healer | 2dc65011521e7ad60108888f5371fb028a91e927b1073cb9289f80fd02ee1763

Analysis

max time kernel
126s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe
Size

1.6MB
MD5

7d32073410b319d087fce19d1e06e567
SHA1

db8fc2679ad185f7593223c7c9b1bd24dc9f9c14
SHA256

a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49
SHA512

7f488b6974d89acb19da09df9784df631203f4ef1693c72092d0eb0cc3ed663332381ae3f052d479942acbf271466f2a8160009ebe0dceddc450a3b5818c6af3
SSDEEP

24576:3y9qneMGcM4DVQJBTkCn/H6tfxjl/zq9exWtOf2K1UkGmTXDqKbv4d3:C4neMZMJBT7n/+JjRq9ex0K2yDei

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral15/memory/1128-28-0x0000000000470000-0x000000000047A000-memory.dmp	healer
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3967201.exe	healer
behavioral15/memory/1472-37-0x0000000000BD0000-0x0000000000BDA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

b3967201.exea9717694.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9717694.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b3967201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9717694.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral15/memory/4656-42-0x0000000000490000-0x00000000004C0000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

v1914298.exev4762413.exev1073985.exea9717694.exeb3967201.exec2363283.exe

pid process

4020 v1914298.exe
4516 v4762413.exe
1692 v1073985.exe
1128 a9717694.exe
1472 b3967201.exe
4656 c2363283.exe

pid	process
4020	v1914298.exe
4516	v4762413.exe
1692	v1073985.exe
1128	a9717694.exe
1472	b3967201.exe
4656	c2363283.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a9717694.exeb3967201.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b3967201.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exev1914298.exev4762413.exev1073985.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1914298.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4762413.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v1073985.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a9717694.exeb3967201.exe

pid process

1128 a9717694.exe
1128 a9717694.exe
1472 b3967201.exe
1472 b3967201.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a9717694.exeb3967201.exe

description pid process

Token: SeDebugPrivilege 1128 a9717694.exe
Token: SeDebugPrivilege 1472 b3967201.exe

pid	process
1128	a9717694.exe
1128	a9717694.exe
1472	b3967201.exe
1472	b3967201.exe

description	pid	process
Token: SeDebugPrivilege	1128	a9717694.exe
Token: SeDebugPrivilege	1472	b3967201.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exev1914298.exev4762413.exev1073985.exe

description	pid	process	target process
PID 4816 wrote to memory of 4020	4816	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe	v1914298.exe
PID 4816 wrote to memory of 4020	4816	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe	v1914298.exe
PID 4816 wrote to memory of 4020	4816	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe	v1914298.exe
PID 4020 wrote to memory of 4516	4020	v1914298.exe	v4762413.exe
PID 4020 wrote to memory of 4516	4020	v1914298.exe	v4762413.exe
PID 4020 wrote to memory of 4516	4020	v1914298.exe	v4762413.exe
PID 4516 wrote to memory of 1692	4516	v4762413.exe	v1073985.exe
PID 4516 wrote to memory of 1692	4516	v4762413.exe	v1073985.exe
PID 4516 wrote to memory of 1692	4516	v4762413.exe	v1073985.exe
PID 1692 wrote to memory of 1128	1692	v1073985.exe	a9717694.exe
PID 1692 wrote to memory of 1128	1692	v1073985.exe	a9717694.exe
PID 1692 wrote to memory of 1128	1692	v1073985.exe	a9717694.exe
PID 1692 wrote to memory of 1472	1692	v1073985.exe	b3967201.exe
PID 1692 wrote to memory of 1472	1692	v1073985.exe	b3967201.exe
PID 4516 wrote to memory of 4656	4516	v4762413.exe	c2363283.exe
PID 4516 wrote to memory of 4656	4516	v4762413.exe	c2363283.exe
PID 4516 wrote to memory of 4656	4516	v4762413.exe	c2363283.exe

