healer | f66854431dc57070e060e776be18cba0992366fab22b71f8cf929b91c81a6c26

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exe
Size

919KB
MD5

3798d7397297e366a26153993de02af0
SHA1

ddedf24c83ae1c4a0e7baf2cdfe59463a10b56da
SHA256

5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01
SHA512

077211deb71636df685b3cf02350989fa49e76787dbbd88ae220c6bcb16cded5f1cbf734b76c4ccfdd77a6ae138c045f9f49b51b57195f7829a74e72472de557
SSDEEP

24576:Jy8rhw3n0b6BVnDlL2dEl/W0gJUku6tREpqM:886kb6HD12dEFWtJUb6tREpq

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral14/memory/2828-28-0x0000000000690000-0x00000000006CE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k5452403.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k5452403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5452403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5452403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5452403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5452403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5452403.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral14/memory/1500-36-0x00000000004E0000-0x000000000056C000-memory.dmp	family_redline
behavioral14/memory/1500-42-0x00000000004E0000-0x000000000056C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y6030413.exey5007650.exek5452403.exel4137723.exe

pid process

2740 y6030413.exe
2932 y5007650.exe
2828 k5452403.exe
1500 l4137723.exe

pid	process
2740	y6030413.exe
2932	y5007650.exe
2828	k5452403.exe
1500	l4137723.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k5452403.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k5452403.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5452403.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exey6030413.exey5007650.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6030413.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5007650.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k5452403.exe

pid process

2828 k5452403.exe
2828 k5452403.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k5452403.exe

description pid process

Token: SeDebugPrivilege 2828 k5452403.exe

pid	process
2828	k5452403.exe
2828	k5452403.exe

description	pid	process
Token: SeDebugPrivilege	2828	k5452403.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exey6030413.exey5007650.exe

description	pid	process	target process
PID 4440 wrote to memory of 2740	4440	5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exe	y6030413.exe
PID 4440 wrote to memory of 2740	4440	5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exe	y6030413.exe
PID 4440 wrote to memory of 2740	4440	5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exe	y6030413.exe
PID 2740 wrote to memory of 2932	2740	y6030413.exe	y5007650.exe
PID 2740 wrote to memory of 2932	2740	y6030413.exe	y5007650.exe
PID 2740 wrote to memory of 2932	2740	y6030413.exe	y5007650.exe
PID 2932 wrote to memory of 2828	2932	y5007650.exe	k5452403.exe
PID 2932 wrote to memory of 2828	2932	y5007650.exe	k5452403.exe
PID 2932 wrote to memory of 2828	2932	y5007650.exe	k5452403.exe
PID 2932 wrote to memory of 1500	2932	y5007650.exe	l4137723.exe
PID 2932 wrote to memory of 1500	2932	y5007650.exe	l4137723.exe
PID 2932 wrote to memory of 1500	2932	y5007650.exe	l4137723.exe

C:\Users\Admin\AppData\Local\Temp\5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exe
"C:\Users\Admin\AppData\Local\Temp\5eba1ca0e7f43344f323005e13fa132f591c4f904c89b0c249ed3226ebd05e01.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6030413.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6030413.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5007650.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5007650.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5452403.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5452403.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4137723.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4137723.exe
      4⤵
      Executes dropped EXE
      PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6030413.exe

Filesize
764KB

MD5
7f9d21b7661db0306b53d29c5e12bf9b

SHA1
7d69148eedd0976eebc53f6e393e581b26070cf4

SHA256
0256f5eae7c27f10238e40c23b16e84056e0ea4bee98288e40ce92cf4f397bd9

SHA512
faa45eeeb6ae08119981a005f9b7b0b1b71d141f7433352eb74552607f60ff8e7328d24746340395c88a3cc40792b3b6fb24547ac58caf722f0c7aec6a0c7025

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5007650.exe

Filesize
580KB

MD5
fd04c77c4f417d9c81b1e3627bb1ada9

SHA1
6989b30ca2c15692895bf4706eaf0d4cb4fe1197

SHA256
102fbe3b141b90be1384b4892e75c04703aa40489d82ad39e5dc71c99040c17f

SHA512
233aa19b4aecfd717679a580fb1feb2a574e7d866e4146c2ac1d54a1c6675431a8ffc59772f298ee53bb04b7c1c245e1d965d4e5b994508b8e7362aef974b6cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5452403.exe

Filesize
295KB

MD5
594f9ea1b0795a69b07dc3c3a79298bb

SHA1
1396d9d32a9d9ff11bd06e5a7168ef2ca67c93ea

SHA256
58e034fac189d7df06493eb7c3b4c7e983bff638dda2bfd3eb445a8b1ed34874

SHA512
d3aedcac0ac3e0764b2c701a7f7269a9c56119ecf5fc240f10fc8e920ff91a0533c58174042dfe375065db2e00979d6f3a0eadfeeb81fcab3b0c375859ddcac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4137723.exe

Filesize
489KB

MD5
17d5bd158552db313dbb6baa180c8473

SHA1
cbe14bf1767f5589b1923a0d4c1be1fd54292ae3

SHA256
d139a831bbd93c34c0a0e69bc443c5de93ba54dd39bfa4301cc6314d0e8d8352

SHA512
2f1a8c10ca00b75cdaa9255254988926390c48950f2e8dc85aaca875e9ca9d41c24797c76c584f750f51f072692f1c7dcec3e58a3825663a7a640b926a21d3f4

Download Submit
memory/1500-45-0x00000000049F0000-0x0000000005008000-memory.dmp

Filesize
6.1MB

Download
memory/1500-36-0x00000000004E0000-0x000000000056C000-memory.dmp

Filesize
560KB

Download
memory/1500-42-0x00000000004E0000-0x000000000056C000-memory.dmp

Filesize
560KB

Download
memory/1500-44-0x00000000023A0000-0x00000000023A6000-memory.dmp

Filesize
24KB

Download
memory/1500-46-0x00000000050A0000-0x00000000051AA000-memory.dmp

Filesize
1.0MB

Download
memory/1500-47-0x00000000051D0000-0x00000000051E2000-memory.dmp

Filesize
72KB

Download
memory/1500-48-0x00000000051F0000-0x000000000522C000-memory.dmp

Filesize
240KB

Download
memory/1500-49-0x0000000005260000-0x00000000052AC000-memory.dmp

Filesize
304KB

Download
memory/2828-29-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2828-28-0x0000000000690000-0x00000000006CE000-memory.dmp

Filesize
248KB

Download
memory/2828-22-0x0000000000690000-0x00000000006CE000-memory.dmp

Filesize
248KB

Download
memory/2828-21-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download