healer | a33c889b1929e9442a2a49de188e05a8ddbddcb32a7231b7c362f6833a45d720

Analysis

max time kernel
131s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
Size

1.0MB
MD5

aa56dc80d4e82ae017ce150cf8fa48cc
SHA1

2a7ee36a1296e0438ef0e7a9ab41d8ff03496ec4
SHA256

2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad
SHA512

ce4c8441785c866d0bc9ab8a5c23bba8815fd8a1e30b9ab10ec6a36c6aaba2ebf70bf3c53a9515a52402014daf6e2b25542397fc498bb9a12ad11ee602769daf
SSDEEP

24576:XyaHBh7s7f2+6EFDn3Q521V2AJ56SANT0kAZJzgc:iahwfsEd3F1sAJ565gke

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral5/memory/4836-34-0x0000000000570000-0x00000000005AE000-memory.dmp	healer
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe	healer
behavioral5/memory/3364-41-0x0000000000480000-0x000000000048A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a2081936.exeb0494259.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2081936.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b0494259.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b0494259.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a2081936.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral5/memory/4948-46-0x0000000002010000-0x000000000209C000-memory.dmp	family_redline
behavioral5/memory/4948-53-0x0000000002010000-0x000000000209C000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

v6836019.exev6690351.exev8762757.exea2081936.exeb0494259.exec2096168.exe

pid process

4296 v6836019.exe
3096 v6690351.exe
64 v8762757.exe
4836 a2081936.exe
3364 b0494259.exe
4948 c2096168.exe

pid	process
4296	v6836019.exe
3096	v6690351.exe
64	v8762757.exe
4836	a2081936.exe
3364	b0494259.exe
4948	c2096168.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a2081936.exeb0494259.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2081936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b0494259.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exev6836019.exev6690351.exev8762757.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6836019.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6690351.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8762757.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a2081936.exeb0494259.exe

pid process

4836 a2081936.exe
4836 a2081936.exe
3364 b0494259.exe
3364 b0494259.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a2081936.exeb0494259.exe

description pid process

Token: SeDebugPrivilege 4836 a2081936.exe
Token: SeDebugPrivilege 3364 b0494259.exe

pid	process
4836	a2081936.exe
4836	a2081936.exe
3364	b0494259.exe
3364	b0494259.exe

description	pid	process
Token: SeDebugPrivilege	4836	a2081936.exe
Token: SeDebugPrivilege	3364	b0494259.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exev6836019.exev6690351.exev8762757.exe

description	pid	process	target process
PID 3988 wrote to memory of 4296	3988	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe	v6836019.exe
PID 3988 wrote to memory of 4296	3988	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe	v6836019.exe
PID 3988 wrote to memory of 4296	3988	2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe	v6836019.exe
PID 4296 wrote to memory of 3096	4296	v6836019.exe	v6690351.exe
PID 4296 wrote to memory of 3096	4296	v6836019.exe	v6690351.exe
PID 4296 wrote to memory of 3096	4296	v6836019.exe	v6690351.exe
PID 3096 wrote to memory of 64	3096	v6690351.exe	v8762757.exe
PID 3096 wrote to memory of 64	3096	v6690351.exe	v8762757.exe
PID 3096 wrote to memory of 64	3096	v6690351.exe	v8762757.exe
PID 64 wrote to memory of 4836	64	v8762757.exe	a2081936.exe
PID 64 wrote to memory of 4836	64	v8762757.exe	a2081936.exe
PID 64 wrote to memory of 4836	64	v8762757.exe	a2081936.exe
PID 64 wrote to memory of 3364	64	v8762757.exe	b0494259.exe
PID 64 wrote to memory of 3364	64	v8762757.exe	b0494259.exe
PID 3096 wrote to memory of 4948	3096	v6690351.exe	c2096168.exe
PID 3096 wrote to memory of 4948	3096	v6690351.exe	c2096168.exe
PID 3096 wrote to memory of 4948	3096	v6690351.exe	c2096168.exe

