healer | 9805f81a13aaa68a2026a38b70b1fdd1d76fee0ff63916c669d728c6e4dc3b7e

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exe
Size

922KB
MD5

4d6bc87a5035be0d2eff75f9a663f7a7
SHA1

a427033287f275020232a2f96e8413f7ffc9b400
SHA256

7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225
SHA512

c2168b460ec7fe2f6af5f3c4103a3940aa2b4da642790ddb2efa69463f71f2cb1b3183bbd9ee5f8c5046d9b56fafd89c79eea19ca14c0467a8861af4ea3c8399
SSDEEP

24576:QygOXaCEQ2qvM8W8KNJv+w7pg9uz8aPjsER:XgOqCEYk8W39g95qY

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral13/memory/2916-28-0x0000000001F50000-0x0000000001F8E000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k8528235.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8528235.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8528235.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k8528235.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8528235.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8528235.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8528235.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral13/memory/1692-35-0x0000000001FB0000-0x000000000203C000-memory.dmp	family_redline
behavioral13/memory/1692-42-0x0000000001FB0000-0x000000000203C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y0850882.exey7385010.exek8528235.exel0232831.exe

pid process

2708 y0850882.exe
4168 y7385010.exe
2916 k8528235.exe
1692 l0232831.exe

pid	process
2708	y0850882.exe
4168	y7385010.exe
2916	k8528235.exe
1692	l0232831.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k8528235.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k8528235.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8528235.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exey0850882.exey7385010.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0850882.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7385010.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k8528235.exe

pid process

2916 k8528235.exe
2916 k8528235.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k8528235.exe

description pid process

Token: SeDebugPrivilege 2916 k8528235.exe

pid	process
2916	k8528235.exe
2916	k8528235.exe

description	pid	process
Token: SeDebugPrivilege	2916	k8528235.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exey0850882.exey7385010.exe

description	pid	process	target process
PID 5044 wrote to memory of 2708	5044	7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exe	y0850882.exe
PID 5044 wrote to memory of 2708	5044	7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exe	y0850882.exe
PID 5044 wrote to memory of 2708	5044	7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exe	y0850882.exe
PID 2708 wrote to memory of 4168	2708	y0850882.exe	y7385010.exe
PID 2708 wrote to memory of 4168	2708	y0850882.exe	y7385010.exe
PID 2708 wrote to memory of 4168	2708	y0850882.exe	y7385010.exe
PID 4168 wrote to memory of 2916	4168	y7385010.exe	k8528235.exe
PID 4168 wrote to memory of 2916	4168	y7385010.exe	k8528235.exe
PID 4168 wrote to memory of 2916	4168	y7385010.exe	k8528235.exe
PID 4168 wrote to memory of 1692	4168	y7385010.exe	l0232831.exe
PID 4168 wrote to memory of 1692	4168	y7385010.exe	l0232831.exe
PID 4168 wrote to memory of 1692	4168	y7385010.exe	l0232831.exe

C:\Users\Admin\AppData\Local\Temp\7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exe
"C:\Users\Admin\AppData\Local\Temp\7fc78a2450a642c8ab25d22c58c9792408d566a5b9043d95b64f6b407d9d8225.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0850882.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0850882.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7385010.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7385010.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8528235.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8528235.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0232831.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0232831.exe
      4⤵
      Executes dropped EXE
      PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0850882.exe

Filesize
767KB

MD5
962339e95ac5bdecc78ceea3f5889a15

SHA1
4844abe8c5bcdbaa7b98523aecb3ffe4cc4ab989

SHA256
f64cd7a90f2d74f3a03884579799e10c279b897fff8a70516df3812e1a5aa55a

SHA512
1e5eba16e1b5c2e54f972d99889e356fe4733c06ed393dda404cc5665de990aa4824a4e646a8510a0d390a5c4422b6206c882d78823ac4a5741053a90c1343a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7385010.exe

Filesize
584KB

MD5
5793a21ac859ef19994b3d1a50ddc743

SHA1
d22009a4c879198e4860f544c6852e6c1bbd2668

SHA256
b6ecdfa52af2f75c34139ee50b75c309dbf58115ac1e49a7345b9c54446f9cdb

SHA512
2825667a20b9facd92ea035905e2d9dc31c6da5a6a5162f43a46469b3377f25d8d313693d49762c62f126bde75fabfbcc54fbb05c81b1e2f0dc21fff9dab3d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8528235.exe

Filesize
294KB

MD5
28047cbf2d645dcc10890f1dd7b100bc

SHA1
4e151f97af9eb9d158c18f192304a1761e86de5c

SHA256
b0b4dc853bd36dc9c374adc07d2f3587d666172d757de99e676be75867ee9704

SHA512
f3a75c60150eaa0ed0b8f8b6919160f97e4f4ca22b07754959e6750b427710357cf9af8da13c8f290a89bb3b3e3237935f51909b7351aba5dd8cef5c6f5fc75d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0232831.exe

Filesize
492KB

MD5
d1a7bdf3494cf43c97baefb3f0a5690f

SHA1
c5e923eae73ca8ef14a47926108f4c57d249dae0

SHA256
594f7299b09cad447d65d591d4cd9e55ad65a45743f07746ff087d148e889757

SHA512
a44b72890635b9d575da19fed1e1de03297d3ba5328ddecacb146790ef2bbc4b66c17f8d14db4e5ddc56faf59da1fe6fdbeb19c6271f740519a822476497d965

Download Submit
memory/1692-45-0x0000000005CD0000-0x00000000062E8000-memory.dmp

Filesize
6.1MB

Download
memory/1692-35-0x0000000001FB0000-0x000000000203C000-memory.dmp

Filesize
560KB

Download
memory/1692-42-0x0000000001FB0000-0x000000000203C000-memory.dmp

Filesize
560KB

Download
memory/1692-44-0x0000000002440000-0x0000000002446000-memory.dmp

Filesize
24KB

Download
memory/1692-46-0x0000000006330000-0x000000000643A000-memory.dmp

Filesize
1.0MB

Download
memory/1692-47-0x0000000006460000-0x0000000006472000-memory.dmp

Filesize
72KB

Download
memory/1692-48-0x0000000006480000-0x00000000064BC000-memory.dmp

Filesize
240KB

Download
memory/1692-49-0x00000000064F0000-0x000000000653C000-memory.dmp

Filesize
304KB

Download
memory/2916-29-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2916-28-0x0000000001F50000-0x0000000001F8E000-memory.dmp

Filesize
248KB

Download
memory/2916-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2916-21-0x0000000001F50000-0x0000000001F8E000-memory.dmp

Filesize
248KB

Download