healer | 19ffc101f7c4457a5adb66b38ce5823d52f596b323578de48d3585b1b57d24c6

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe
Size

921KB
MD5

35d65edcad0eb94203a77b37f369a214
SHA1

a9a64846ed8c44b0969da1b8c912181b971c9cdc
SHA256

604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c
SHA512

eea9c8d65f52e27e98c3249409338052547695ce3670e7388367f42ef625b9b8e4fa336c5f9dd6b674bf051484ee80f0171407eed108484227d6f331b6c5fd29
SSDEEP

24576:iy3YGYGYjHIA33LkLpteVbKpX4SVkrh3:J3dYGYrI7p+G5Jk

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral10/memory/2892-28-0x0000000000580000-0x00000000005BE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k4297688.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4297688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4297688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4297688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4297688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4297688.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k4297688.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral10/memory/3224-35-0x0000000001F80000-0x000000000200C000-memory.dmp	family_redline
behavioral10/memory/3224-42-0x0000000001F80000-0x000000000200C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y3409986.exey6447107.exek4297688.exel4586877.exe

pid process

4320 y3409986.exe
116 y6447107.exe
2892 k4297688.exe
3224 l4586877.exe

pid	process
4320	y3409986.exe
116	y6447107.exe
2892	k4297688.exe
3224	l4586877.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k4297688.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k4297688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4297688.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exey3409986.exey6447107.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3409986.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y6447107.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k4297688.exe

pid process

2892 k4297688.exe
2892 k4297688.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k4297688.exe

description pid process

Token: SeDebugPrivilege 2892 k4297688.exe

pid	process
2892	k4297688.exe
2892	k4297688.exe

description	pid	process
Token: SeDebugPrivilege	2892	k4297688.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exey3409986.exey6447107.exe

description	pid	process	target process
PID 2376 wrote to memory of 4320	2376	604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe	y3409986.exe
PID 2376 wrote to memory of 4320	2376	604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe	y3409986.exe
PID 2376 wrote to memory of 4320	2376	604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe	y3409986.exe
PID 4320 wrote to memory of 116	4320	y3409986.exe	y6447107.exe
PID 4320 wrote to memory of 116	4320	y3409986.exe	y6447107.exe
PID 4320 wrote to memory of 116	4320	y3409986.exe	y6447107.exe
PID 116 wrote to memory of 2892	116	y6447107.exe	k4297688.exe
PID 116 wrote to memory of 2892	116	y6447107.exe	k4297688.exe
PID 116 wrote to memory of 2892	116	y6447107.exe	k4297688.exe
PID 116 wrote to memory of 3224	116	y6447107.exe	l4586877.exe
PID 116 wrote to memory of 3224	116	y6447107.exe	l4586877.exe
PID 116 wrote to memory of 3224	116	y6447107.exe	l4586877.exe

C:\Users\Admin\AppData\Local\Temp\604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe
"C:\Users\Admin\AppData\Local\Temp\604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3409986.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3409986.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6447107.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6447107.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:116

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4297688.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4297688.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4586877.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4586877.exe
4⤵
- Executes dropped EXE
PID:3224

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3409986.exe
Filesize
766KB

MD5
ee837058812fdc4680611e7f305af372

SHA1
75de988a25717a7abf0217066e029c69c80caeff

SHA256
dae60cd73f4d28e316901aa143bff9000e192489844ca4835cdaaae7f2775729

SHA512
e5b4e0b7da1bf69e7b714f90739f237c0f91ef3fb4f1ff816264387e8ebb9b8be10cab2f0f4d122d40f3b6c44e5fbead60f1193fc3f8101c37b3fc675950e51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6447107.exe
Filesize
583KB

MD5
c64b725b5b25746cdd266f0ee494e18a

SHA1
52366c32b7ec944ce876b50c741dcc8a714a27af

SHA256
254a40ec3befae5ed3476f369ea7d849ebcec380bbfd8792bed067460e8667cb

SHA512
84b3d8be12ea6813569de625c3659c625eac650c6d3f1082285fd3996677a3bd65bcb33277a0ae151e7b8768ff76e00bbaa0f238f611e3a1cfc4dcbb7d6a08ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4297688.exe
Filesize
295KB

MD5
eafd91b98e54b54571d9e5174bc6d23a

SHA1
d4951d0ad2e41acf36852102bab15c4a0243ca38

SHA256
6a4a62480905c1eb5f644b7a0e5c296327d718dc03f8a67075cfe2fc5c7d2323

SHA512
5ab2bdc986426374538d75bafb43473ea88699e85ddc10ae8da60781ca0467293251e99a2ad541e6203c4af4b87bf2e31da6a72171ae67dce72adc96cbf651cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l4586877.exe
Filesize
492KB

MD5
435db4d65a081557a0e21d726f45dff8

SHA1
305f795fda9d84b08838d18ccc15b5d25919c297

SHA256
2be020131b0302de2ba7d8654d6ae74c9b4eb68ec1434afa61a87067b6eb0548

SHA512
48cfbec1919fda33705a168381182352817d16432cae4ea4d2880276ed34a48ae82159c059279dd6d8b114eb79ae0d3358a5c8f660e1b1f664b710b3d75713cc

Download Submit
memory/2892-21-0x0000000000580000-0x00000000005BE000-memory.dmp

Filesize
248KB

Download
memory/2892-27-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2892-28-0x0000000000580000-0x00000000005BE000-memory.dmp

Filesize
248KB

Download
memory/2892-29-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/3224-35-0x0000000001F80000-0x000000000200C000-memory.dmp

Filesize
560KB

Download
memory/3224-42-0x0000000001F80000-0x000000000200C000-memory.dmp

Filesize
560KB

Download
memory/3224-44-0x00000000023A0000-0x00000000023A6000-memory.dmp

Filesize
24KB

Download
memory/3224-45-0x0000000008670000-0x0000000008C88000-memory.dmp

Filesize
6.1MB

Download
memory/3224-46-0x00000000080A0000-0x00000000081AA000-memory.dmp

Filesize
1.0MB

Download
memory/3224-47-0x00000000081D0000-0x00000000081E2000-memory.dmp

Filesize
72KB

Download
memory/3224-48-0x00000000081F0000-0x000000000822C000-memory.dmp

Filesize
240KB

Download
memory/3224-49-0x0000000008260000-0x00000000082AC000-memory.dmp

Filesize
304KB

Download