C:\Users\Admin\AppData\Local\Temp\2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
"C:\Users\Admin\AppData\Local\Temp\2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3988

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4296

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3096

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:64

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe
4⤵
- Executes dropped EXE
PID:4948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe
Filesize
908KB

MD5
25658f17325696a77fdc5dc5af300472

SHA1
0facd580ea7466701baf25ab3cd36945aea28b7d

SHA256
3c9d37c487d37aefab6c520534b2a76ee97ccb9d8dddc16b2220e3455f14344a

SHA512
1155d0d8b34cead480920efdc9220af31e82de4b7e843862163815d061da11e9457d34f16b2f55213728ef43f921ec0f363443fd4a8fe3488fea7612ae297c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe
Filesize
725KB

MD5
a2e96ecf6ba60ff964a2b0b60dde7e27

SHA1
501080ad7058cac17e373c9acbda786c3ff9bdac

SHA256
0e712b394b21d5676bde7625b698470e0f7011ae4897abdec1a4f89dfa8cf096

SHA512
93c3963b8488abb826601dc90e98733b1e29549494039df1cd1fb2c351f2374a24ea2e2d8c66eefa51d6ee6a1b0221432a42cfa00eac510da0aef33ed4544bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe
Filesize
492KB

MD5
d672c9ba43fa4ec7905376f48d1f5cbc

SHA1
e0c94e851acb35383c031780e03ea0861acf6dc8

SHA256
963945d65b9fa323b0825b650842d944de7c0d5ecbe7af4fe91097f1f6e42702

SHA512
551cd7811814302685a698d8a6d73e8ac2dbea66bac651bb2fc6457300d536529619bcb4973b072cedd88c08e96fae0f50abf39ca35e9bc09e38f48566c6bd53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe
Filesize
326KB

MD5
d5b0ccf141e399d25360a28d534df7f0

SHA1
ef15c7a65069cb727ffdb2232c6210d030b4fbfe

SHA256
0170edb4d68699bbc4babbafeada5ed5138206b0d06d736a1340a077256b3d30

SHA512
0ebdf9f7ff7adaa314abec6e2359d2e241c483be42b81aadc097dac13c70a5906ee6e4345579dece05a84373f47462f5f53aee6554e3a4abaf142a5a09c00e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe
Filesize
294KB

MD5
bdb5076d6b84394534265c87b725acd6

SHA1
be2336c83ca619167ef129bd699027e21fa187b1

SHA256
347e9d55c98bc84cef2d62c5e3ce982c9176bee6df41bdbc7d6f31f25744e198

SHA512
10404edb5540983006f3f50754d4babc0d6c35ce6315aff8ef6d3d7aa9e5bd5d9b52f3cb05374be7e317ca2a4ea74af6eec99c72335a5112a5f50c1c77ae1173

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/3364-41-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/4836-28-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download
memory/4836-35-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4836-34-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download
memory/4948-46-0x0000000002010000-0x000000000209C000-memory.dmp

Filesize
560KB

Download
memory/4948-53-0x0000000002010000-0x000000000209C000-memory.dmp

Filesize
560KB

Download
memory/4948-55-0x00000000022E0000-0x00000000022E6000-memory.dmp

Filesize
24KB

Download
memory/4948-56-0x00000000049E0000-0x0000000004FF8000-memory.dmp

Filesize
6.1MB

Download
memory/4948-57-0x0000000005070000-0x000000000517A000-memory.dmp

Filesize
1.0MB

Download
memory/4948-58-0x00000000051A0000-0x00000000051B2000-memory.dmp

Filesize
72KB

Download
memory/4948-59-0x00000000051C0000-0x00000000051FC000-memory.dmp

Filesize
240KB

Download
memory/4948-60-0x0000000005230000-0x000000000527C000-memory.dmp

Filesize
304KB

Download