healer | 19ef966a051fb80a7e9a4c226171784888184c9e12f75a8cc5d88da9ecab375f

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe
Size

307KB
MD5

c3144993ffb5e02297c6ff3f4819def7
SHA1

4c89bd13f54211cef5a2d4c7588f4aa133206b6e
SHA256

42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd
SHA512

3d308a292866753ae68de637f1389d221df569416844a813729477adfa46b37739aebf6df3a9d1f0dcafe895efa6d273b855073bfa0e97869265b522c69557dc
SSDEEP

6144:KUy+bnr+7p0yN90QEF5F5OYc1u31g4TBy+1y9Pb6I:sMr7y90Rxc1u31TTEpb6I

Score

10^/10

healer redline dumud dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral10/memory/2216-8-0x0000000002460000-0x000000000247A000-memory.dmp	healer
behavioral10/memory/2216-11-0x0000000004990000-0x00000000049A8000-memory.dmp	healer
behavioral10/memory/2216-21-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-25-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-39-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-37-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-35-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-33-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-31-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-29-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-27-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-23-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-13-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-12-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-19-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-17-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral10/memory/2216-15-0x0000000004990000-0x00000000049A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k4453002.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k4453002.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4453002.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4453002.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4453002.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4453002.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4453002.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l8075849.exe	family_redline
behavioral10/memory/3384-47-0x00000000004B0000-0x00000000004E0000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

k4453002.exel8075849.exe

pid process

2216 k4453002.exe
3384 l8075849.exe

pid	process
2216	k4453002.exe
3384	l8075849.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k4453002.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k4453002.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4453002.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k4453002.exe

pid process

2216 k4453002.exe
2216 k4453002.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k4453002.exe

description pid process

Token: SeDebugPrivilege 2216 k4453002.exe

pid	process
2216	k4453002.exe
2216	k4453002.exe

description	pid	process
Token: SeDebugPrivilege	2216	k4453002.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe

description	pid	process	target process
PID 2232 wrote to memory of 2216	2232	42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe	k4453002.exe
PID 2232 wrote to memory of 2216	2232	42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe	k4453002.exe
PID 2232 wrote to memory of 2216	2232	42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe	k4453002.exe
PID 2232 wrote to memory of 3384	2232	42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe	l8075849.exe
PID 2232 wrote to memory of 3384	2232	42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe	l8075849.exe
PID 2232 wrote to memory of 3384	2232	42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe	l8075849.exe

C:\Users\Admin\AppData\Local\Temp\42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe
"C:\Users\Admin\AppData\Local\Temp\42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k4453002.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k4453002.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l8075849.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l8075849.exe
  2⤵
  - Executes dropped EXE
  PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k4453002.exe

Filesize
180KB

MD5
fcb45dce2700145c4fe0fa07e5f6630b

SHA1
036f1eacbad20f783b40fcbb027eeec7e0f03fed

SHA256
b38442d44a13e5767ce54ce7fdf600e9c102ec2b00d8af9479b873ab5e568644

SHA512
4ba6f2aa7351fb5b8194d8984f07ae52e0ded0e1ed440a8540934f20f1b2927165185100e855c50a5f0a0ed764298f2403d2ef88c27a162f915a3ebd4a78df04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l8075849.exe

Filesize
168KB

MD5
1f0ba19b282e4f97a08b0d5cd9c0ec9a

SHA1
02450723fbf3d8f43be3b18b607ec650bae2f331

SHA256
386f8ff028bbde9ddbbb781046300013450965fb02c5f3d2352ea23948f85ffe

SHA512
46a380235e97ca6cb2fa7e990c263a9d4c4d5a4123c380a36af509d813a863f445a6b8bde3a6d53265d86f751ffdc15449418c985430005e566d823f89d5e377

Download Submit
memory/2216-40-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/2216-39-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-10-0x0000000004A20000-0x0000000004FC4000-memory.dmp

Filesize
5.6MB

Download
memory/2216-12-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-21-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-25-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-8-0x0000000002460000-0x000000000247A000-memory.dmp

Filesize
104KB

Download
memory/2216-19-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-37-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-35-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-33-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-31-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-29-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-17-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-23-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-13-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-11-0x0000000004990000-0x00000000049A8000-memory.dmp

Filesize
96KB

Download
memory/2216-9-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/2216-27-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-15-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2216-41-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/2216-43-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/2216-7-0x000000007487E000-0x000000007487F000-memory.dmp

Filesize
4KB

Download
memory/3384-48-0x0000000074820000-0x00000000748CB000-memory.dmp

Filesize
684KB

Download
memory/3384-47-0x00000000004B0000-0x00000000004E0000-memory.dmp

Filesize
192KB

Download
memory/3384-49-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/3384-50-0x0000000005510000-0x0000000005B28000-memory.dmp

Filesize
6.1MB

Download
memory/3384-51-0x0000000005000000-0x000000000510A000-memory.dmp

Filesize
1.0MB

Download
memory/3384-52-0x0000000004D20000-0x0000000004D32000-memory.dmp

Filesize
72KB

Download
memory/3384-53-0x0000000074820000-0x00000000748CB000-memory.dmp

Filesize
684KB

Download
memory/3384-54-0x0000000004D80000-0x0000000004DBC000-memory.dmp

Filesize
240KB

Download
memory/3384-55-0x0000000004EF0000-0x0000000004F3C000-memory.dmp

Filesize
304KB

Download
memory/3384-56-0x0000000074820000-0x00000000748CB000-memory.dmp

Filesize
684KB

Download