healer | e6564b70fa3d9a9e989ad7c1bb2b027f2e5447273c0bb64f84c7940828ecb0ed

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe
Size

389KB
MD5

2eeefdf643f78c415d5773e6839837b2
SHA1

797a0d8433f1b575915a9cb2952795535fb3546d
SHA256

ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394
SHA512

96c66dfb44902289d99a122c9e8b2804a236e61351e81ad56f5406fd935a2c5e65fac58da2bb8dd8f2738e5d7e1251128413b5247a1cfc421e1b5dc6c960272f
SSDEEP

6144:K8y+bnr+9p0yN90QEA748JHJlPx2r5z3HVK9ehKCCB2GTNXeD3zsvHclk:QMrty90mM8VJluVSaKCCEUXau

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe	healer
behavioral16/memory/3040-14-0x0000000000990000-0x000000000099A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

p8565578.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p8565578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p8565578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p8565578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p8565578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p8565578.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p8565578.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4844943.exe	family_redline
behavioral16/memory/2384-20-0x0000000000F00000-0x0000000000F30000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

z2882788.exep8565578.exer4844943.exe

pid process

1228 z2882788.exe
3040 p8565578.exe
2384 r4844943.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

p8565578.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p8565578.exe

pid	process
1228	z2882788.exe
3040	p8565578.exe
2384	r4844943.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p8565578.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exez2882788.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2882788.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

p8565578.exe

pid process

3040 p8565578.exe
3040 p8565578.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

p8565578.exe

description pid process

Token: SeDebugPrivilege 3040 p8565578.exe

pid	process
3040	p8565578.exe
3040	p8565578.exe

description	pid	process
Token: SeDebugPrivilege	3040	p8565578.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exez2882788.exe

description	pid	process	target process
PID 1952 wrote to memory of 1228	1952	ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe	z2882788.exe
PID 1952 wrote to memory of 1228	1952	ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe	z2882788.exe
PID 1952 wrote to memory of 1228	1952	ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe	z2882788.exe
PID 1228 wrote to memory of 3040	1228	z2882788.exe	p8565578.exe
PID 1228 wrote to memory of 3040	1228	z2882788.exe	p8565578.exe
PID 1228 wrote to memory of 2384	1228	z2882788.exe	r4844943.exe
PID 1228 wrote to memory of 2384	1228	z2882788.exe	r4844943.exe
PID 1228 wrote to memory of 2384	1228	z2882788.exe	r4844943.exe

C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe
"C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4844943.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4844943.exe
    3⤵
    - Executes dropped EXE
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe

Filesize
206KB

MD5
6de9a950d4a4b7c0332b45a5bd235d01

SHA1
841af90b26f4db62c4b8f90e28338191a6a7f828

SHA256
3259015332b3c7d28f60d87021ad2c8774ee8fecdf700f3955e15f54889187a7

SHA512
5020589a686c79d44bd60222e57d114a395b06e9d2a57d29097c2666ec76a8312558593415f55017d066964c49abe9a45ebd738d761666d1b0d93f1bb1e6ba3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe

Filesize
14KB

MD5
96a788f0a5be814e86485a5a69530a9f

SHA1
2d3e089f1d1e6bcd963d905e4562b3f463795d85

SHA256
49cb26c4643b21f4e6b5ac16f17256db971437aa4ad718cf747ffe01449a8e34

SHA512
d2f13b86e881b2663e32b77cdc3323c971a42737295766ad575bad1fbc21bf8e7c358e87145acbd092dace56b56c7c76203580b4cdf91afb0346b22cb00ecc0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4844943.exe

Filesize
173KB

MD5
672fb4244fd74cff542f35696bd45875

SHA1
d1849efc41f2d286b13d036ef60417c318caf583

SHA256
b6f9f1e64fdbb0df744bf834291c6fc891188daf93e5630537498cf9c44141a6

SHA512
33b1dc400c253744c08c4506ed95e1d8518e67508e4bd6a5a73cceac4b3c628ec001c20e415b0b1d85764cafb3306b9332f3ac2a046a690d7941ecfdadc1bef5

Download Submit
memory/2384-20-0x0000000000F00000-0x0000000000F30000-memory.dmp

Filesize
192KB

Download
memory/2384-21-0x00000000031B0000-0x00000000031B6000-memory.dmp

Filesize
24KB

Download
memory/2384-22-0x000000000B340000-0x000000000B958000-memory.dmp

Filesize
6.1MB

Download
memory/2384-23-0x000000000AEB0000-0x000000000AFBA000-memory.dmp

Filesize
1.0MB

Download
memory/2384-24-0x000000000ADF0000-0x000000000AE02000-memory.dmp

Filesize
72KB

Download
memory/2384-25-0x000000000AE50000-0x000000000AE8C000-memory.dmp

Filesize
240KB

Download
memory/2384-26-0x00000000051F0000-0x000000000523C000-memory.dmp

Filesize
304KB

Download
memory/3040-14-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/3040-15-0x00007FF8EDAB3000-0x00007FF8EDAB5000-memory.dmp

Filesize
8KB

Download