healer | c9e1bcbbab1fafcf8cc24760bccf3efac8e604baa1ea574dbe47e2dd7ac09433

Analysis

max time kernel
126s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe
Size

1.5MB
MD5

85e57bbbfa4b4a93b3389c480fac7189
SHA1

bd185ed9b704ae08c0fd652ca05ee3f3cbfccef5
SHA256

f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865
SHA512

10b7313ed100b1539cf8e4d6caaa996ee8185010d3d475c416b7be8e8f032514605bff766f5210d0921a96a9ad84730bf7583970949c9b62557b42db3d384238
SSDEEP

49152:pvUrKe4i6MP4mUJJq5ZuIISIxVa46ecL:W34rMP4fTq5ZuxxVJa

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral25/memory/4484-28-0x0000000000460000-0x000000000046A000-memory.dmp	healer
behavioral25/files/0x00070000000235b9-35.dat	healer
behavioral25/memory/888-37-0x00000000005A0000-0x00000000005AA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a7554329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7554329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b9106682.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b9106682.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7554329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7554329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7554329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7554329.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b9106682.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b9106682.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b9106682.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b9106682.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral25/memory/3628-42-0x0000000000490000-0x00000000004C0000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
3004	v7898097.exe
1672	v6574897.exe
1020	v1577867.exe
4484	a7554329.exe
888	b9106682.exe
3628	c8157648.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a7554329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7554329.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b9106682.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7898097.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6574897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v1577867.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4484	a7554329.exe
4484	a7554329.exe
888	b9106682.exe
888	b9106682.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	a7554329.exe
Token: SeDebugPrivilege	888	b9106682.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3004	228	f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe	90
PID 228 wrote to memory of 3004	228	f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe	90
PID 228 wrote to memory of 3004	228	f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe	90
PID 3004 wrote to memory of 1672	3004	v7898097.exe	92
PID 3004 wrote to memory of 1672	3004	v7898097.exe	92
PID 3004 wrote to memory of 1672	3004	v7898097.exe	92
PID 1672 wrote to memory of 1020	1672	v6574897.exe	93
PID 1672 wrote to memory of 1020	1672	v6574897.exe	93
PID 1672 wrote to memory of 1020	1672	v6574897.exe	93
PID 1020 wrote to memory of 4484	1020	v1577867.exe	95
PID 1020 wrote to memory of 4484	1020	v1577867.exe	95
PID 1020 wrote to memory of 4484	1020	v1577867.exe	95
PID 1020 wrote to memory of 888	1020	v1577867.exe	101
PID 1020 wrote to memory of 888	1020	v1577867.exe	101
PID 1672 wrote to memory of 3628	1672	v6574897.exe	102
PID 1672 wrote to memory of 3628	1672	v6574897.exe	102
PID 1672 wrote to memory of 3628	1672	v6574897.exe	102

C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe
"C:\Users\Admin\AppData\Local\Temp\f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe
      4⤵
      Executes dropped EXE
      PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:8
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7898097.exe

Filesize
1.4MB

MD5
5975b6e2c53907e72a35e89a69829c36

SHA1
bdeaf1c68fe28de49e2c923868060d4bb7d4dfd0

SHA256
bd3cb6e81880ffa0c32fb408d60ef9974e2b6ff06b13a928e9f69b459517457d

SHA512
6ddef808b8eb0a2db8a1b4db953fe6b92d653e2208660a27e0bf2be312da11f0261f3a5a7bc9364274b1c25c8b42544c5413b0fd0bd94ec27d7a7ee8f0fbb4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6574897.exe

Filesize
1.3MB

MD5
b3b5e12b2eb24482da326a731dc7d362

SHA1
e3d53b6262147ccb92342c2aab19286267c95e0d

SHA256
147a26be6100b3209d27a17a0c9915c9e88285e81a21f4a71ef39a44166b5570

SHA512
bee0b1e67b76719522a982e0a3c8a1e64240deb1586f94b6cf93ecc80573e3a9fddf4ab98e698545eddc74099ec9f074ead9991ca2dd7ac3a0a55e2ef55acd76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8157648.exe

Filesize
729KB

MD5
04620d9fe2a5325defb2976d91136961

SHA1
2d6093b077dc8c25a645040b4d293b81fcfd0515

SHA256
4428e22ca4b63c5c6ff73cbe6feb7516c02768a3ffa990398ca70ab87fad7fc9

SHA512
1f72eafbfffce0a1222ddb201b63f0d1dfd991f847d57d8847b2221cfe01e49307179533202ad6937f1685eae6170a3d6a1d0b91ac8853614ff3127a62905ac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1577867.exe

Filesize
638KB

MD5
36868cf42a0fa5357de5d91a49b02ec2

SHA1
826cfb70a23f86f8fa5887c346db91ddc5a81c05

SHA256
041152e94915786645759f52877ae1c2c8657d5e6576cd62de073bca45655978

SHA512
e5361aa1c45edb2400984a78577c1c7b0833ef110254d6e5748d92c6e2c64326c9c10a40912a95c271df1d65108712e24b74851c725849c77217fd95ce518583

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a7554329.exe

Filesize
568KB

MD5
f6f6c1d86e71979c2881590fd84e006f

SHA1
9fa7bb5ae2f4df1cc75792a9c88a4cc2a21d435a

SHA256
fac89f40c173b98d2c6b0955c4d8385b8aa3bb3e1b0e9c30238e71e05529a6f5

SHA512
22b6376d651d6ee4a36374931288e86cd986a3d10fb0800bdfbd421e88889ed664d295dd37d35647eb1c67349050147ef7c94bb18f921385e3e9c942b107473c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b9106682.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/888-37-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/3628-49-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

Filesize
1.0MB

Download
memory/3628-42-0x0000000000490000-0x00000000004C0000-memory.dmp

Filesize
192KB

Download
memory/3628-47-0x0000000002510000-0x0000000002516000-memory.dmp

Filesize
24KB

Download
memory/3628-48-0x000000000A470000-0x000000000AA88000-memory.dmp

Filesize
6.1MB

Download
memory/3628-50-0x000000000A020000-0x000000000A032000-memory.dmp

Filesize
72KB

Download
memory/3628-51-0x000000000A040000-0x000000000A07C000-memory.dmp

Filesize
240KB

Download
memory/3628-52-0x00000000022D0000-0x000000000231C000-memory.dmp

Filesize
304KB

Download
memory/4484-28-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download