healer | 19ef966a051fb80a7e9a4c226171784888184c9e12f75a8cc5d88da9ecab375f

Analysis

max time kernel
147s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe
Size

1.5MB
MD5

c30d6278694817d3cc99f6ff5265da74
SHA1

350567243f65ea38c3bcbc24fc93272e4e46217b
SHA256

9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6
SHA512

3963175ae52c90b743dbcc1b38220ab2abcc10916558053c1a6f13ac52ca426aec2394ddf5220f482c48ad9e08955704b4764289c26f50a45ee648297b5b4a89
SSDEEP

24576:cy51XtT3ttYzCJsw66AMLRzIdYiQceweiSKE70EpUSn6qY0I+mUNNqU:LHXdttB0uJKjQTkE73pBDY0I+JNg

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4885965.exe	healer
behavioral19/memory/1260-31-0x0000000000D30000-0x0000000000D3A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

b4885965.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b4885965.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b4885965.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b4885965.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b4885965.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b4885965.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b4885965.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral19/memory/2616-36-0x0000000000560000-0x0000000000590000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

v0809209.exev1099435.exev0510598.exea5518771.exeb4885965.exec3966287.exe

pid process

3160 v0809209.exe
1472 v1099435.exe
3112 v0510598.exe
3900 a5518771.exe
1260 b4885965.exe
2616 c3966287.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

b4885965.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b4885965.exe

pid	process
3160	v0809209.exe
1472	v1099435.exe
3112	v0510598.exe
3900	a5518771.exe
1260	b4885965.exe
2616	c3966287.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b4885965.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exev0809209.exev1099435.exev0510598.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0809209.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v1099435.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v0510598.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5044 3900 WerFault.exe a5518771.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b4885965.exe

pid process

1260 b4885965.exe
1260 b4885965.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b4885965.exe

description pid process

Token: SeDebugPrivilege 1260 b4885965.exe

pid	pid_target	process	target process
5044	3900	WerFault.exe	a5518771.exe

pid	process
1260	b4885965.exe
1260	b4885965.exe

description	pid	process
Token: SeDebugPrivilege	1260	b4885965.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exev0809209.exev1099435.exev0510598.exe

description	pid	process	target process
PID 224 wrote to memory of 3160	224	9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe	v0809209.exe
PID 224 wrote to memory of 3160	224	9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe	v0809209.exe
PID 224 wrote to memory of 3160	224	9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe	v0809209.exe
PID 3160 wrote to memory of 1472	3160	v0809209.exe	v1099435.exe
PID 3160 wrote to memory of 1472	3160	v0809209.exe	v1099435.exe
PID 3160 wrote to memory of 1472	3160	v0809209.exe	v1099435.exe
PID 1472 wrote to memory of 3112	1472	v1099435.exe	v0510598.exe
PID 1472 wrote to memory of 3112	1472	v1099435.exe	v0510598.exe
PID 1472 wrote to memory of 3112	1472	v1099435.exe	v0510598.exe
PID 3112 wrote to memory of 3900	3112	v0510598.exe	a5518771.exe
PID 3112 wrote to memory of 3900	3112	v0510598.exe	a5518771.exe
PID 3112 wrote to memory of 3900	3112	v0510598.exe	a5518771.exe
PID 3112 wrote to memory of 1260	3112	v0510598.exe	b4885965.exe
PID 3112 wrote to memory of 1260	3112	v0510598.exe	b4885965.exe
PID 1472 wrote to memory of 2616	1472	v1099435.exe	c3966287.exe
PID 1472 wrote to memory of 2616	1472	v1099435.exe	c3966287.exe
PID 1472 wrote to memory of 2616	1472	v1099435.exe	c3966287.exe

C:\Users\Admin\AppData\Local\Temp\9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe
"C:\Users\Admin\AppData\Local\Temp\9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0809209.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0809209.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1099435.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1099435.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0510598.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0510598.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5518771.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5518771.exe
        5⤵
        Executes dropped EXE
        
        PID:3900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 144
        6⤵
        Program crash
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4885965.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4885965.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3966287.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3966287.exe
      4⤵
      Executes dropped EXE
      PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3900 -ip 3900
1⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0809209.exe

Filesize
1.3MB

MD5
a92244203973af1812f49381b14a902a

SHA1
f5bdc79974c217a021f0d9012a601544e946f763

SHA256
7603008d5a851b3befb237728b98fc76030102f379347a6cd88bbec23583f2a0

SHA512
75bc89a223d2f8f4a0674ad3f1e029df42fb033c51c8b90f09f3f432627604b57ef242c732643074263aae4140c030cd4cd97c4e7aee1a361d36da60b3069ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1099435.exe

Filesize
1.2MB

MD5
9192984788a893edeac86d5fb067ab34

SHA1
e20f53493d3b625ba8f1c2b8153d26dc1175059c

SHA256
93f117f9dd33f1114ce1626b549cc0823b6342125a31e81e9e22452f642d7c58

SHA512
350c379bb9e31cb4ff377fc6e1b3d4eae11ef9caa186d934c21c3a2add5d15edd09cd8c3b9a5cc8e1a0454903e988d05532cad0960c8d8cf40c08160994f99c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3966287.exe

Filesize
691KB

MD5
4c9143c3f950b72f2448971bcb5452e1

SHA1
55b8baf47c93d620bde72bc1ddab2ee32bef5905

SHA256
253b28fb3f14e8414a1cdffc799bd7efc9a5ea53f41c6f6cf94e4013f74c0de2

SHA512
288612e05d1ca81aa6f6aba854338c3895ae1f542fda8875889794072b25a275ccfbb990de08b01a7fcf5d6c21936b55a1e642667a6641ec87206833f8ab7dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0510598.exe

Filesize
619KB

MD5
54ff5da31f5ef412b0e198160b928d68

SHA1
f77fd5ce8d037be655796970a0eed314d03e691b

SHA256
a35e4cc393acf400ff6c197cfac7194452200fcc2886ba67a6743a3a0551d974

SHA512
533d30e82cad234d77c0cff718aeafc5ca93e39ffbf57deade85f7f1af268a55397238c70387dfae63490e072ec88fb51b4d7a447666c3e82c1c5f865869e882

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5518771.exe

Filesize
530KB

MD5
d47f2b01b2f8cbd3c629d49b2f85498e

SHA1
347f6955974dd495e6e8e7fe3d997f34be85df35

SHA256
a6dfb808535da1106e77d70efd18b8d3d0cb738a36c2f503e66e0e942ce24a45

SHA512
939de0672550a516ea9b4c9601707d8c18e5722607fd8b1ce90e9995f27b76fd60918dd62ebfa2ad28cfd79804e4a630c35e06679dce7a402d391312e14642a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b4885965.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1260-31-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/2616-36-0x0000000000560000-0x0000000000590000-memory.dmp

Filesize
192KB

Download
memory/2616-40-0x0000000002470000-0x0000000002476000-memory.dmp

Filesize
24KB

Download
memory/2616-41-0x0000000009F90000-0x000000000A5A8000-memory.dmp

Filesize
6.1MB

Download
memory/2616-42-0x000000000A640000-0x000000000A74A000-memory.dmp

Filesize
1.0MB

Download
memory/2616-43-0x000000000A780000-0x000000000A792000-memory.dmp

Filesize
72KB

Download
memory/2616-44-0x000000000A7A0000-0x000000000A7DC000-memory.dmp

Filesize
240KB

Download
memory/2616-45-0x000000000A840000-0x000000000A88C000-memory.dmp

Filesize
304KB

Download