C:\Users\Admin\AppData\Local\Temp\a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe
"C:\Users\Admin\AppData\Local\Temp\a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4816

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1914298.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1914298.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4020

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4762413.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4762413.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4516

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1073985.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1073985.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1692

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9717694.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9717694.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3967201.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3967201.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2363283.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2363283.exe
4⤵
- Executes dropped EXE
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1914298.exe
Filesize
1.4MB

MD5
b23e03f55fb665ef3a7c1b59ba25905c

SHA1
aa41f769ab64582e1580634ecbb93413fe8faf01

SHA256
f384aa634281296fab2d70b2976f5f6ecd6d095088753ca0d9d9818b0ac8c90a

SHA512
9b09d2694a52d85f8600119740ccf5f376bc990e440fe2d5dd419e6d560d5604f87821eed040c3ef9cbc29cbe76e36f565808a3353f0303f9ac3182c8022b6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4762413.exe
Filesize
1.3MB

MD5
6e1ec15bc7923022df460c3b3717b9f1

SHA1
5ffe926fe0f7e839c1d92789c12a10bb36569fe5

SHA256
fba0fce9dbf4e0fb93079728682e5b253bdf24a5490d20850fe61e848a7652f3

SHA512
6a1588b3cfe74f8cd8d2056fbd5ed4aa0478f1010a1f4251a98ea07317f6a71b7bbbf0cd494d4684286a252b16d129256b509be7cc9a3fdb8d98fb2c699f501c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2363283.exe
Filesize
729KB

MD5
baf9493d9c73890f8d4f4f091fd9eca6

SHA1
f54abf5bf95c1f8483f5d32ee202b20dcdba29cc

SHA256
329ab5497737e82ec1b2d6d6f6942d674dbaa2199074baaacca5b09418131749

SHA512
f967a7db1ffbad2c720c179a2a2aa7b464fc1534bca41f4205d06094f2bb9ba4e83a374efafc8c2d422d243d50f0c22ab954f783c2c8dedec9bfd89d24a5d088

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1073985.exe
Filesize
640KB

MD5
523410329da6810d2c34721fefeec97a

SHA1
4958236c7f287066d076053441437c844301108b

SHA256
f7082f4eb966435fac581a7d8229543628dba662c68ef5fe8d47ec47ea83f80b

SHA512
db15359004d1a72d2dc7c9784ad876a4b1fda6b14aca104faccd877d0094a5ff93740858f80de92af51f77bf1e1441ac0a2ba5eb5880066809208fa170a8a193

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9717694.exe
Filesize
568KB

MD5
473158cb77f1c5092427ace743c57e6a

SHA1
81cea8ee25a9d99f0e192a76b13703dfa53e9554

SHA256
c55380f69ac05a426382a0cac0fd03dfb9096a0342d30351c13040072a77a0c9

SHA512
5d66c4dfc312369c147cdb675700336139ca878ab5ab6ebb4f175010a8ee1040becba8b0a97c045cd874c01238b38f11e06d863bd2df89548bf3914282dc182b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3967201.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1128-28-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/1472-37-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

Filesize
40KB

Download
memory/4656-42-0x0000000000490000-0x00000000004C0000-memory.dmp

Filesize
192KB

Download
memory/4656-47-0x0000000004960000-0x0000000004966000-memory.dmp

Filesize
24KB

Download
memory/4656-48-0x000000000A4E0000-0x000000000AAF8000-memory.dmp

Filesize
6.1MB

Download
memory/4656-49-0x0000000009EE0000-0x0000000009FEA000-memory.dmp

Filesize
1.0MB

Download
memory/4656-50-0x000000000A020000-0x000000000A032000-memory.dmp

Filesize
72KB

Download
memory/4656-51-0x000000000A040000-0x000000000A07C000-memory.dmp

Filesize
240KB

Download
memory/4656-52-0x00000000007D0000-0x000000000081C000-memory.dmp

Filesize
304KB

Download