healer | e26fabd2c7ff2793a03e50751c6b5c5606cd0dcc9f0fbec237db01080085c327

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
Size

1.0MB
MD5

f4c9a2e04bf7425f92b4dfa743985d4b
SHA1

ecc8cafe83d4ce841894c78a6add9841174738ef
SHA256

855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc
SHA512

cc22e3244b1e9a5373777dd645b864761963fc34ebaa09338a6cf16f0240de7b6d073203ebc70a45cfb0f41b23bfe6f60adc2322f1bc71f3bf92b9ac40872d68
SSDEEP

12288:pMrXy90AnEbF79w5lfUQYeJ+CMGNfrZlcROl1Eh3CkczpbZ7wyYirGZUq0dTlpLx:iyUZ5wTf/IGhPc8lUspb+g2U/Tlpv5

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral21/memory/2464-34-0x0000000000570000-0x00000000005AE000-memory.dmp	healer
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2368708.exe	healer
behavioral21/memory/2188-41-0x0000000000030000-0x000000000003A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

b2368708.exea0032343.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b2368708.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0032343.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b2368708.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral21/memory/4336-46-0x0000000001FD0000-0x000000000205C000-memory.dmp	family_redline
behavioral21/memory/4336-53-0x0000000001FD0000-0x000000000205C000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

v0623685.exev6604025.exev5043356.exea0032343.exeb2368708.exec0999172.exe

pid process

5108 v0623685.exe
2612 v6604025.exe
2904 v5043356.exe
2464 a0032343.exe
2188 b2368708.exe
4336 c0999172.exe

pid	process
5108	v0623685.exe
2612	v6604025.exe
2904	v5043356.exe
2464	a0032343.exe
2188	b2368708.exe
4336	c0999172.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a0032343.exeb2368708.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b2368708.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v6604025.exev5043356.exe855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exev0623685.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6604025.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5043356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0623685.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a0032343.exeb2368708.exe

pid process

2464 a0032343.exe
2464 a0032343.exe
2188 b2368708.exe
2188 b2368708.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a0032343.exeb2368708.exe

description pid process

Token: SeDebugPrivilege 2464 a0032343.exe
Token: SeDebugPrivilege 2188 b2368708.exe

pid	process
2464	a0032343.exe
2464	a0032343.exe
2188	b2368708.exe
2188	b2368708.exe

description	pid	process
Token: SeDebugPrivilege	2464	a0032343.exe
Token: SeDebugPrivilege	2188	b2368708.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exev0623685.exev6604025.exev5043356.exe

description	pid	process	target process
PID 3608 wrote to memory of 5108	3608	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe	v0623685.exe
PID 3608 wrote to memory of 5108	3608	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe	v0623685.exe
PID 3608 wrote to memory of 5108	3608	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe	v0623685.exe
PID 5108 wrote to memory of 2612	5108	v0623685.exe	v6604025.exe
PID 5108 wrote to memory of 2612	5108	v0623685.exe	v6604025.exe
PID 5108 wrote to memory of 2612	5108	v0623685.exe	v6604025.exe
PID 2612 wrote to memory of 2904	2612	v6604025.exe	v5043356.exe
PID 2612 wrote to memory of 2904	2612	v6604025.exe	v5043356.exe
PID 2612 wrote to memory of 2904	2612	v6604025.exe	v5043356.exe
PID 2904 wrote to memory of 2464	2904	v5043356.exe	a0032343.exe
PID 2904 wrote to memory of 2464	2904	v5043356.exe	a0032343.exe
PID 2904 wrote to memory of 2464	2904	v5043356.exe	a0032343.exe
PID 2904 wrote to memory of 2188	2904	v5043356.exe	b2368708.exe
PID 2904 wrote to memory of 2188	2904	v5043356.exe	b2368708.exe
PID 2612 wrote to memory of 4336	2612	v6604025.exe	c0999172.exe
PID 2612 wrote to memory of 4336	2612	v6604025.exe	c0999172.exe
PID 2612 wrote to memory of 4336	2612	v6604025.exe	c0999172.exe

C:\Users\Admin\AppData\Local\Temp\855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
"C:\Users\Admin\AppData\Local\Temp\855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3608

