healer | 205ae779babd66a06edef8f4549388af61dbb854e06c82a7f291317f4dbe780e

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
Size

863KB
MD5

2a6e1fb8b08aaa808c7fb58476b6e43a
SHA1

7ad750caf7fae9d5a84a40ceaa6b717687c8f8c0
SHA256

6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8
SHA512

e1ebc658f348be796144da8d64139e1736e028448e15e922663202fbb9234ae5eff82fe5323cd3b0b192f238eaa4dcbe91364fe0a46385726f91ec0afc892db8
SSDEEP

24576:zybHwr+znBAxCLaz/qplMPNYrlWCn+QCh2:GbQr+jBQL+M2R+Qq

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
behavioral12/memory/3508-15-0x00000000004F0000-0x00000000004FA000-memory.dmp	healer
behavioral12/memory/3508-19-0x0000000000400000-0x0000000000412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k0140419.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0140419.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral12/memory/1888-26-0x0000000000620000-0x0000000000650000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

y2308083.exek0140419.exel0067136.exe

pid process

2540 y2308083.exe
3508 k0140419.exe
1888 l0067136.exe

pid	process
2540	y2308083.exe
3508	k0140419.exe
1888	l0067136.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k0140419.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0140419.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0140419.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exey2308083.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2308083.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k0140419.exe

pid process

3508 k0140419.exe
3508 k0140419.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k0140419.exe

description pid process

Token: SeDebugPrivilege 3508 k0140419.exe

pid	process
3508	k0140419.exe
3508	k0140419.exe

description	pid	process
Token: SeDebugPrivilege	3508	k0140419.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exey2308083.exe

description	pid	process	target process
PID 3984 wrote to memory of 2540	3984	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	y2308083.exe
PID 3984 wrote to memory of 2540	3984	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	y2308083.exe
PID 3984 wrote to memory of 2540	3984	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	y2308083.exe
PID 2540 wrote to memory of 3508	2540	y2308083.exe	k0140419.exe
PID 2540 wrote to memory of 3508	2540	y2308083.exe	k0140419.exe
PID 2540 wrote to memory of 3508	2540	y2308083.exe	k0140419.exe
PID 2540 wrote to memory of 1888	2540	y2308083.exe	l0067136.exe
PID 2540 wrote to memory of 1888	2540	y2308083.exe	l0067136.exe
PID 2540 wrote to memory of 1888	2540	y2308083.exe	l0067136.exe

C:\Users\Admin\AppData\Local\Temp\6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
"C:\Users\Admin\AppData\Local\Temp\6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0067136.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0067136.exe
    3⤵
    - Executes dropped EXE
    PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe

Filesize
680KB

MD5
9c6164d041c24db6736a51008707f2a6

SHA1
c11101f7b72a3a0249f3e873bdd3735c1d8267fe

SHA256
bf73429ee52f9270d33a8197ee4e52727f33a67083eb1ae40adfbc8b2dbe2075

SHA512
847f56104d115c6b8e59a02fd5252a6e52a8511faf01b59d86fb3abbef1fab226cc5abce2c8921777c0db88e616b6f14028cdfcbd09fc6b6bfc06c5e4aaca2b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe

Filesize
530KB

MD5
5663b528b5976a2873c447dbcb05b6af

SHA1
c4e5c3993293c0441f80d4434d177708962bb78f

SHA256
082e8efad9dc970b2395071b67565558033a397e71cb304fea335ae18b739edf

SHA512
1c352c1c48faa071b627b152c0898ac7e0e5c685478a79561d388a9a2563ce27c221b05b1e9572b62788dbca008da5858a2d33889b086f254d633f725e3600e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0067136.exe

Filesize
691KB

MD5
f5fbed4a17d320d04f69af6ba9604b80

SHA1
a41d2a644b5bdb23f41b194a06db0fb5e0ff61aa

SHA256
9a8624b0e10ff7c1764e3cb07d2371b70dd4cf3ad32e8a0f41e5de4db11dacee

SHA512
ae0221d3b79a220d9433c3b2ee243cb61b1f02a65e55337cc40afc978ad3f0c1dc2ae45cabcbe3e69e4e49f25a5db762bf4f891ad2a97fb1a6b11a62dc6c4cda

Download Submit
memory/1888-31-0x0000000009E50000-0x000000000A468000-memory.dmp

Filesize
6.1MB

Download
memory/1888-26-0x0000000000620000-0x0000000000650000-memory.dmp

Filesize
192KB

Download
memory/1888-30-0x0000000004960000-0x0000000004966000-memory.dmp

Filesize
24KB

Download
memory/1888-32-0x000000000A500000-0x000000000A60A000-memory.dmp

Filesize
1.0MB

Download
memory/1888-33-0x000000000A640000-0x000000000A652000-memory.dmp

Filesize
72KB

Download
memory/1888-34-0x000000000A660000-0x000000000A69C000-memory.dmp

Filesize
240KB

Download
memory/1888-35-0x0000000002320000-0x000000000236C000-memory.dmp

Filesize
304KB

Download
memory/3508-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3508-15-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/3508-14-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download