healer | dd49e60a45e3962b98b32d0ae9a1256ae1e60ba2b696a005fe221e32f96d996b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe
Size

864KB
MD5

ba371037effb3bc1fb01bb593a705272
SHA1

a557ecb6ba798abf36b6c691d19e50e03e2285df
SHA256

b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606
SHA512

373624c6d599275cd090fe584cb5ce26f3acabd2ed070623470764e5a43d875a6c0220bd36b056299773f3b8ff12cf19ce261ab7edd80661ad8d5c3b535a7556
SSDEEP

12288:yMrjy90R4n/HwA+x/tRDFjep/9fX7ZqpYM3b3GOfGsBuku78cKIyVUYFYZT5zd+O:Zy4k/HwVZWZqScasI778FIyTYZNsiF

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
behavioral19/memory/4316-14-0x0000000000500000-0x000000000050A000-memory.dmp	healer
behavioral19/memory/4316-19-0x0000000000400000-0x0000000000412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k2136327.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k2136327.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k2136327.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral19/memory/4576-25-0x0000000000510000-0x0000000000540000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

y8651279.exek2136327.exel5542130.exe

pid process

2452 y8651279.exe
4316 k2136327.exe
4576 l5542130.exe

pid	process
2452	y8651279.exe
4316	k2136327.exe
4576	l5542130.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

k2136327.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k2136327.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k2136327.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exey8651279.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8651279.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

k2136327.exe

pid process

4316 k2136327.exe
4316 k2136327.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

k2136327.exe

description pid process

Token: SeDebugPrivilege 4316 k2136327.exe

pid	process
4316	k2136327.exe
4316	k2136327.exe

description	pid	process
Token: SeDebugPrivilege	4316	k2136327.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exey8651279.exe

description	pid	process	target process
PID 2028 wrote to memory of 2452	2028	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe	y8651279.exe
PID 2028 wrote to memory of 2452	2028	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe	y8651279.exe
PID 2028 wrote to memory of 2452	2028	b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe	y8651279.exe
PID 2452 wrote to memory of 4316	2452	y8651279.exe	k2136327.exe
PID 2452 wrote to memory of 4316	2452	y8651279.exe	k2136327.exe
PID 2452 wrote to memory of 4316	2452	y8651279.exe	k2136327.exe
PID 2452 wrote to memory of 4576	2452	y8651279.exe	l5542130.exe
PID 2452 wrote to memory of 4576	2452	y8651279.exe	l5542130.exe
PID 2452 wrote to memory of 4576	2452	y8651279.exe	l5542130.exe

C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe
"C:\Users\Admin\AppData\Local\Temp\b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2452

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
3⤵
- Executes dropped EXE
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8651279.exe
Filesize
681KB

MD5
2fa0b20366653721bfd1f84d5b98b444

SHA1
c773631701fe88e4005f677f6c1ef79214e86b67

SHA256
fc2efa5d597bb9ee814cf60cad1a3bd950f888f9872e9eb0641122d6970f1b4e

SHA512
55c6446678428d769252290284b4fb7e8754e2bea6eec83aa69c89265d73bbadd5960ccb4a3fcc72814adfe3ba9210695047d20fde33db059896cb8dd8f36b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2136327.exe
Filesize
530KB

MD5
d34061162711706e5dd2ab26f14dcb48

SHA1
6d82cb68928bdff681abb7d57e189134b423cbb9

SHA256
d9acdfeecdcc8d68575f0b12776b8de817879244b722cbfce99bebee466e058a

SHA512
030b52f1fdf8e23d5928804f83b885eef245c4997bfde8cf84f553b17495c5e2480c0586f646c93fa229c1dde281d296e766880bf7a13efd70ba0fe8d4273379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
Filesize
576KB

MD5
0f1e11302e0ad1cb095b2c689f98a1b9

SHA1
00a891c8220b9caeaeee3d7cbb2fe8dba4b2c615

SHA256
1d06e330b7c8415e34a76c177455477c75e56658442039a03ab1c723a9cb2f76

SHA512
3300278fc948b50ddb18baf22c3e236946cc6de7de12d4fa2df050c900a37c2b106e8fa9ae5991d2a63750203dcd192b1363342a0360ed1e8b15fbaa3f53cc28

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5542130.exe
Filesize
512KB

MD5
416e22fd931516bc01b99fa80a28efc8

SHA1
cd3663411346d9e40c5fcd7c9249d88d04ba9a7e

SHA256
81929cd9fcda652109f72086d3754550da24397cdd177a0471f7dff9343d0aac

SHA512
ce9bd2ef31b0f2296a921bac7bb942a209e4a57223b051799820149fdbc55ff9e250e8be36a8217067dc576d413f58240efc5bcb8c780de8fb96b591b6d32a5d

Download Submit
memory/4316-18-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4316-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4316-14-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/4576-25-0x0000000000510000-0x0000000000540000-memory.dmp

Filesize
192KB

Download
memory/4576-30-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/4576-32-0x000000000A640000-0x000000000A74A000-memory.dmp

Filesize
1.0MB

Download
memory/4576-33-0x000000000A780000-0x000000000A792000-memory.dmp

Filesize
72KB

Download
memory/4576-34-0x000000000A7A0000-0x000000000A7DC000-memory.dmp

Filesize
240KB

Download
memory/4576-35-0x00000000024D0000-0x000000000251C000-memory.dmp

Filesize
304KB

Download
memory/4576-31-0x0000000009FC0000-0x000000000A5D8000-memory.dmp

Filesize
6.1MB

Download