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0623685.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0623685.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5108

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6604025.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6604025.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2612

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5043356.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5043356.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0032343.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0032343.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2368708.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2368708.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0999172.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0999172.exe
4⤵
- Executes dropped EXE
PID:4336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0623685.exe
Filesize
907KB

MD5
2949202165b6aecdfd7e1e166f80d67a

SHA1
d08399d23ffd9a7c571b8bda32fa8ffd09b9fa60

SHA256
a676d5a21bfadd0b38cd8ddcf76a3479124fe0c4ef736250f92a0a1546b0ccb3

SHA512
86e6109c16830b120a09e0e3541eb206b0b2ddf72f054d49d0acf70693c037fabfcda19508fb649e7e933908ecdae0337b08e7c50445a37661dcb76b7de9f7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6604025.exe
Filesize
723KB

MD5
aa1b077e92994d4619dd12f4431e34a5

SHA1
20b6a5c758cea0abc5dc43e3d1d8c166c9b353a9

SHA256
f56122328c5bb8b64bdcd06bba1b5b089c40b22825bd055cfdf92c122ab89a58

SHA512
d5ca518c627ae14527164577423420f142cad57966cbf17d5f5fd6be3fe6e4170ba6b0689f59b391c4e1b1ed7f7fa0237a77999ca0089d3ce9b359f3fdd224a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0999172.exe
Filesize
488KB

MD5
c8c493f1b16661e67a8976070733fb54

SHA1
e5a1683c7a9f7512f60d2fe23893bd14f1d5898c

SHA256
be3c79a550fa52255e4b0f967435c062477a5688033fc406957f5578ac4a805f

SHA512
80d057a9fc41f56db405c8ca09e852cb38a8097c57e14254cc9c073e11dcf8d7fcfda7cd33eaa5d3e006573a3fd8c0c8319046565acac0aba123dbd73b53d9b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5043356.exe
Filesize
327KB

MD5
901ce7880098ea823a81879f4d2bb6d9

SHA1
fef9b652a92a1dda10f92c2fce99260b54c3871f

SHA256
460617077eaaebdd0558c7265eeb5ccbdf3f53b416f54f93dad7e9b86355ab99

SHA512
bd2bdb5bcf4b426f541339a8e213b3567fc6d1cd1e353a25d720544c4710e23b943d858c467c40a0c646b336b7c5650929104d6d205ffd7bfcc8cb311645d894

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0032343.exe
Filesize
295KB

MD5
f94bc8402c5e820366a69973818d25dd

SHA1
4c22bf9ed48c43ce113edc70e4cb5b99c0e4b9d1

SHA256
100fc01463a6ef234d70787403043df49187b0d0f2efe3416f866e17e6d0c690

SHA512
ef2d04b69b8cf6767ece0611ff14a082f4b8faf7190de6fadc11cedacfca65095f502b7ce9771280e0e331e0f9729152b8034a23a562c422ac6886463c0e2fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2368708.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/2188-41-0x0000000000030000-0x000000000003A000-memory.dmp

Filesize
40KB

Download
memory/2464-28-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download
memory/2464-35-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2464-34-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download
memory/4336-46-0x0000000001FD0000-0x000000000205C000-memory.dmp

Filesize
560KB

Download
memory/4336-53-0x0000000001FD0000-0x000000000205C000-memory.dmp

Filesize
560KB

Download
memory/4336-55-0x00000000023B0000-0x00000000023B6000-memory.dmp

Filesize
24KB

Download
memory/4336-56-0x000000000AC40000-0x000000000B258000-memory.dmp

Filesize
6.1MB

Download
memory/4336-57-0x0000000005E30000-0x0000000005F3A000-memory.dmp

Filesize
1.0MB

Download
memory/4336-58-0x0000000005F60000-0x0000000005F72000-memory.dmp

Filesize
72KB

Download
memory/4336-59-0x0000000005F80000-0x0000000005FBC000-memory.dmp

Filesize
240KB

Download
memory/4336-60-0x0000000005FF0000-0x000000000603C000-memory.dmp

Filesize
304KB

Download