: SeDebugPrivilege 1724 k8462227.exe

pid	process
1724	k8462227.exe
1724	k8462227.exe

description	pid	process
Token: SeDebugPrivilege	1724	k8462227.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exey8742565.exey6192832.exe

description	pid	process	target process
PID 536 wrote to memory of 3464	536	7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exe	y8742565.exe
PID 536 wrote to memory of 3464	536	7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exe	y8742565.exe
PID 536 wrote to memory of 3464	536	7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exe	y8742565.exe
PID 3464 wrote to memory of 1372	3464	y8742565.exe	y6192832.exe
PID 3464 wrote to memory of 1372	3464	y8742565.exe	y6192832.exe
PID 3464 wrote to memory of 1372	3464	y8742565.exe	y6192832.exe
PID 1372 wrote to memory of 1724	1372	y6192832.exe	k8462227.exe
PID 1372 wrote to memory of 1724	1372	y6192832.exe	k8462227.exe
PID 1372 wrote to memory of 1724	1372	y6192832.exe	k8462227.exe
PID 1372 wrote to memory of 3836	1372	y6192832.exe	l4474769.exe
PID 1372 wrote to memory of 3836	1372	y6192832.exe	l4474769.exe
PID 1372 wrote to memory of 3836	1372	y6192832.exe	l4474769.exe

C:\Users\Admin\AppData\Local\Temp\7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exe
"C:\Users\Admin\AppData\Local\Temp\7a398dd87e73b31bd02e99eea6ac42ac6c884f0fed02dcf0a0a2184a33913555.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8742565.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8742565.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3464

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6192832.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6192832.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8462227.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8462227.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4474769.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4474769.exe
4⤵
- Executes dropped EXE
PID:3836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8742565.exe
Filesize
766KB

MD5
95d2100c92a77a73c603081f30c2fc23

SHA1
c1aa4842f6cd0876401f5c2738f41f3083116d47

SHA256
84eec35e2697eea6eb88e1c63006dbc7464533bd8a703cd0cbf553d1b60eacc4

SHA512
e8221ee1bc142f0c8cb3726b46767a196a271de5bdc4d73fb9a9b5e7898c955cdbd7037733142d45873743b1a0bcaf7eee0a7493fab4652cb9b753feb7d807e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6192832.exe
Filesize
583KB

MD5
25ae8b33c55e946e87d3ad9cf1b95e4e

SHA1
94b57f3d5b2ef2a5b4af0f13d93574c441ed9016

SHA256
d77536661a640bcd7bae77346b665cf7a4cfdf72d66463d638d65efc541a8855

SHA512
aacbfa748b6e6385e199a358e2781bb05b7eb389ff8f735eaed1c257e9c7ddd6783f8efc9743507c565ad4b0d31987161a07b126b753c4c38f07fccf4ddda233

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8462227.exe
Filesize
296KB

MD5
6ba22005c57de51e274dd36fcc6cf437

SHA1
b5b07a32ad47870b828e701792f9d90fe8494242

SHA256
a7c6872ed6045c7dd0706d2b96cd122989cdb9c1d4fa772594131a760e733194

SHA512
e4215fb7b937afc794d49983738326d8359b2887bc6253a6d5e8380bd2db92afc84dc35206db8a3f8b4e4b2a08b87e04c2108e7fe3c0a1e06a7af897832a40bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4474769.exe
Filesize
491KB

MD5
68285b405009ab1bfb17580e8ccdaaf2

SHA1
d013006cf8f7fc2f7ed85eb9e961ed29599998c5

SHA256
12713c9bded34a577955f09993589e7e6c4ae24791ffd88f4c3d860bc8cf786e

SHA512
ef31bcca57ab341e0768997edbd243b31d73d4cd29eaa9104a88588db2a904bd1f76e9d4883a491c7aa89db5b1046a49b49116e13ad0a2fd065b8f07841974c5

Download Submit
memory/1724-21-0x0000000000590000-0x00000000005CE000-memory.dmp

Filesize
248KB

Download
memory/1724-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1724-28-0x0000000000590000-0x00000000005CE000-memory.dmp

Filesize
248KB

Download
memory/1724-29-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/3836-35-0x0000000002060000-0x00000000020EC000-memory.dmp

Filesize
560KB

Download
memory/3836-42-0x0000000002060000-0x00000000020EC000-memory.dmp

Filesize
560KB

Download
memory/3836-44-0x00000000022A0000-0x00000000022A6000-memory.dmp

Filesize
24KB

Download
memory/3836-45-0x0000000008520000-0x0000000008B38000-memory.dmp

Filesize
6.1MB

Download
memory/3836-46-0x0000000007F50000-0x000000000805A000-memory.dmp

Filesize
1.0MB

Download
memory/3836-47-0x0000000008080000-0x0000000008092000-memory.dmp

Filesize
72KB

Download
memory/3836-48-0x00000000080A0000-0x00000000080DC000-memory.dmp

Filesize
240KB

Download
memory/3836-49-0x0000000005A30000-0x0000000005A7C000-memory.dmp

Filesize
304KB

Download