healer | e26fabd2c7ff2793a03e50751c6b5c5606cd0dcc9f0fbec237db01080085c327

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
Size

1.0MB
MD5

f4c9a2e04bf7425f92b4dfa743985d4b
SHA1

ecc8cafe83d4ce841894c78a6add9841174738ef
SHA256

855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc
SHA512

cc22e3244b1e9a5373777dd645b864761963fc34ebaa09338a6cf16f0240de7b6d073203ebc70a45cfb0f41b23bfe6f60adc2322f1bc71f3bf92b9ac40872d68
SSDEEP

12288:pMrXy90AnEbF79w5lfUQYeJ+CMGNfrZlcROl1Eh3CkczpbZ7wyYirGZUq0dTlpLx:iyUZ5wTf/IGhPc8lUspb+g2U/Tlpv5

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral21/memory/2464-34-0x0000000000570000-0x00000000005AE000-memory.dmp	healer
behavioral21/files/0x000700000002341f-39.dat	healer
behavioral21/memory/2188-41-0x0000000000030000-0x000000000003A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b2368708.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0032343.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b2368708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b2368708.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral21/memory/4336-46-0x0000000001FD0000-0x000000000205C000-memory.dmp	family_redline
behavioral21/memory/4336-53-0x0000000001FD0000-0x000000000205C000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
5108	v0623685.exe
2612	v6604025.exe
2904	v5043356.exe
2464	a0032343.exe
2188	b2368708.exe
4336	c0999172.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0032343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b2368708.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v6604025.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5043356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0623685.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2464	a0032343.exe
2464	a0032343.exe
2188	b2368708.exe
2188	b2368708.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	a0032343.exe
Token: SeDebugPrivilege	2188	b2368708.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 5108	3608	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe	85
PID 3608 wrote to memory of 5108	3608	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe	85
PID 3608 wrote to memory of 5108	3608	855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe	85
PID 5108 wrote to memory of 2612	5108	v0623685.exe	87
PID 5108 wrote to memory of 2612	5108	v0623685.exe	87
PID 5108 wrote to memory of 2612	5108	v0623685.exe	87
PID 2612 wrote to memory of 2904	2612	v6604025.exe	88
PID 2612 wrote to memory of 2904	2612	v6604025.exe	88
PID 2612 wrote to memory of 2904	2612	v6604025.exe	88
PID 2904 wrote to memory of 2464	2904	v5043356.exe	90
PID 2904 wrote to memory of 2464	2904	v5043356.exe	90
PID 2904 wrote to memory of 2464	2904	v5043356.exe	90
PID 2904 wrote to memory of 2188	2904	v5043356.exe	95
PID 2904 wrote to memory of 2188	2904	v5043356.exe	95
PID 2612 wrote to memory of 4336	2612	v6604025.exe	96
PID 2612 wrote to memory of 4336	2612	v6604025.exe	96
PID 2612 wrote to memory of 4336	2612	v6604025.exe	96

C:\Users\Admin\AppData\Local\Temp\855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe
"C:\Users\Admin\AppData\Local\Temp\855fd4cf224283ecfadcbbde8f8bda52096a389946f6890fa83b09e26cea10dc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0623685.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0623685.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6604025.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6604025.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5043356.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5043356.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0032343.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0032343.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2368708.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2368708.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0999172.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0999172.exe
      4⤵
      Executes dropped EXE
      PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0623685.exe

Filesize
907KB

MD5
2949202165b6aecdfd7e1e166f80d67a

SHA1
d08399d23ffd9a7c571b8bda32fa8ffd09b9fa60

SHA256
a676d5a21bfadd0b38cd8ddcf76a3479124fe0c4ef736250f92a0a1546b0ccb3

SHA512
86e6109c16830b120a09e0e3541eb206b0b2ddf72f054d49d0acf70693c037fabfcda19508fb649e7e933908ecdae0337b08e7c50445a37661dcb76b7de9f7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6604025.exe

Filesize
723KB

MD5
aa1b077e92994d4619dd12f4431e34a5

SHA1
20b6a5c758cea0abc5dc43e3d1d8c166c9b353a9

SHA256
f56122328c5bb8b64bdcd06bba1b5b089c40b22825bd055cfdf92c122ab89a58

SHA512
d5ca518c627ae14527164577423420f142cad57966cbf17d5f5fd6be3fe6e4170ba6b0689f59b391c4e1b1ed7f7fa0237a77999ca0089d3ce9b359f3fdd224a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c0999172.exe

Filesize
488KB

MD5
c8c493f1b16661e67a8976070733fb54

SHA1
e5a1683c7a9f7512f60d2fe23893bd14f1d5898c

SHA256
be3c79a550fa52255e4b0f967435c062477a5688033fc406957f5578ac4a805f

SHA512
80d057a9fc41f56db405c8ca09e852cb38a8097c57e14254cc9c073e11dcf8d7fcfda7cd33eaa5d3e006573a3fd8c0c8319046565acac0aba123dbd73b53d9b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5043356.exe

Filesize
327KB

MD5
901ce7880098ea823a81879f4d2bb6d9

SHA1
fef9b652a92a1dda10f92c2fce99260b54c3871f

SHA256
460617077eaaebdd0558c7265eeb5ccbdf3f53b416f54f93dad7e9b86355ab99

SHA512
bd2bdb5bcf4b426f541339a8e213b3567fc6d1cd1e353a25d720544c4710e23b943d858c467c40a0c646b336b7c5650929104d6d205ffd7bfcc8cb311645d894

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a0032343.exe

Filesize
295KB

MD5
f94bc8402c5e820366a69973818d25dd

SHA1
4c22bf9ed48c43ce113edc70e4cb5b99c0e4b9d1

SHA256
100fc01463a6ef234d70787403043df49187b0d0f2efe3416f866e17e6d0c690

SHA512
ef2d04b69b8cf6767ece0611ff14a082f4b8faf7190de6fadc11cedacfca65095f502b7ce9771280e0e331e0f9729152b8034a23a562c422ac6886463c0e2fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2368708.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/2188-41-0x0000000000030000-0x000000000003A000-memory.dmp

Filesize
40KB

Download
memory/2464-28-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download
memory/2464-35-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2464-34-0x0000000000570000-0x00000000005AE000-memory.dmp

Filesize
248KB

Download
memory/4336-46-0x0000000001FD0000-0x000000000205C000-memory.dmp

Filesize
560KB

Download
memory/4336-53-0x0000000001FD0000-0x000000000205C000-memory.dmp

Filesize
560KB

Download
memory/4336-55-0x00000000023B0000-0x00000000023B6000-memory.dmp

Filesize
24KB

Download
memory/4336-56-0x000000000AC40000-0x000000000B258000-memory.dmp

Filesize
6.1MB

Download
memory/4336-57-0x0000000005E30000-0x0000000005F3A000-memory.dmp

Filesize
1.0MB

Download
memory/4336-58-0x0000000005F60000-0x0000000005F72000-memory.dmp

Filesize
72KB

Download
memory/4336-59-0x0000000005F80000-0x0000000005FBC000-memory.dmp

Filesize
240KB

Download
memory/4336-60-0x0000000005FF0000-0x000000000603C000-memory.dmp

Filesize
304KB

Download