healer | 19ffc101f7c4457a5adb66b38ce5823d52f596b323578de48d3585b1b57d24c6

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe
Size

919KB
MD5

355a3e838e20ebfddb67e880ffd84eb4
SHA1

ec544c366ec75c9072f5aaba66e80d04b59f70e9
SHA256

57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b
SHA512

8a276fe0dce212cd0b4f6646d469be82d9f3ca2728d83f7583a11400158b71175df6749c2a47365f5e797f03984cd46720001de50542178f21080863ed5e3a84
SSDEEP

24576:wy1vtFUxX9ePZlAVZDRr/jXZOnQ0/RlSUP:31vtajegVzLkQSlSU

Score

10^/10

healer redline lamp dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral9/memory/3484-28-0x0000000000570000-0x00000000005AE000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k6558214.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6558214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6558214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6558214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6558214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6558214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6558214.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral9/memory/3420-35-0x00000000005F0000-0x000000000067C000-memory.dmp	family_redline
behavioral9/memory/3420-42-0x00000000005F0000-0x000000000067C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y4307971.exey9141097.exek6558214.exel7878487.exe

pid process

3908 y4307971.exe
4592 y9141097.exe
3484 k6558214.exe
3420 l7878487.exe

pid	process
3908	y4307971.exe
4592	y9141097.exe
3484	k6558214.exe
3420	l7878487.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k6558214.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6558214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6558214.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exey4307971.exey9141097.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4307971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y9141097.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k6558214.exe

pid process

3484 k6558214.exe
3484 k6558214.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k6558214.exe

description pid process

Token: SeDebugPrivilege 3484 k6558214.exe

pid	process
3484	k6558214.exe
3484	k6558214.exe

description	pid	process
Token: SeDebugPrivilege	3484	k6558214.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exey4307971.exey9141097.exe

description	pid	process	target process
PID 2800 wrote to memory of 3908	2800	57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe	y4307971.exe
PID 2800 wrote to memory of 3908	2800	57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe	y4307971.exe
PID 2800 wrote to memory of 3908	2800	57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe	y4307971.exe
PID 3908 wrote to memory of 4592	3908	y4307971.exe	y9141097.exe
PID 3908 wrote to memory of 4592	3908	y4307971.exe	y9141097.exe
PID 3908 wrote to memory of 4592	3908	y4307971.exe	y9141097.exe
PID 4592 wrote to memory of 3484	4592	y9141097.exe	k6558214.exe
PID 4592 wrote to memory of 3484	4592	y9141097.exe	k6558214.exe
PID 4592 wrote to memory of 3484	4592	y9141097.exe	k6558214.exe
PID 4592 wrote to memory of 3420	4592	y9141097.exe	l7878487.exe
PID 4592 wrote to memory of 3420	4592	y9141097.exe	l7878487.exe
PID 4592 wrote to memory of 3420	4592	y9141097.exe	l7878487.exe

C:\Users\Admin\AppData\Local\Temp\57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe
"C:\Users\Admin\AppData\Local\Temp\57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4307971.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4307971.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3908

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9141097.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9141097.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4592

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6558214.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6558214.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7878487.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7878487.exe
4⤵
- Executes dropped EXE
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4292,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
1⤵
PID:3128

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4307971.exe
Filesize
763KB

MD5
c8a77dffd9d87c0866f0ac5336855685

SHA1
e68b68aa0df9b7ad0df3d01adc86e0244b584fa1

SHA256
8124210a5d5500790e9735d9ec035f223cd885dbd517147a6e24e4c0aed88a5d

SHA512
5b7220b6a9fb3f27c94836e1130b073ed4fc2a0a3b3e0c732b384fc643160082b36d72866672374efced71c83f97609e03be9798703d5edf3ae223beed905d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9141097.exe
Filesize
580KB

MD5
58ea9399008bea3afd88a40339ffe4e1

SHA1
34fd068ba9ae6e5f99b14504fccaa8c5e1c26577

SHA256
3765865c4cd3f11bf047d32977cdc0385f16a21de3d1493f00e37b62f84d273f

SHA512
c79839518e965827b020d17712a87da33e0e446f33165cf30c10b6b2477ddb5939d96bcc88943226c81ec139eeb22970307faab80d3c381e52f202480cf8467b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k6558214.exe
Filesize
294KB

MD5
a4c5fd6966121a07dc45f19776a4f965

SHA1
0138a8217cd66853725ee2f10367627b72e3ddf3

SHA256
ffc0c05033914fe61ac8b89a46734ac62e7655393e7eff9f4f31e6ab9a19ee50

SHA512
b89e1aed6a9b6d845e8b1d5b9a49aa596882c66ad04de685773300e2af7115621fd0f0f6fb9f65b237b8608be5687f80d0ffd4cc73cace7c50a8a7c20aa5e5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7878487.exe
Filesize
488KB

MD5
14d5ba6849d149a28734d46e6f3b8380

SHA1
0330609728df56e9e52d89233054d5b4d93dd10d

SHA256
4baf5f777c4d56e38a146f9cdf886e489bc6efe5f6d8c13eec892cd20aefcac1

SHA512
259c007cbf981b40b6f334407ca7100a71ae0897a4e07b2aed252401fb6530e5bddfae6fa160a1df341d6582f5835a9abbefb184b64315f9022c07679759c07a

Download Submit
memory/3420-45-0x0000000006E30000-0x0000000007448000-memory.dmp

Filesize
6.1MB

Download
memory/3420-35-0x00000000005F0000-0x000000000067C000-memory.dmp

Filesize
560KB

Download
memory/3420-42-0x00000000005F0000-0x000000000067C000-memory.dmp

Filesize
560KB

Download
memory/3420-44-0x00000000022F0000-0x00000000022F6000-memory.dmp

Filesize
24KB

Download
memory/3420-46-0x0000000006CD0000-0x0000000006DDA000-memory.dmp

Filesize
1.0MB

Download
memory/3420-47-0x0000000006E00000-0x0000000006E12000-memory.dmp

Filesize
72KB

Download
memory/3420-48-0x0000000007450000-0x000000000748C000-memory.dmp

Filesize
240KB

Download
memory/3420-49-0x0000000005A00000-0x0000000005A4C000-memory.dmp

Filesize
304KB

Download
memory/3484-29-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/3484-28-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download
memory/3484-21-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3484-22-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download