healer | 0ff9bc0436d6052b24d3174a3e4aeb590fa03a5b78a09d0b6a5a4084006891e2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe
Size

923KB
MD5

15a66b0dbcfb940814f615e4ee68aba4
SHA1

176b68418045780c00cfd3d7d80bfbfbfc5d5c06
SHA256

1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be
SHA512

567bb1ceafb234ae79165a19f029455b169fb1fdd09ef2117194e1b7445ded3f790c7dd677e1ec9dda5e87b8ec80e03f948c1a182a88af23667aa937136e5490
SSDEEP

24576:AyTpevOGPbwWB1yeCa0va2vLKpWF8XggzXjeMsP0upbt:H1TGPbceC7mpteM8pb

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2384-28-0x0000000000580000-0x00000000005BE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k0868537.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0868537.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0868537.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0868537.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0868537.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0868537.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0868537.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1752-35-0x0000000000590000-0x000000000061C000-memory.dmp	family_redline
behavioral1/memory/1752-42-0x0000000000590000-0x000000000061C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y9618800.exey7994942.exek0868537.exel2565488.exe

pid process

1440 y9618800.exe
888 y7994942.exe
2384 k0868537.exe
1752 l2565488.exe

pid	process
1440	y9618800.exe
888	y7994942.exe
2384	k0868537.exe
1752	l2565488.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k0868537.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0868537.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0868537.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exey9618800.exey7994942.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9618800.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7994942.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k0868537.exe

pid process

2384 k0868537.exe
2384 k0868537.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k0868537.exe

description pid process

Token: SeDebugPrivilege 2384 k0868537.exe

pid	process
2384	k0868537.exe
2384	k0868537.exe

description	pid	process
Token: SeDebugPrivilege	2384	k0868537.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exey9618800.exey7994942.exe

description	pid	process	target process
PID 1240 wrote to memory of 1440	1240	1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe	y9618800.exe
PID 1240 wrote to memory of 1440	1240	1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe	y9618800.exe
PID 1240 wrote to memory of 1440	1240	1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe	y9618800.exe
PID 1440 wrote to memory of 888	1440	y9618800.exe	y7994942.exe
PID 1440 wrote to memory of 888	1440	y9618800.exe	y7994942.exe
PID 1440 wrote to memory of 888	1440	y9618800.exe	y7994942.exe
PID 888 wrote to memory of 2384	888	y7994942.exe	k0868537.exe
PID 888 wrote to memory of 2384	888	y7994942.exe	k0868537.exe
PID 888 wrote to memory of 2384	888	y7994942.exe	k0868537.exe
PID 888 wrote to memory of 1752	888	y7994942.exe	l2565488.exe
PID 888 wrote to memory of 1752	888	y7994942.exe	l2565488.exe
PID 888 wrote to memory of 1752	888	y7994942.exe	l2565488.exe

C:\Users\Admin\AppData\Local\Temp\1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe
"C:\Users\Admin\AppData\Local\Temp\1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1240

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9618800.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9618800.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7994942.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7994942.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:888

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0868537.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0868537.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2565488.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2565488.exe
4⤵
- Executes dropped EXE
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9618800.exe
Filesize
768KB

MD5
90ddc71aad47f855293aac8fb6cc3155

SHA1
fd7c1a778a3b152efc0191abb4d9850d3d16c27d

SHA256
b5e4572305046a1e2cb098917210151587637b9c36e569e865604c2ac9c44a89

SHA512
7e245ae5d1719e0d5b602daab25e5909ce69ac7043e86484bb4f78dcca330388e3a5d2ac107a2461034f6d4516114be2e57fd7a870d1e12c3d57b4200ac38e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7994942.exe
Filesize
584KB

MD5
99a8d9274cc4137b35ba4257b8656bde

SHA1
1bc53a1ba6f9ba68e72e4b0633cf6cd4906f03a6

SHA256
97c5f5178025c0394c7da0b0e07572cdbe125ba415d6287691a24385bd78d8ac

SHA512
a8b8d287d8ea83079e778a0825c78c8a0e8eaa4762f49f57548cbf57c9199b023505061318c9bb3d34af62349d81626f027d3463926b849206302a9caa934b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0868537.exe
Filesize
295KB

MD5
e16312c7c9a868625867d1b890aca6a4

SHA1
df0ab37d89638f7b20a5dae626e443d6cdd7e7de

SHA256
52ee36c62392f58e1477cdc63784fd76c34beb00f228e5a53cf87061f92d0f54

SHA512
875849af8dc45f53f1c8b71ba7a6487268618c145f10c2d817fcd7aa517e0aff174e14bd7067712e14141248ef4754fcf5c6339ae3a4c1eb80f982353543cbb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2565488.exe
Filesize
493KB

MD5
a3e8dfc21a7b47a0c350c9ac0d531045

SHA1
04e9e262d60a6d12621605556a886d79454a2f8f

SHA256
92d96d740fe1e575f6ad6b93af64e0e4d47ebd6c5e70d2f6fa5892e8c1548124

SHA512
fef294ca2691dde614b44d79b7f67b44984f43ea201e3b352ee8ab38346fbc02b711c8e7ff47dad7eca0e445df34adcc9493c61f9f9128cb12f08dc685941cc6

Download Submit
memory/1752-45-0x00000000049E0000-0x0000000004FF8000-memory.dmp

Filesize
6.1MB

Download
memory/1752-35-0x0000000000590000-0x000000000061C000-memory.dmp

Filesize
560KB

Download
memory/1752-42-0x0000000000590000-0x000000000061C000-memory.dmp

Filesize
560KB

Download
memory/1752-44-0x00000000022E0000-0x00000000022E6000-memory.dmp

Filesize
24KB

Download
memory/1752-46-0x0000000005090000-0x000000000519A000-memory.dmp

Filesize
1.0MB

Download
memory/1752-47-0x00000000051C0000-0x00000000051D2000-memory.dmp

Filesize
72KB

Download
memory/1752-48-0x00000000051E0000-0x000000000521C000-memory.dmp

Filesize
240KB

Download
memory/1752-49-0x0000000005250000-0x000000000529C000-memory.dmp

Filesize
304KB

Download
memory/2384-29-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/2384-28-0x0000000000580000-0x00000000005BE000-memory.dmp

Filesize
248KB

Download
memory/2384-22-0x0000000000580000-0x00000000005BE000-memory.dmp

Filesize
248KB

Download
memory/2384-21-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download