healer | f66854431dc57070e060e776be18cba0992366fab22b71f8cf929b91c81a6c26

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe
Size

919KB
MD5

393d6bd3d722abd31114cf500a6d31f5
SHA1

027ab7af8553f0a73e95d6c9c8ddeb0e12af8965
SHA256

f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa
SHA512

d97c315bd1aadb8f209099532d1d84265c305b7a0217dbbc172104c34be32d6a17d3473cfd89a44985d639e3e14bc723a3726b44fb857ab45120fc13feeac903
SSDEEP

24576:fyp+BYZ6J6nTHME00k7UjgA69JsKL0AI6bnscKUph5E:qpZsJAH87UjOHaonsrUP5

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral25/memory/3776-28-0x00000000005A0000-0x00000000005DE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k6678803.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6678803.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6678803.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6678803.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral25/memory/1952-35-0x00000000006B0000-0x000000000073C000-memory.dmp	family_redline
behavioral25/memory/1952-42-0x00000000006B0000-0x000000000073C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y6713790.exey9691614.exek6678803.exel0593874.exe

pid process

1776 y6713790.exe
232 y9691614.exe
3776 k6678803.exe
1952 l0593874.exe

pid	process
1776	y6713790.exe
232	y9691614.exe
3776	k6678803.exe
1952	l0593874.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k6678803.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6678803.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6678803.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

y6713790.exey9691614.exef0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y6713790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y9691614.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k6678803.exe

pid process

3776 k6678803.exe
3776 k6678803.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k6678803.exe

description pid process

Token: SeDebugPrivilege 3776 k6678803.exe

pid	process
3776	k6678803.exe
3776	k6678803.exe

description	pid	process
Token: SeDebugPrivilege	3776	k6678803.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exey6713790.exey9691614.exe

description	pid	process	target process
PID 3096 wrote to memory of 1776	3096	f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe	y6713790.exe
PID 3096 wrote to memory of 1776	3096	f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe	y6713790.exe
PID 3096 wrote to memory of 1776	3096	f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe	y6713790.exe
PID 1776 wrote to memory of 232	1776	y6713790.exe	y9691614.exe
PID 1776 wrote to memory of 232	1776	y6713790.exe	y9691614.exe
PID 1776 wrote to memory of 232	1776	y6713790.exe	y9691614.exe
PID 232 wrote to memory of 3776	232	y9691614.exe	k6678803.exe
PID 232 wrote to memory of 3776	232	y9691614.exe	k6678803.exe
PID 232 wrote to memory of 3776	232	y9691614.exe	k6678803.exe
PID 232 wrote to memory of 1952	232	y9691614.exe	l0593874.exe
PID 232 wrote to memory of 1952	232	y9691614.exe	l0593874.exe
PID 232 wrote to memory of 1952	232	y9691614.exe	l0593874.exe

C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe
"C:\Users\Admin\AppData\Local\Temp\f0d33c78b4822415ef8b626889ef19e5538cc85e78b11afdd7a1e3aa9b84b8aa.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe
      4⤵
      Executes dropped EXE
      PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6713790.exe

Filesize
763KB

MD5
9cc9c916490c135defcc592f1f2a5374

SHA1
03f2aea5009ab3e5f8d2880b3904aa41de9fe537

SHA256
74a89129e242e5cf7c5332b993cad847e3f6edbf85df58c21f3efbb9b5269f23

SHA512
7e6132ce2d2b733287a767a963b57c0879ebc9b41e4a97c4a2f9bc9f5c8b4cc663ac3d25702516e2b8d0028091787f76e23d27a36f43726c9d0dd4946f68e684

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9691614.exe

Filesize
580KB

MD5
c5a850b9ed6a570f1369475362bbe02a

SHA1
b9bd9921109dee417ffae88e63f05f046d91aabe

SHA256
177f07125221507dd30a4895acaacc482b8deb8a39d3b93660e1d21a3a8788b5

SHA512
9c15b8d3bae0a746dd0bd6f8644f41bbadec9f3a8c7bd5d092d03d04daf3d8f11fb6bd841171d287d652fb94677fbf131031330ebf27d19a559550d059403436

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6678803.exe

Filesize
291KB

MD5
1950f38d40bcb31bcd36050781382251

SHA1
88757c97fccc4654d94f84effaa208190f456316

SHA256
567eb24dd7ab2978dfb9b2fd429db5689c4ec354f001a061fb37537384e5b9ec

SHA512
1af275f1119e06b030b96d34628a19f370b16dec4c996fa0451292b217b3535061a2a66c752437b9e77b9788ef66864a23fc997bc155897a98f01bbc35a66fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l0593874.exe

Filesize
492KB

MD5
f543fa9e3d44db6851ca3a1af6a094c2

SHA1
4aa6879c80ef145d11f95810c41b7c5733e81f7a

SHA256
408ef900484b44fb7d41ebe3c3a8c06ce8f13cfc791803374666b15847272736

SHA512
efda8c364c056a0b12ac94f3606f9f93bfc6325378e57f148ae3b400cb6a31774705d083fb9ffa739c2b8c7441aba58c03481202e9df63fc14cb1fcd9aac0aa6

Download Submit
memory/1952-45-0x0000000005000000-0x0000000005618000-memory.dmp

Filesize
6.1MB

Download
memory/1952-35-0x00000000006B0000-0x000000000073C000-memory.dmp

Filesize
560KB

Download
memory/1952-42-0x00000000006B0000-0x000000000073C000-memory.dmp

Filesize
560KB

Download
memory/1952-44-0x0000000004360000-0x0000000004366000-memory.dmp

Filesize
24KB

Download
memory/1952-46-0x0000000004A70000-0x0000000004B7A000-memory.dmp

Filesize
1.0MB

Download
memory/1952-47-0x0000000004BA0000-0x0000000004BB2000-memory.dmp

Filesize
72KB

Download
memory/1952-48-0x0000000004BC0000-0x0000000004BFC000-memory.dmp

Filesize
240KB

Download
memory/1952-49-0x0000000004C30000-0x0000000004C7C000-memory.dmp

Filesize
304KB

Download
memory/3776-29-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3776-28-0x00000000005A0000-0x00000000005DE000-memory.dmp

Filesize
248KB

Download
memory/3776-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3776-21-0x00000000005A0000-0x00000000005DE000-memory.dmp

Filesize
248KB

Download