healer | 292b6242a8248f18030260bd0c373ec14be1362f7f7494bca33e42fcc97580b0

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe
Size

864KB
MD5

ba371037effb3bc1fb01bb593a705272
SHA1

a557ecb6ba798abf36b6c691d19e50e03e2285df
SHA256

b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606
SHA512

373624c6d599275cd090fe584cb5ce26f3acabd2ed070623470764e5a43d875a6c0220bd36b056299773f3b8ff12cf19ce261ab7edd80661ad8d5c3b535a7556
SSDEEP

12288:yMrjy90R4n/HwA+x/tRDFjep/9fX7ZqpYM3b3GOfGsBuku78cKIyVUYFYZT5zd+O:Zy4k/HwVZWZqScasI778FIyTYZNsiF

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral16/memory/2884-15-0x0000000000510000-0x000000000051A000-memory.dmp	healer
behavioral16/memory/2884-19-0x0000000000400000-0x0000000000412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k2136327.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k2136327.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral16/memory/4912-25-0x0000000000510000-0x0000000000540000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
3504	y8651279.exe
2884	k2136327.exe
4912	l5542130.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k2136327.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8651279.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4592	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	k2136327.exe
2884	k2136327.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	k2136327.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 3504	1432	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe	82
PID 1432 wrote to memory of 3504	1432	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe	82
PID 1432 wrote to memory of 3504	1432	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe	82
PID 3504 wrote to memory of 2884	3504	y8651279.exe	84
PID 3504 wrote to memory of 2884	3504	y8651279.exe	84
PID 3504 wrote to memory of 2884	3504	y8651279.exe	84
PID 3504 wrote to memory of 4912	3504	y8651279.exe	96
PID 3504 wrote to memory of 4912	3504	y8651279.exe	96
PID 3504 wrote to memory of 4912	3504	y8651279.exe	96

C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe
"C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
    3⤵
    - Executes dropped EXE
    PID:4912

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe

Filesize
681KB

MD5
2fa0b20366653721bfd1f84d5b98b444

SHA1
c773631701fe88e4005f677f6c1ef79214e86b67

SHA256
fc2efa5d597bb9ee814cf60cad1a3bd950f888f9872e9eb0641122d6970f1b4e

SHA512
55c6446678428d769252290284b4fb7e8754e2bea6eec83aa69c89265d73bbadd5960ccb4a3fcc72814adfe3ba9210695047d20fde33db059896cb8dd8f36b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe

Filesize
530KB

MD5
d34061162711706e5dd2ab26f14dcb48

SHA1
6d82cb68928bdff681abb7d57e189134b423cbb9

SHA256
d9acdfeecdcc8d68575f0b12776b8de817879244b722cbfce99bebee466e058a

SHA512
030b52f1fdf8e23d5928804f83b885eef245c4997bfde8cf84f553b17495c5e2480c0586f646c93fa229c1dde281d296e766880bf7a13efd70ba0fe8d4273379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe

Filesize
692KB

MD5
c1324e71cf7b600ddcd634bd62a66011

SHA1
c4931a75b47ef4d24cb2d207ef2541d632fcd9a1

SHA256
76fa42dfdd3e0ada08e4534c0cd169ef3d15c0561ca01074b43f621e885011d7

SHA512
1ff9c15bb553dd793413ad5f58b02c45bbeeeea5663235132c5771e6ff5b917c1a4985790682200c94b44d617b795b9846d81904226431389b5f185c26c3332c

Download Submit
memory/2884-14-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2884-15-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/2884-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4912-25-0x0000000000510000-0x0000000000540000-memory.dmp

Filesize
192KB

Download
memory/4912-30-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/4912-31-0x0000000009F70000-0x000000000A588000-memory.dmp

Filesize
6.1MB

Download
memory/4912-32-0x000000000A590000-0x000000000A69A000-memory.dmp

Filesize
1.0MB

Download
memory/4912-33-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/4912-34-0x0000000004BA0000-0x0000000004BDC000-memory.dmp

Filesize
240KB

Download
memory/4912-35-0x0000000001FE0000-0x000000000202C000-memory.dmp

Filesize
304KB

Download