healer | f6a395732f5dfe45c1b53e1a544f31826d5f310499de2170e9064ac9605a913e

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe
Size

1.0MB
MD5

250d1ecad815535932db86d951b6f70d
SHA1

9d56851eda02a979043c33ec98883e2655bacc30
SHA256

e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a
SHA512

ede2fc99fe086f427355d95e2b4fad0289da828f3105c5c2b9b48a8aee213928299725b55d066df7ce2f3c139ecdf38ff418bf20ac36244678f0f0d0a7a05c65
SSDEEP

24576:wyt+dYi+Bu0wW31dx/UEvzxRTkICQ/digppmVnXrBh:3tmYiN0t3VfB5VdpAV1

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral19/memory/5060-21-0x0000000000420000-0x000000000042A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k0376940.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0376940.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral19/memory/4856-32-0x0000000000520000-0x0000000000550000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y4046657.exey7493625.exek0376940.exel8136250.exe

pid process

2008 y4046657.exe
2868 y7493625.exe
5060 k0376940.exe
4856 l8136250.exe

pid	process
2008	y4046657.exe
2868	y7493625.exe
5060	k0376940.exe
4856	l8136250.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k0376940.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0376940.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

y7493625.exee81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exey4046657.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7493625.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4046657.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k0376940.exe

pid process

5060 k0376940.exe
5060 k0376940.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k0376940.exe

description pid process

Token: SeDebugPrivilege 5060 k0376940.exe

pid	process
5060	k0376940.exe
5060	k0376940.exe

description	pid	process
Token: SeDebugPrivilege	5060	k0376940.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exey4046657.exey7493625.exe

description	pid	process	target process
PID 1616 wrote to memory of 2008	1616	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe	y4046657.exe
PID 1616 wrote to memory of 2008	1616	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe	y4046657.exe
PID 1616 wrote to memory of 2008	1616	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe	y4046657.exe
PID 2008 wrote to memory of 2868	2008	y4046657.exe	y7493625.exe
PID 2008 wrote to memory of 2868	2008	y4046657.exe	y7493625.exe
PID 2008 wrote to memory of 2868	2008	y4046657.exe	y7493625.exe
PID 2868 wrote to memory of 5060	2868	y7493625.exe	k0376940.exe
PID 2868 wrote to memory of 5060	2868	y7493625.exe	k0376940.exe
PID 2868 wrote to memory of 5060	2868	y7493625.exe	k0376940.exe
PID 2868 wrote to memory of 4856	2868	y7493625.exe	l8136250.exe
PID 2868 wrote to memory of 4856	2868	y7493625.exe	l8136250.exe
PID 2868 wrote to memory of 4856	2868	y7493625.exe	l8136250.exe

C:\Users\Admin\AppData\Local\Temp\e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe
"C:\Users\Admin\AppData\Local\Temp\e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4046657.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4046657.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7493625.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7493625.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0376940.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0376940.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8136250.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8136250.exe
      4⤵
      Executes dropped EXE
      PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4046657.exe

Filesize
891KB

MD5
632d34cbac048fae16fe87464e3a7863

SHA1
5a3b1318c0a3f49db4a6b50f1a793c4467270acb

SHA256
7baf3c9e70fb5602c411a2a26e560d838749d33b049ae714a239cd8e723d0fa9

SHA512
6c7267a7cd1cd7d5656e4ec510995c051c2b4765268fa77a3281d60c9ebd625c8e6dfec407991f379ad0136bba2bb7c1dc8d126c6fc05ad8e68e377c9c071c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7493625.exe

Filesize
708KB

MD5
126a71b0cadb61f9955dfb0afde13398

SHA1
9eb772b2a8b827afee01748cf145d45c13b0eeec

SHA256
fb4aad226f160ee99a11e53b3be48122a02426e78831e3af9b3d0c5732864b67

SHA512
45a4e81984557481d49caa986e509a379346d9c5ebee6c6c0b8a26a44e4564ec0d4ca648561e3b7aef8d90afd17ded42843bb261fea9e7d5b1a4c211fd4662d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0376940.exe

Filesize
576KB

MD5
cff8a2e59615a98cbf918dd8e077a389

SHA1
e11fc159e3d8583828982cffea34f067a2660590

SHA256
41cf136363e0a0111f1e5fea2446d7b81e6e8027eb980eea8f287f2223007e52

SHA512
e6fff9eddf47925ee859feb22b8fc1ab5a34bc2d7fa95afbfcf477ac0ba584a2c1142dde0860f13d3951c8c1486af0e7567638227434d07a13e3239e590aa23f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8136250.exe

Filesize
448KB

MD5
0c192551879129ab157aed855f715e8a

SHA1
57c1b0a4cbd849ae0b37ea36b57463f05ae91e97

SHA256
f6dcc0fb1a738c88ec2020e178e6685cd02be70baab21d57ac70651cfcac1ff9

SHA512
9162c8efe3d212d55b157616386f19a869b64dbd242089c8a322cb902fc9416f7f4b1715fd9c664daaa1c1394be0b33dc6cca87a83512428f64bafe2d7c9ab36

Download Submit
memory/4856-37-0x0000000009FD0000-0x000000000A5E8000-memory.dmp

Filesize
6.1MB

Download
memory/4856-32-0x0000000000520000-0x0000000000550000-memory.dmp

Filesize
192KB

Download
memory/4856-36-0x0000000004960000-0x0000000004966000-memory.dmp

Filesize
24KB

Download
memory/4856-38-0x000000000A640000-0x000000000A74A000-memory.dmp

Filesize
1.0MB

Download
memory/4856-39-0x000000000A780000-0x000000000A792000-memory.dmp

Filesize
72KB

Download
memory/4856-40-0x000000000A7A0000-0x000000000A7DC000-memory.dmp

Filesize
240KB

Download
memory/4856-41-0x00000000022F0000-0x000000000233C000-memory.dmp

Filesize
304KB

Download
memory/5060-21-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/5060-25-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download