healer | e22a5cadeacc1a9d95354d85bdc17f6ab2dc5d23efe7df6d3d4683fb7b881a52

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exe
Size

923KB
MD5

1e4d6f387b6127e8e81f9d87c54ab03d
SHA1

aaece8294c60dcb0dffa5666c5562dfd1c625d14
SHA256

2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d
SHA512

d462602dbeca21d8aa4b724aa55d44a13a233f651d97894beff0c2f343ec9d1f4d4a13231d7d0ba5e50670aa2cc9df32b812036b50ee6446ffdd926665f62f44
SSDEEP

24576:HychlJu+Eka3nZgkWIRqu1ooxDHWC77/UXuE:SchlJha3KkWgH17xDHW

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral5/memory/2880-28-0x0000000000580000-0x00000000005BE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k1592910.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k1592910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1592910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1592910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1592910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1592910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1592910.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral5/memory/5088-36-0x0000000000590000-0x000000000061C000-memory.dmp	family_redline
behavioral5/memory/5088-42-0x0000000000590000-0x000000000061C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y8025108.exey4383833.exek1592910.exel4499084.exe

pid process

1088 y8025108.exe
4312 y4383833.exe
2880 k1592910.exe
5088 l4499084.exe

pid	process
1088	y8025108.exe
4312	y4383833.exe
2880	k1592910.exe
5088	l4499084.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k1592910.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k1592910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1592910.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exey8025108.exey4383833.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8025108.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y4383833.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k1592910.exe

pid process

2880 k1592910.exe
2880 k1592910.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k1592910.exe

description pid process

Token: SeDebugPrivilege 2880 k1592910.exe

pid	process
2880	k1592910.exe
2880	k1592910.exe

description	pid	process
Token: SeDebugPrivilege	2880	k1592910.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exey8025108.exey4383833.exe

description	pid	process	target process
PID 2116 wrote to memory of 1088	2116	2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exe	y8025108.exe
PID 2116 wrote to memory of 1088	2116	2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exe	y8025108.exe
PID 2116 wrote to memory of 1088	2116	2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exe	y8025108.exe
PID 1088 wrote to memory of 4312	1088	y8025108.exe	y4383833.exe
PID 1088 wrote to memory of 4312	1088	y8025108.exe	y4383833.exe
PID 1088 wrote to memory of 4312	1088	y8025108.exe	y4383833.exe
PID 4312 wrote to memory of 2880	4312	y4383833.exe	k1592910.exe
PID 4312 wrote to memory of 2880	4312	y4383833.exe	k1592910.exe
PID 4312 wrote to memory of 2880	4312	y4383833.exe	k1592910.exe
PID 4312 wrote to memory of 5088	4312	y4383833.exe	l4499084.exe
PID 4312 wrote to memory of 5088	4312	y4383833.exe	l4499084.exe
PID 4312 wrote to memory of 5088	4312	y4383833.exe	l4499084.exe

C:\Users\Admin\AppData\Local\Temp\2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exe
"C:\Users\Admin\AppData\Local\Temp\2d35abe32aaee5617d43bf1fd2ace13b082a8d22878b2f5ae8136ab65d54742d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8025108.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8025108.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4383833.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4383833.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4312

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1592910.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1592910.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4499084.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4499084.exe
4⤵
- Executes dropped EXE
PID:5088

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8025108.exe
Filesize
767KB

MD5
3c6b20838878d1ba0dc85f9e25560d6a

SHA1
7cc48ef04088c784933916840f1a7ffdbbc05557

SHA256
44d9c3ced5756e5568d8a6f88ffe600745a11e96142c8fe1c8fb737587c34165

SHA512
694a25eeef0b59a8b0cfb7cab5edf11804f75b0878d0087a73cf63e3ce51c499cc3af5ece50567b0b11f9c8af873e74fb5ed39b9fc26662ffa4339ed181ad78e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4383833.exe
Filesize
583KB

MD5
d051a72f73b7344a0f16d9be0f575638

SHA1
bc621c580d6a273ea4a3a54f6a87baa4c33c5a77

SHA256
1cbe63d47c16a2a7a20ebac006b978d9eeb00a24cf0b71644642e85d70a5a714

SHA512
2c2e8e7b0a4ee2fc00ea5c598922ca5ff202d11b0127cec909a0003d0748fbac09a5bd081b63a226d97520d9877c583b003962bc94d2cd2549f7421c2a76ec18

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1592910.exe
Filesize
294KB

MD5
3bd04dbf31955a13a1b2c7610dd7fedc

SHA1
ec1431cad05a34166412e31a7c7d3d25788a9691

SHA256
88e9656c88418f0692a5a41a2b7712bba3d19b68eefaf9d5ae79642b336a9a59

SHA512
eeb9c1c43c598205a61b2fecf8f49074957845dd07a1970ea14c1caf8566eb3ffb2f25b955422fb2d35bfddedfca8fba1438ac4e7486a28008bb5465125c7f6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4499084.exe
Filesize
494KB

MD5
5b977ea52ce08c78ce679e37b6875d06

SHA1
9fd79e29d065e0c79b66a9299333fd2abc829b00

SHA256
ff022c1a13884cd3bc78a4ed293ffc931e36b91880d996793039c035e87d347f

SHA512
d929c25adf73a2648a3b1de69cf51436a8ffccf878f1f9bde020027b17076f0f036536a3fd63d7f5468fd5272573d109d3ceaccba9a285216487b021edc394ac

Download Submit
memory/2880-21-0x0000000000580000-0x00000000005BE000-memory.dmp

Filesize
248KB

Download
memory/2880-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2880-28-0x0000000000580000-0x00000000005BE000-memory.dmp

Filesize
248KB

Download
memory/2880-29-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/5088-36-0x0000000000590000-0x000000000061C000-memory.dmp

Filesize
560KB

Download
memory/5088-42-0x0000000000590000-0x000000000061C000-memory.dmp

Filesize
560KB

Download
memory/5088-44-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/5088-45-0x0000000004AA0000-0x00000000050B8000-memory.dmp

Filesize
6.1MB

Download
memory/5088-46-0x00000000050C0000-0x00000000051CA000-memory.dmp

Filesize
1.0MB

Download
memory/5088-47-0x00000000051F0000-0x0000000005202000-memory.dmp

Filesize
72KB

Download
memory/5088-48-0x0000000005210000-0x000000000524C000-memory.dmp

Filesize
240KB

Download
memory/5088-49-0x0000000005280000-0x00000000052CC000-memory.dmp

Filesize
304KB

Download