healer | 205ae779babd66a06edef8f4549388af61dbb854e06c82a7f291317f4dbe780e

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
Size 863KB
Sample240510-qfa2rsbe83
SHA256 6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8
MD5 2a6e1fb8b08aaa808c7fb58476b6e43a
SHA1 7ad750caf7fae9d5a84a40ceaa6b717687c8f8c0
SHA512 e1ebc658f348be796144da8d64139e1736e028448e15e922663202fbb9234ae5eff82fe5323cd3b0b192f238eaa4dcbe91364fe0a46385726f91ec0afc892db8
SSDEEP 24576:zybHwr+znBAxCLaz/qplMPNYrlWCn+QCh2:GbQr+jBQL+M2R+Qq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral12/memory/1548-15-0x0000000000420000-0x000000000042A000-memory.dmp	healer
behavioral12/memory/1548-19-0x0000000000400000-0x0000000000412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0140419.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0140419.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral12/memory/3412-25-0x0000000000440000-0x0000000000470000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
4004	y2308083.exe
1548	k0140419.exe
3412	l0067136.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0140419.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0140419.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2308083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1548	k0140419.exe
1548	k0140419.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	k0140419.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4004	772	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	91
PID 772 wrote to memory of 4004	772	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	91
PID 772 wrote to memory of 4004	772	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	91
PID 4004 wrote to memory of 1548	4004	y2308083.exe	92
PID 4004 wrote to memory of 1548	4004	y2308083.exe	92
PID 4004 wrote to memory of 1548	4004	y2308083.exe	92
PID 4004 wrote to memory of 3412	4004	y2308083.exe	96
PID 4004 wrote to memory of 3412	4004	y2308083.exe	96
PID 4004 wrote to memory of 3412	4004	y2308083.exe	96

C:\Users\Admin\AppData\Local\Temp\6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
"C:\Users\Admin\AppData\Local\Temp\6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0067136.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0067136.exe
    3⤵
    - Executes dropped EXE
    PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

y2308083.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe
Size 680KB
SHA256 bf73429ee52f9270d33a8197ee4e52727f33a67083eb1ae40adfbc8b2dbe2075
MD5 9c6164d041c24db6736a51008707f2a6
SHA1 c11101f7b72a3a0249f3e873bdd3735c1d8267fe
SHA512 847f56104d115c6b8e59a02fd5252a6e52a8511faf01b59d86fb3abbef1fab226cc5abce2c8921777c0db88e616b6f14028cdfcbd09fc6b6bfc06c5e4aaca2b0
SSDEEP 12288:bMrvy90pX9kxn0jIb0mCkqWL3sJG62zkdkjMPsdNNwL/Sh+nv3:YyiXuzlXAkjMPsXNwWcnv3
MD5 SHA1 SHA512 SSDEEP

Submit Download

k0140419.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe
Size 530KB
SHA256 082e8efad9dc970b2395071b67565558033a397e71cb304fea335ae18b739edf
MD5 5663b528b5976a2873c447dbcb05b6af
SHA1 c4e5c3993293c0441f80d4434d177708962bb78f
SHA512 1c352c1c48faa071b627b152c0898ac7e0e5c685478a79561d388a9a2563ce27c221b05b1e9572b62788dbca008da5858a2d33889b086f254d633f725e3600e2
SSDEEP 12288:7iICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:7BbVTb34k30/8dRi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

l0067136.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0067136.exe
Size 691KB
SHA256 9a8624b0e10ff7c1764e3cb07d2371b70dd4cf3ad32e8a0f41e5de4db11dacee
MD5 f5fbed4a17d320d04f69af6ba9604b80
SHA1 a41d2a644b5bdb23f41b194a06db0fb5e0ff61aa
SHA512 ae0221d3b79a220d9433c3b2ee243cb61b1f02a65e55337cc40afc978ad3f0c1dc2ae45cabcbe3e69e4e49f25a5db762bf4f891ad2a97fb1a6b11a62dc6c4cda
SSDEEP 12288:ow3zk2EwiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:owDkNwBbVTb34k30/8dRi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1548-14-0x0000000000401000-0x0000000000402000-memory.dmp

Download

memory/1548-15-0x0000000000420000-0x000000000042A000-memory.dmp

Download

memory/1548-19-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3412-25-0x0000000000440000-0x0000000000470000-memory.dmp

Download

memory/3412-30-0x0000000002420000-0x0000000002426000-memory.dmp

Download

memory/3412-31-0x000000000A4C0000-0x000000000AAD8000-memory.dmp

Download

memory/3412-32-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

Download

memory/3412-33-0x000000000A020000-0x000000000A032000-memory.dmp

Download

memory/3412-34-0x000000000A040000-0x000000000A07C000-memory.dmp

Download

memory/3412-35-0x000000000A0E0000-0x000000000A12C000-memory.dmp

Download