healer | 205ae779babd66a06edef8f4549388af61dbb854e06c82a7f291317f4dbe780e

Analysis

max time kernel
126s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe
Size 1.0MB
Sample240510-qb3afsbd44
SHA256 3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092
MD5 2a7b1612e39c878b57a90f1ba48107f4
SHA1 51068a24348c3b407040ac2ff89880ee0d288175
SHA512 499bb38c777c8f2af14abff205ef997541a49521f6b873274d05d891486ac0a55144c4bb4ef99930b0bc4f36761235ba9fbf02d15859cd7dadf6ba0c05cfda14
SSDEEP 24576:8ybG6hufBVZ66lWbl9hIPGYN/2/nxult1qKTs5E/yldbAfIL:rjQ3s0Wb1IPGYNUnxuZ9Ts5E/Kk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral7/memory/4244-34-0x00000000005A0000-0x00000000005DE000-memory.dmp	healer
behavioral7/files/0x00070000000233ea-39.dat	healer
behavioral7/memory/2340-41-0x00000000005F0000-0x00000000005FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9380383.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b7088417.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b7088417.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/memory/4856-46-0x00000000006D0000-0x000000000075C000-memory.dmp	family_redline
behavioral7/memory/4856-53-0x00000000006D0000-0x000000000075C000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
956	v7446353.exe
2476	v7768253.exe
3596	v3476318.exe
4244	a9380383.exe
2340	b7088417.exe
4856	c3299072.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b7088417.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v3476318.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7446353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7768253.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4244	a9380383.exe
4244	a9380383.exe
2340	b7088417.exe
2340	b7088417.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	a9380383.exe
Token: SeDebugPrivilege	2340	b7088417.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 956	2892	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe	83
PID 2892 wrote to memory of 956	2892	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe	83
PID 2892 wrote to memory of 956	2892	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe	83
PID 956 wrote to memory of 2476	956	v7446353.exe	85
PID 956 wrote to memory of 2476	956	v7446353.exe	85
PID 956 wrote to memory of 2476	956	v7446353.exe	85
PID 2476 wrote to memory of 3596	2476	v7768253.exe	86
PID 2476 wrote to memory of 3596	2476	v7768253.exe	86
PID 2476 wrote to memory of 3596	2476	v7768253.exe	86
PID 3596 wrote to memory of 4244	3596	v3476318.exe	87
PID 3596 wrote to memory of 4244	3596	v3476318.exe	87
PID 3596 wrote to memory of 4244	3596	v3476318.exe	87
PID 3596 wrote to memory of 2340	3596	v3476318.exe	91
PID 3596 wrote to memory of 2340	3596	v3476318.exe	91
PID 2476 wrote to memory of 4856	2476	v7768253.exe	92
PID 2476 wrote to memory of 4856	2476	v7768253.exe	92
PID 2476 wrote to memory of 4856	2476	v7768253.exe	92

C:\Users\Admin\AppData\Local\Temp\3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe
"C:\Users\Admin\AppData\Local\Temp\3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7446353.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7446353.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7768253.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7768253.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3476318.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3476318.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9380383.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9380383.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7088417.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7088417.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3299072.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3299072.exe
      4⤵
      Executes dropped EXE
      PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

v7446353.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7446353.exe
Size 906KB
SHA256 7ebebeaa103ec219dc21ed1ab8b25e4a2d8d60020566009de3ae760d57231eba
MD5 cdb65c533898d46ca672b92973876229
SHA1 dd3e4296b3a91e58fc012573d71cab5fff647384
SHA512 ad49996b89fd5eeef0736072c1470f37fc6dc415d23dd3b2631b04fd183d50c4f34ce76233c31d4264f5ab132fcbbdc22158a19475937f211cbc3188a899f53f
SSDEEP 24576:TyNBVZ6z/WnN9xxj3po/2CqxHXnypKT8H3/LlAbjd5y:mFsDWn9xj3pofqxHi4T8H3/i3
MD5 SHA1 SHA512 SSDEEP

