healer | 0ff9bc0436d6052b24d3174a3e4aeb590fa03a5b78a09d0b6a5a4084006891e2

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe
Size

923KB
MD5

14826c2b7764c3ae77eb12b79dd1aaf8
SHA1

c46b126efed7e3f415170c28c72fe5728f9d3736
SHA256

fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f
SHA512

e6c8c0033d6dfe041cccc39706b792848dc616a558c4335a684b90b4699b741878e5bd6154091fcdc5edea5aa6182461cf77d8502570d757e8139dd923e34817
SSDEEP

12288:FMrty90DTg0LJebSzCkCFAsbuJE0AR6N+nNuSXFdjlocBpRDPUYz+tEAF15+pqE7:QyshkYdCFduoNjrl5XBPUW+78qE/j

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral23/memory/4364-28-0x0000000000590000-0x00000000005CE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k1421373.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1421373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1421373.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k1421373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1421373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1421373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1421373.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral23/memory/4808-35-0x0000000001F70000-0x0000000001FFC000-memory.dmp	family_redline
behavioral23/memory/4808-42-0x0000000001F70000-0x0000000001FFC000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y2571427.exey7110096.exek1421373.exel2146173.exe

pid process

652 y2571427.exe
5032 y7110096.exe
4364 k1421373.exe
4808 l2146173.exe

pid	process
652	y2571427.exe
5032	y7110096.exe
4364	k1421373.exe
4808	l2146173.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k1421373.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k1421373.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1421373.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exey2571427.exey7110096.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2571427.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7110096.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k1421373.exe

pid process

4364 k1421373.exe
4364 k1421373.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k1421373.exe

description pid process

Token: SeDebugPrivilege 4364 k1421373.exe

pid	process
4364	k1421373.exe
4364	k1421373.exe

description	pid	process
Token: SeDebugPrivilege	4364	k1421373.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exey2571427.exey7110096.exe

description	pid	process	target process
PID 3808 wrote to memory of 652	3808	fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe	y2571427.exe
PID 3808 wrote to memory of 652	3808	fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe	y2571427.exe
PID 3808 wrote to memory of 652	3808	fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe	y2571427.exe
PID 652 wrote to memory of 5032	652	y2571427.exe	y7110096.exe
PID 652 wrote to memory of 5032	652	y2571427.exe	y7110096.exe
PID 652 wrote to memory of 5032	652	y2571427.exe	y7110096.exe
PID 5032 wrote to memory of 4364	5032	y7110096.exe	k1421373.exe
PID 5032 wrote to memory of 4364	5032	y7110096.exe	k1421373.exe
PID 5032 wrote to memory of 4364	5032	y7110096.exe	k1421373.exe
PID 5032 wrote to memory of 4808	5032	y7110096.exe	l2146173.exe
PID 5032 wrote to memory of 4808	5032	y7110096.exe	l2146173.exe
PID 5032 wrote to memory of 4808	5032	y7110096.exe	l2146173.exe

C:\Users\Admin\AppData\Local\Temp\fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe
"C:\Users\Admin\AppData\Local\Temp\fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3808

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2571427.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2571427.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7110096.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7110096.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5032

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1421373.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1421373.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2146173.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2146173.exe
4⤵
- Executes dropped EXE
PID:4808

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2571427.exe
Filesize
767KB

MD5
e8bfe83276b8cf0523f7cdb5c09d1ccd

SHA1
25ea0b55076d042b75d8518feacc7acee94db71b

SHA256
0b91ab3aeed8bf8d36d1d8f9b621ea7419c15705c44a722b707cce7034057966

SHA512
a12562de993ff37f37738f808fc1ecfb36e79b64442a348196a3d2ea3c3b8fb32c25ff217abfd19246d3a2193d4eae9ee4d580065c3542697f959832ad843935

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7110096.exe
Filesize
584KB

MD5
7e16642af0542f98e53a83ef26011162

SHA1
e3a5d8e9f82a94a78dc8627d0471c5edd4e2953c

SHA256
f09c37ee6dec059ef49483c9da0634b64ea289848a507e331a0bfb8caa65a750

SHA512
a75bc33c5d2ff76bb6eb17053d3a2f37d89f75189bcbd1c2b0671df3fb32a75bfc464b822b4a35c8869a0eb50a55149b5a7aa204f83d034749acf025d8b3b60e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1421373.exe
Filesize
294KB

MD5
efade657e753c1afa9934e5810c6c45d

SHA1
69fc060c17e0b19599e31cf883f695f3172fe00d

SHA256
6c5fd398bae2c753bcbc4bdeb0bcdc53ef76c009021e2a082a3bbc022b9f8635

SHA512
b1d5e80adf2ba11bd855a93172c761c1f660dad9f3f3c80ba335d8fe668026c6e2337028fd1fa90f35c2cda2778e03f1cf6d26d91a1f376f4fffe380e283e724

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2146173.exe
Filesize
492KB

MD5
92afdf44d1c33960ab452a8c274282db

SHA1
60c7376a52f74f0799ee2a574782e9855af28efe

SHA256
e12a3d43b1f8a35e75f3bf09ea5422ef10bccfa19a8b2e131259f7b4be5333d2

SHA512
31ee981dd21ffe2498d74cf7713df410d55b6a9f9894c571b6d05bd372402362f051b0f87cbcb62d9723c145593eb53dd8c04cdb72836adf9c71b82170a83e1f

Download Submit
memory/4364-22-0x0000000000590000-0x00000000005CE000-memory.dmp

Filesize
248KB

Download
memory/4364-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/4364-28-0x0000000000590000-0x00000000005CE000-memory.dmp

Filesize
248KB

Download
memory/4364-29-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4808-35-0x0000000001F70000-0x0000000001FFC000-memory.dmp

Filesize
560KB

Download
memory/4808-42-0x0000000001F70000-0x0000000001FFC000-memory.dmp

Filesize
560KB

Download
memory/4808-44-0x0000000004530000-0x0000000004536000-memory.dmp

Filesize
24KB

Download
memory/4808-45-0x000000000B510000-0x000000000BB28000-memory.dmp

Filesize
6.1MB

Download
memory/4808-46-0x000000000BB30000-0x000000000BC3A000-memory.dmp

Filesize
1.0MB

Download
memory/4808-47-0x0000000006CF0000-0x0000000006D02000-memory.dmp

Filesize
72KB

Download
memory/4808-48-0x0000000006D10000-0x0000000006D4C000-memory.dmp

Filesize
240KB

Download
memory/4808-49-0x00000000069F0000-0x0000000006A3C000-memory.dmp

Filesize
304KB

Download