healer | df50e88cdc283283db23658c52adb6d37e55d4a38da81d63be2c23c190e6d979

Analysis

max time kernel
126s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe
Size

1.6MB
MD5

aed3e716f608104e2440f5a872c969de
SHA1

07bd20370b5dfebd101d421c64d040163aab20fc
SHA256

cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc
SHA512

80b1c179f57468ff121a0909e7e6940af32122e2086754329463c9c1877ea6e2cd4cfd0eccfe3f31b830a5d51fec6ceaacbd9e6c8eb6254cd734b0c4cdf00b5b
SSDEEP

24576:fyl8gNcSnpEaZYaoMZ7R9DkPAjuhhqT5zoCVQcx/e1jTfIHBx8sEwZZl7:qHDVq0NZkPmKh8zoCVQt1/Inxz

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral17/memory/3408-28-0x0000000000650000-0x000000000065A000-memory.dmp	healer
behavioral17/files/0x000700000002356b-35.dat	healer
behavioral17/memory/3252-37-0x0000000000800000-0x000000000080A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0591490.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0591490.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0591490.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b8807328.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b8807328.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b8807328.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b8807328.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a0591490.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0591490.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0591490.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b8807328.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b8807328.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral17/memory/4524-42-0x0000000000490000-0x00000000004C0000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
4084	v4450258.exe
2028	v2382910.exe
2448	v3119867.exe
3408	a0591490.exe
3252	b8807328.exe
4524	c2338553.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a0591490.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0591490.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b8807328.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v2382910.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v3119867.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4450258.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3408	a0591490.exe
3408	a0591490.exe
3252	b8807328.exe
3252	b8807328.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3408	a0591490.exe
Token: SeDebugPrivilege	3252	b8807328.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4084	2012	cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe	90
PID 2012 wrote to memory of 4084	2012	cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe	90
PID 2012 wrote to memory of 4084	2012	cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe	90
PID 4084 wrote to memory of 2028	4084	v4450258.exe	92
PID 4084 wrote to memory of 2028	4084	v4450258.exe	92
PID 4084 wrote to memory of 2028	4084	v4450258.exe	92
PID 2028 wrote to memory of 2448	2028	v2382910.exe	93
PID 2028 wrote to memory of 2448	2028	v2382910.exe	93
PID 2028 wrote to memory of 2448	2028	v2382910.exe	93
PID 2448 wrote to memory of 3408	2448	v3119867.exe	95
PID 2448 wrote to memory of 3408	2448	v3119867.exe	95
PID 2448 wrote to memory of 3408	2448	v3119867.exe	95
PID 2448 wrote to memory of 3252	2448	v3119867.exe	100
PID 2448 wrote to memory of 3252	2448	v3119867.exe	100
PID 2028 wrote to memory of 4524	2028	v2382910.exe	101
PID 2028 wrote to memory of 4524	2028	v2382910.exe	101
PID 2028 wrote to memory of 4524	2028	v2382910.exe	101

C:\Users\Admin\AppData\Local\Temp\cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe
"C:\Users\Admin\AppData\Local\Temp\cd321830f55d58d1391cb6f68bd887e31a7e1c0da19880caac02e0804afeb9bc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4450258.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4450258.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2382910.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2382910.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3119867.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3119867.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0591490.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0591490.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b8807328.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b8807328.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2338553.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2338553.exe
      4⤵
      Executes dropped EXE
      PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4450258.exe

Filesize
1.4MB

MD5
a9c8938bb80e4535f4d00f93ca4db050

SHA1
9875588d3102cb2a50eb5fdc0e517af9676fe769

SHA256
faae488d0f36be21caea7908d89e1171fa6292ebc7f06b387835cc1b0e83cc0d

SHA512
2a75bbe5717850c7a11ccfd5cecf84bddf982a3512a70909b0d9daf4abe7b217498cc5f147dec1b1b81d2e2d1f7ce54e54eb1fcc15071f3c4f375a0b98ab4d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v2382910.exe

Filesize
1.3MB

MD5
9dd971f5c28bd239ce88e6b50cf70234

SHA1
c4ef5f8668e15371d14fa93c8b18dc4d578d0d3b

SHA256
1f615508a598246fd500720118f9a85603048c8ba6c60484094605ba69ec1ef8

SHA512
57330a0c7b4a1b0539f153c4cfc9a159767352f36748de8c9dcafa3adce2652ee758c7d78c1728f6edda2c4c38b04167c1191e54f65c8005e37109b4d1da36dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2338553.exe

Filesize
729KB

MD5
640ce7325e5663516b121c5eeeb02dbc

SHA1
ac6ba514c9442b43450415b22d6b6fb686485cf7

SHA256
589e5e37639cfd78e6b7d7bb05bd072742932309195073812a7104cd9e715fc8

SHA512
1fa81a601b38f278b163c6ba04fe20d49c6f258ffbd8a4598553b209a83f0433d868f83f1f47876f2c1edef0b431334ebb8dfbcfb8bad3a3db9ee3f6161e87ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3119867.exe

Filesize
640KB

MD5
a23e8566807ee3a468dabd71af03d831

SHA1
bdb3d103a6108ba80f05bc73666e74816eb605f8

SHA256
8091ea19390957b3e708748238daa02d95f3e2b42abc9d29d7e88172bb344604

SHA512
aacfadc599c4e0a1ac54664a30fa6ba165df087b97e6225fe561439d465678fa731dc9712a3e1b30c0d79ecff8a2b8007e11f1653867498472125a4c88b4e827

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0591490.exe

Filesize
568KB

MD5
5cef2c3efcc75856638d10e09a8aaa08

SHA1
6a91293684bb915d84b394e7a58d92b6c9671c96

SHA256
b9d62aff6a5001903f6c1dce538cade7460b8efa1670a18002bd2b758944bd0b

SHA512
b20bef185f44d28fcc5e5adfa11991dcb05fae4856e2fc8e1204626e904fb8a90d604377b59a2c9210a3cb632ab08bbbfa04cbaa7fbf958f0735ff9ebd54b0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b8807328.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/3252-37-0x0000000000800000-0x000000000080A000-memory.dmp

Filesize
40KB

Download
memory/3408-28-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/4524-42-0x0000000000490000-0x00000000004C0000-memory.dmp

Filesize
192KB

Download
memory/4524-47-0x0000000006DF0000-0x0000000006DF6000-memory.dmp

Filesize
24KB

Download
memory/4524-48-0x0000000005090000-0x00000000056A8000-memory.dmp

Filesize
6.1MB

Download
memory/4524-49-0x0000000004AB0000-0x0000000004BBA000-memory.dmp

Filesize
1.0MB

Download
memory/4524-50-0x0000000004BF0000-0x0000000004C02000-memory.dmp

Filesize
72KB

Download
memory/4524-51-0x0000000004C10000-0x0000000004C4C000-memory.dmp

Filesize
240KB

Download
memory/4524-52-0x0000000004CB0000-0x0000000004CFC000-memory.dmp

Filesize
304KB

Download