Submit Download

v7768253.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7768253.exe
Size 722KB
SHA256 d5e3c032af376571e939c53f9842783cf42e3bec65d504cad97ac08dedbb9e30
MD5 f0f6f170df1d271c552b0d02d9cfd00c
SHA1 81772a39f54f09e087fe647a2f29d00300ec790e
SHA512 7d0beb6f2f7f02f9664d840df1651846dad6332ba4d7df53870263af432bcd6ee66503e907efe2118196fb886fd0e9798ca2f03b77277281764847c226fb09fb
SSDEEP 12288:hMrIy902BaWm9MsLpSSnxSKVVuH/2CS4JiXvvSerBVFHKo8bD01g22HUjpTjG/bj:Fy5BaWm9Hg+3j8/2CjIXXLjJKo8Hr2PS
MD5 SHA1 SHA512 SSDEEP

Submit Download

c3299072.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3299072.exe
Size 492KB
SHA256 a56d1c14695ffe3d85956ba7c177b854a815455c54d2f6d7fb5a62b8581f6b6d
MD5 67cb989f9d39ef2dc25805925f57cdd2
SHA1 72de5155bbe113cecabc724e967c10080c2d656c
SHA512 dad3cef23beb97eaf54ae22432059de154e7ddb30ddb6431615230ed299b4fadd740cc483fe808c8b303c7a58b2008a560dc7bbc163e0f8928e9475c64aab943
SSDEEP 12288:YNzD47dIpNNajxWvqF+8O5K4GBG8UB4mKXU:YyIpHaNXoTK4GBGq
MD5 SHA1 SHA512 SSDEEP

Submit Download

v3476318.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3476318.exe
Size 323KB
SHA256 7042a4553944787fcb60549bdef9787f955632186eb343f892b892b221e1e260
MD5 b521dd3035f27c010fee90054ae2676b
SHA1 b14d984181669f3e60e628d4ccb22087098d18f7
SHA512 8e0a111b4d67a316f26d6bb046b486c302bbaa6202215a51e4370103cd200ae78e2b4111393bfe020e6e6c6e0107059c30d2252b12ae00cd829f15daafffe5d4
SSDEEP 6144:KYy+bnr+jp0yN90QE140EqMo5PB6/5rCSZPN4tW77WVn9uAz:MMrLy90D40z45rCSngSKV9uA
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9380383.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9380383.exe
Size 294KB
SHA256 7a6f2da386b5ab2e68859fe2b034068fde5c4c988d44edd3308364dbc95c9556
MD5 bd77385922ae5ed4007eb7317819e44a
SHA1 fc068ca58ab2d5ba7089df2507ff9c3842d9d7a1
SHA512 091e158952f5f4a7e71c5f49792b2b5bb05939071e14cbe2702d9c0a9255122118a930a48003ba56918f4f1a14c1bb9f87c0bf5a540fadc28a28e3ae0e915cb3
SSDEEP 6144:MXtLfFaxmKhcOXSFYK4reaBl5keqzpliTpTS2W8aeGo:MXt5Yt5K4rXlyeqPiTpTKbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7088417.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7088417.exe
Size 11KB
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2340-41-0x00000000005F0000-0x00000000005FA000-memory.dmp

Download

memory/4244-28-0x00000000005A0000-0x00000000005DE000-memory.dmp

Download

memory/4244-35-0x0000000004420000-0x0000000004421000-memory.dmp

Download

memory/4244-34-0x00000000005A0000-0x00000000005DE000-memory.dmp

Download

memory/4856-46-0x00000000006D0000-0x000000000075C000-memory.dmp

Download

memory/4856-53-0x00000000006D0000-0x000000000075C000-memory.dmp

Download

memory/4856-55-0x0000000002410000-0x0000000002416000-memory.dmp

Download

memory/4856-56-0x0000000007460000-0x0000000007A78000-memory.dmp

Download

memory/4856-57-0x0000000006E40000-0x0000000006F4A000-memory.dmp

Download

memory/4856-58-0x0000000006F50000-0x0000000006F62000-memory.dmp

Download

memory/4856-59-0x0000000006F70000-0x0000000006FAC000-memory.dmp

Download

memory/4856-60-0x0000000005A30000-0x0000000005A7C000-memory.dmp

Download