healer | 205ae779babd66a06edef8f4549388af61dbb854e06c82a7f291317f4dbe780e

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe
Size

1.0MB
MD5

2a7b1612e39c878b57a90f1ba48107f4
SHA1

51068a24348c3b407040ac2ff89880ee0d288175
SHA256

3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092
SHA512

499bb38c777c8f2af14abff205ef997541a49521f6b873274d05d891486ac0a55144c4bb4ef99930b0bc4f36761235ba9fbf02d15859cd7dadf6ba0c05cfda14
SSDEEP

24576:8ybG6hufBVZ66lWbl9hIPGYN/2/nxult1qKTs5E/yldbAfIL:rjQ3s0Wb1IPGYNUnxuZ9Ts5E/Kk

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral7/memory/1756-34-0x00000000004E0000-0x000000000051E000-memory.dmp	healer
behavioral7/files/0x0007000000023452-39.dat	healer
behavioral7/memory/2920-41-0x0000000000760000-0x000000000076A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b7088417.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9380383.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b7088417.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b7088417.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/memory/4056-46-0x0000000001F50000-0x0000000001FDC000-memory.dmp	family_redline
behavioral7/memory/4056-53-0x0000000001F50000-0x0000000001FDC000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
4712	v7446353.exe
2416	v7768253.exe
3416	v3476318.exe
1756	a9380383.exe
2920	b7088417.exe
4056	c3299072.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9380383.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b7088417.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7446353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7768253.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v3476318.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1756	a9380383.exe
1756	a9380383.exe
2920	b7088417.exe
2920	b7088417.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	a9380383.exe
Token: SeDebugPrivilege	2920	b7088417.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4712	2360	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe	83
PID 2360 wrote to memory of 4712	2360	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe	83
PID 2360 wrote to memory of 4712	2360	3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe	83
PID 4712 wrote to memory of 2416	4712	v7446353.exe	84
PID 4712 wrote to memory of 2416	4712	v7446353.exe	84
PID 4712 wrote to memory of 2416	4712	v7446353.exe	84
PID 2416 wrote to memory of 3416	2416	v7768253.exe	85
PID 2416 wrote to memory of 3416	2416	v7768253.exe	85
PID 2416 wrote to memory of 3416	2416	v7768253.exe	85
PID 3416 wrote to memory of 1756	3416	v3476318.exe	86
PID 3416 wrote to memory of 1756	3416	v3476318.exe	86
PID 3416 wrote to memory of 1756	3416	v3476318.exe	86
PID 3416 wrote to memory of 2920	3416	v3476318.exe	95
PID 3416 wrote to memory of 2920	3416	v3476318.exe	95
PID 2416 wrote to memory of 4056	2416	v7768253.exe	96
PID 2416 wrote to memory of 4056	2416	v7768253.exe	96
PID 2416 wrote to memory of 4056	2416	v7768253.exe	96

C:\Users\Admin\AppData\Local\Temp\3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe
"C:\Users\Admin\AppData\Local\Temp\3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7446353.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7446353.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7768253.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7768253.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3476318.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3476318.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9380383.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9380383.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7088417.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7088417.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3299072.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3299072.exe
      4⤵
      Executes dropped EXE
      PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7446353.exe

Filesize
906KB

MD5
cdb65c533898d46ca672b92973876229

SHA1
dd3e4296b3a91e58fc012573d71cab5fff647384

SHA256
7ebebeaa103ec219dc21ed1ab8b25e4a2d8d60020566009de3ae760d57231eba

SHA512
ad49996b89fd5eeef0736072c1470f37fc6dc415d23dd3b2631b04fd183d50c4f34ce76233c31d4264f5ab132fcbbdc22158a19475937f211cbc3188a899f53f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7768253.exe

Filesize
722KB

MD5
f0f6f170df1d271c552b0d02d9cfd00c

SHA1
81772a39f54f09e087fe647a2f29d00300ec790e

SHA256
d5e3c032af376571e939c53f9842783cf42e3bec65d504cad97ac08dedbb9e30

SHA512
7d0beb6f2f7f02f9664d840df1651846dad6332ba4d7df53870263af432bcd6ee66503e907efe2118196fb886fd0e9798ca2f03b77277281764847c226fb09fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3299072.exe

Filesize
492KB

MD5
67cb989f9d39ef2dc25805925f57cdd2

SHA1
72de5155bbe113cecabc724e967c10080c2d656c

SHA256
a56d1c14695ffe3d85956ba7c177b854a815455c54d2f6d7fb5a62b8581f6b6d

SHA512
dad3cef23beb97eaf54ae22432059de154e7ddb30ddb6431615230ed299b4fadd740cc483fe808c8b303c7a58b2008a560dc7bbc163e0f8928e9475c64aab943

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3476318.exe

Filesize
323KB

MD5
b521dd3035f27c010fee90054ae2676b

SHA1
b14d984181669f3e60e628d4ccb22087098d18f7

SHA256
7042a4553944787fcb60549bdef9787f955632186eb343f892b892b221e1e260

SHA512
8e0a111b4d67a316f26d6bb046b486c302bbaa6202215a51e4370103cd200ae78e2b4111393bfe020e6e6c6e0107059c30d2252b12ae00cd829f15daafffe5d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9380383.exe

Filesize
294KB

MD5
bd77385922ae5ed4007eb7317819e44a

SHA1
fc068ca58ab2d5ba7089df2507ff9c3842d9d7a1

SHA256
7a6f2da386b5ab2e68859fe2b034068fde5c4c988d44edd3308364dbc95c9556

SHA512
091e158952f5f4a7e71c5f49792b2b5bb05939071e14cbe2702d9c0a9255122118a930a48003ba56918f4f1a14c1bb9f87c0bf5a540fadc28a28e3ae0e915cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b7088417.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1756-28-0x00000000004E0000-0x000000000051E000-memory.dmp

Filesize
248KB

Download
memory/1756-34-0x00000000004E0000-0x000000000051E000-memory.dmp

Filesize
248KB

Download
memory/1756-35-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/2920-41-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download
memory/4056-46-0x0000000001F50000-0x0000000001FDC000-memory.dmp

Filesize
560KB

Download
memory/4056-53-0x0000000001F50000-0x0000000001FDC000-memory.dmp

Filesize
560KB

Download
memory/4056-55-0x0000000004390000-0x0000000004396000-memory.dmp

Filesize
24KB

Download
memory/4056-56-0x0000000005010000-0x0000000005628000-memory.dmp

Filesize
6.1MB

Download
memory/4056-57-0x0000000004A80000-0x0000000004B8A000-memory.dmp

Filesize
1.0MB

Download
memory/4056-58-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/4056-59-0x0000000004BD0000-0x0000000004C0C000-memory.dmp

Filesize
240KB

Download
memory/4056-60-0x0000000004C40000-0x0000000004C8C000-memory.dmp

Filesize
304KB

Download