healer | df50e88cdc283283db23658c52adb6d37e55d4a38da81d63be2c23c190e6d979

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
Size

1.0MB
MD5

aa56dc80d4e82ae017ce150cf8fa48cc
SHA1

2a7ee36a1296e0438ef0e7a9ab41d8ff03496ec4
SHA256

2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad
SHA512

ce4c8441785c866d0bc9ab8a5c23bba8815fd8a1e30b9ab10ec6a36c6aaba2ebf70bf3c53a9515a52402014daf6e2b25542397fc498bb9a12ad11ee602769daf
SSDEEP

24576:XyaHBh7s7f2+6EFDn3Q521V2AJ56SANT0kAZJzgc:iahwfsEd3F1sAJ565gke

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral7/memory/5112-34-0x0000000000560000-0x000000000059E000-memory.dmp	healer
behavioral7/files/0x00070000000234b4-39.dat	healer
behavioral7/memory/2064-41-0x0000000000C10000-0x0000000000C1A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2081936.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b0494259.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b0494259.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/memory/1976-47-0x00000000005D0000-0x000000000065C000-memory.dmp	family_redline
behavioral7/memory/1976-53-0x00000000005D0000-0x000000000065C000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
2828	v6836019.exe
744	v6690351.exe
5028	v8762757.exe
5112	a2081936.exe
2064	b0494259.exe
1976	c2096168.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b0494259.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8762757.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6836019.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6690351.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2112	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5112	a2081936.exe
5112	a2081936.exe
2064	b0494259.exe
2064	b0494259.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	a2081936.exe
Token: SeDebugPrivilege	2064	b0494259.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2828	4548	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe	83
PID 4548 wrote to memory of 2828	4548	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe	83
PID 4548 wrote to memory of 2828	4548	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe	83
PID 2828 wrote to memory of 744	2828	v6836019.exe	84
PID 2828 wrote to memory of 744	2828	v6836019.exe	84
PID 2828 wrote to memory of 744	2828	v6836019.exe	84
PID 744 wrote to memory of 5028	744	v6690351.exe	85
PID 744 wrote to memory of 5028	744	v6690351.exe	85
PID 744 wrote to memory of 5028	744	v6690351.exe	85
PID 5028 wrote to memory of 5112	5028	v8762757.exe	86
PID 5028 wrote to memory of 5112	5028	v8762757.exe	86
PID 5028 wrote to memory of 5112	5028	v8762757.exe	86
PID 5028 wrote to memory of 2064	5028	v8762757.exe	97
PID 5028 wrote to memory of 2064	5028	v8762757.exe	97
PID 744 wrote to memory of 1976	744	v6690351.exe	98
PID 744 wrote to memory of 1976	744	v6690351.exe	98
PID 744 wrote to memory of 1976	744	v6690351.exe	98

C:\Users\Admin\AppData\Local\Temp\2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
"C:\Users\Admin\AppData\Local\Temp\2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe
      4⤵
      Executes dropped EXE
      PID:1976

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe

Filesize
908KB

MD5
25658f17325696a77fdc5dc5af300472

SHA1
0facd580ea7466701baf25ab3cd36945aea28b7d

SHA256
3c9d37c487d37aefab6c520534b2a76ee97ccb9d8dddc16b2220e3455f14344a

SHA512
1155d0d8b34cead480920efdc9220af31e82de4b7e843862163815d061da11e9457d34f16b2f55213728ef43f921ec0f363443fd4a8fe3488fea7612ae297c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe

Filesize
725KB

MD5
a2e96ecf6ba60ff964a2b0b60dde7e27

SHA1
501080ad7058cac17e373c9acbda786c3ff9bdac

SHA256
0e712b394b21d5676bde7625b698470e0f7011ae4897abdec1a4f89dfa8cf096

SHA512
93c3963b8488abb826601dc90e98733b1e29549494039df1cd1fb2c351f2374a24ea2e2d8c66eefa51d6ee6a1b0221432a42cfa00eac510da0aef33ed4544bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe

Filesize
492KB

MD5
d672c9ba43fa4ec7905376f48d1f5cbc

SHA1
e0c94e851acb35383c031780e03ea0861acf6dc8

SHA256
963945d65b9fa323b0825b650842d944de7c0d5ecbe7af4fe91097f1f6e42702

SHA512
551cd7811814302685a698d8a6d73e8ac2dbea66bac651bb2fc6457300d536529619bcb4973b072cedd88c08e96fae0f50abf39ca35e9bc09e38f48566c6bd53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe

Filesize
326KB

MD5
d5b0ccf141e399d25360a28d534df7f0

SHA1
ef15c7a65069cb727ffdb2232c6210d030b4fbfe

SHA256
0170edb4d68699bbc4babbafeada5ed5138206b0d06d736a1340a077256b3d30

SHA512
0ebdf9f7ff7adaa314abec6e2359d2e241c483be42b81aadc097dac13c70a5906ee6e4345579dece05a84373f47462f5f53aee6554e3a4abaf142a5a09c00e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe

Filesize
294KB

MD5
bdb5076d6b84394534265c87b725acd6

SHA1
be2336c83ca619167ef129bd699027e21fa187b1

SHA256
347e9d55c98bc84cef2d62c5e3ce982c9176bee6df41bdbc7d6f31f25744e198

SHA512
10404edb5540983006f3f50754d4babc0d6c35ce6315aff8ef6d3d7aa9e5bd5d9b52f3cb05374be7e317ca2a4ea74af6eec99c72335a5112a5f50c1c77ae1173

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1976-58-0x00000000051A0000-0x00000000051B2000-memory.dmp

Filesize
72KB

Download
memory/1976-59-0x00000000051C0000-0x00000000051FC000-memory.dmp

Filesize
240KB

Download
memory/1976-60-0x0000000005230000-0x000000000527C000-memory.dmp

Filesize
304KB

Download
memory/1976-47-0x00000000005D0000-0x000000000065C000-memory.dmp

Filesize
560KB

Download
memory/1976-57-0x0000000005070000-0x000000000517A000-memory.dmp

Filesize
1.0MB

Download
memory/1976-53-0x00000000005D0000-0x000000000065C000-memory.dmp

Filesize
560KB

Download
memory/1976-55-0x0000000004450000-0x0000000004456000-memory.dmp

Filesize
24KB

Download
memory/1976-56-0x00000000049E0000-0x0000000004FF8000-memory.dmp

Filesize
6.1MB

Download
memory/2064-41-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/5112-35-0x00000000045E0000-0x00000000045E1000-memory.dmp

Filesize
4KB

Download
memory/5112-34-0x0000000000560000-0x000000000059E000-memory.dmp

Filesize
248KB

Download
memory/5112-29-0x0000000000560000-0x000000000059E000-memory.dmp

Filesize
248KB

Download