healer | 2dc65011521e7ad60108888f5371fb028a91e927b1073cb9289f80fd02ee1763

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe
Size

478KB
MD5

7f14be90da456e71fecfd8ac89d2cd2b
SHA1

87e9180ae88e72d5f10549bed0ab35814771fac6
SHA256

79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70
SHA512

e42e3a3ef28fcae134e58e3f308c678bc3ee9fdc3e4b8b1235f6ef0de67abd0a6ea20a8cbf31b6087e6f8e7f83c5742959153e453e675f4494162625044835d4
SSDEEP

12288:kMrQy90LlnmDAGXyy1TBdamxmuEW9YWJyclYT:UyilnmDAF4T/+uf9YMtYT

Score

10^/10

healer redline mufos dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mufos

217.196.96.102:4132

Attributes

auth_value
136f202e6569ad5815c34377858a255c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral11/memory/2684-15-0x00000000022C0000-0x00000000022DA000-memory.dmp	healer
behavioral11/memory/2684-18-0x0000000004990000-0x00000000049A8000-memory.dmp	healer
behavioral11/memory/2684-46-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-44-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-42-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-40-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-38-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-36-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-34-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-32-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-30-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-28-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-26-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-24-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-22-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-20-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral11/memory/2684-19-0x0000000004990000-0x00000000049A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a5678297.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5678297.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5678297.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral11/files/0x000700000002342b-52.dat	family_redline
behavioral11/memory/4364-54-0x00000000007B0000-0x00000000007DE000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

v3671290.exea5678297.exeb1201133.exe

pid	Process
2296	v3671290.exe
2684	a5678297.exe
4364	b1201133.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a5678297.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5678297.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exev3671290.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v3671290.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a5678297.exe

pid	Process
2684	a5678297.exe
2684	a5678297.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a5678297.exe

description	pid	Process
Token: SeDebugPrivilege	2684	a5678297.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exev3671290.exe

description	pid	Process	procid_target
PID 60 wrote to memory of 2296	60	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe	82
PID 60 wrote to memory of 2296	60	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe	82
PID 60 wrote to memory of 2296	60	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe	82
PID 2296 wrote to memory of 2684	2296	v3671290.exe	84
PID 2296 wrote to memory of 2684	2296	v3671290.exe	84
PID 2296 wrote to memory of 2684	2296	v3671290.exe	84
PID 2296 wrote to memory of 4364	2296	v3671290.exe	89
PID 2296 wrote to memory of 4364	2296	v3671290.exe	89
PID 2296 wrote to memory of 4364	2296	v3671290.exe	89

C:\Users\Admin\AppData\Local\Temp\79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe
"C:\Users\Admin\AppData\Local\Temp\79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:60
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3671290.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3671290.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5678297.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5678297.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1201133.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1201133.exe
    3⤵
    - Executes dropped EXE
    PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3671290.exe

Filesize
307KB

MD5
edb0f1d0bd19d03925773ecc34e1fe50

SHA1
7668fb84e1d9fdfb88f096000020039200ece193

SHA256
8d15ef2fb7dc2170557c6e394c005175be4e28ccb189e6d691367ce1b6ca5fd2

SHA512
dd9f6972694a26b5ab945fe797619417f5d89860f671fb5305fc78333d1e17bae27664aea3abf42839dfea63403353eaea19d846c86ad0cc5641d9c36dd7c660

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5678297.exe

Filesize
181KB

MD5
2cfaae5f88f0b6329711faa063db83fd

SHA1
cc44557537f335858b1f733e5088f4da32f734ce

SHA256
5430132a3271c8b1a9a115cdbbe1f0dc366c2d15cd5e4eca8b461a0f8c117d9b

SHA512
3657d9790c955bf2388b8f15ada4759301485bb637fc41ad37341587fa320a20c7cef6853df05d15de3cd219a121ce3a45ce982c78522c0bb92eaa374daba91d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1201133.exe

Filesize
168KB

MD5
fe6c5d5eb3809fb323f7eca654f7c1d9

SHA1
44e2c7a624fa1cf273d4e7476870a9b185801bd6

SHA256
16c404c340c3e1a2738908be6ef00f7adec098237e6b6f912c4194d3c5bd9aa5

SHA512
2469aa21c524ba33e4e2e9499d87f6a36d4d3764e7c58805e1364543ebe9c5fe559da9ebeca9ed94b8aa7f88204c375df26a0f6e1e9d45dd06dafe585304ecbf

Download Submit
memory/2684-48-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2684-16-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2684-28-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-18-0x0000000004990000-0x00000000049A8000-memory.dmp

Filesize
96KB

Download
memory/2684-46-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-44-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-42-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-47-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2684-40-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-38-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-36-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-34-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-32-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-15-0x00000000022C0000-0x00000000022DA000-memory.dmp

Filesize
104KB

Download
memory/2684-30-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-17-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/2684-26-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-24-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-22-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-20-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-19-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/2684-50-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2684-14-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/4364-54-0x00000000007B0000-0x00000000007DE000-memory.dmp

Filesize
184KB

Download
memory/4364-55-0x0000000000F60000-0x0000000000F66000-memory.dmp

Filesize
24KB

Download
memory/4364-56-0x000000000AC20000-0x000000000B238000-memory.dmp

Filesize
6.1MB

Download
memory/4364-57-0x000000000A760000-0x000000000A86A000-memory.dmp

Filesize
1.0MB

Download
memory/4364-58-0x000000000A690000-0x000000000A6A2000-memory.dmp

Filesize
72KB

Download
memory/4364-59-0x000000000A6F0000-0x000000000A72C000-memory.dmp

Filesize
240KB

Download
memory/4364-60-0x0000000002A70000-0x0000000002ABC000-memory.dmp

Filesize
304KB

Download