healer | 2dc65011521e7ad60108888f5371fb028a91e927b1073cb9289f80fd02ee1763

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe
Size

479KB
MD5

6e781f1e4a262ee83b43f80fe97bd5c5
SHA1

41cb282926f44cf675588fc7a1786d507835faf2
SHA256

2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d
SHA512

a98e68d010b7c0f77d6ace5d3162e3216f07022426d661211c077391d11d8dd09ebd4fecd37c696bc4574ab12ef4b9513ae2988479fd7200307f57a74fc01cec
SSDEEP

12288:UMruy90kvTNQ6sxa8OHz6Relk06eJrf3Gd6xDLu:6yFNUOHz6RelXr2aLu

Score

10^/10

healer redline mufos dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mufos

217.196.96.102:4132

Attributes

auth_value
136f202e6569ad5815c34377858a255c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2480-15-0x00000000021B0000-0x00000000021CA000-memory.dmp	healer
behavioral2/memory/2480-18-0x00000000024B0000-0x00000000024C8000-memory.dmp	healer
behavioral2/memory/2480-25-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-47-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-45-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-43-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-41-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-39-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-37-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-35-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-33-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-31-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-29-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-27-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-23-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-21-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer
behavioral2/memory/2480-20-0x00000000024B0000-0x00000000024C2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a6359303.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6359303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6359303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6359303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6359303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6359303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6359303.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2281523.exe	family_redline
behavioral2/memory/3660-54-0x0000000000920000-0x000000000094E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

v0892473.exea6359303.exeb2281523.exe

pid process

3392 v0892473.exe
2480 a6359303.exe
3660 b2281523.exe

pid	process
3392	v0892473.exe
2480	a6359303.exe
3660	b2281523.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a6359303.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6359303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6359303.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exev0892473.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0892473.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a6359303.exe

pid process

2480 a6359303.exe
2480 a6359303.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a6359303.exe

description pid process

Token: SeDebugPrivilege 2480 a6359303.exe

pid	process
2480	a6359303.exe
2480	a6359303.exe

description	pid	process
Token: SeDebugPrivilege	2480	a6359303.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exev0892473.exe

description	pid	process	target process
PID 224 wrote to memory of 3392	224	2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe	v0892473.exe
PID 224 wrote to memory of 3392	224	2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe	v0892473.exe
PID 224 wrote to memory of 3392	224	2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe	v0892473.exe
PID 3392 wrote to memory of 2480	3392	v0892473.exe	a6359303.exe
PID 3392 wrote to memory of 2480	3392	v0892473.exe	a6359303.exe
PID 3392 wrote to memory of 2480	3392	v0892473.exe	a6359303.exe
PID 3392 wrote to memory of 3660	3392	v0892473.exe	b2281523.exe
PID 3392 wrote to memory of 3660	3392	v0892473.exe	b2281523.exe
PID 3392 wrote to memory of 3660	3392	v0892473.exe	b2281523.exe

C:\Users\Admin\AppData\Local\Temp\2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe
"C:\Users\Admin\AppData\Local\Temp\2159151861e461f2ae831fef44ef4a519defe4741536ef19cc47163f7504ce2d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0892473.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0892473.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3392

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6359303.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6359303.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2281523.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2281523.exe
3⤵
- Executes dropped EXE
PID:3660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0892473.exe
Filesize
307KB

MD5
d751c9ced91639aceb91060e479ac574

SHA1
5f268920bced88a18ad02d2c245e80ef87c4ddb0

SHA256
287c8f9e4ac6fa2dfe8cef4cd02d451cc19d1708e5b3e832b668e778995b5812

SHA512
e81e710c09494e1014e9aa47294b7579cb3d2317941327595671b3fdfe6bb0df40f82cd77d40a28df7d3fdbfc497c19d5a5739cf509ef1dae9444185b9e6b3d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6359303.exe
Filesize
181KB

MD5
80274d55d95fceaefd6ac2b1fee03a05

SHA1
aca66eb221a8c38fb918117a1bbc0fdb271e7331

SHA256
347d14eb6c6069bddb9bd8b62d87cc38f3a233dbe59e084744de47ef2ef7d589

SHA512
d43535227dbdc72faced22f6d8092d9b56b9442a7cfc05ac278678e0175179c758077cd70ec2ac8340eb11caf65c662d7f8ba51d4d8ddc85c068eb2ca5b5d8da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2281523.exe
Filesize
168KB

MD5
9a8892409550e4cbafb553b592b76136

SHA1
adf8ab7c19b352c14463323d5ad2660609e7068e

SHA256
8be5444c4136ea7470f218e43d646328ab1317fb78a21cca3e606eb0e51b6e0b

SHA512
98f0b5175d8b2e0b7b37aa574357612d1924a68c41d188983dfc246aa852db4b02da135deaeb792f4551239e649b318eadfa232a122b0ab4b246898d6576a2f2

Download Submit
memory/2480-33-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-17-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/2480-29-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-18-0x00000000024B0000-0x00000000024C8000-memory.dmp

Filesize
96KB

Download
memory/2480-19-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/2480-25-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-47-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-45-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-43-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-41-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-39-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-37-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-35-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-15-0x00000000021B0000-0x00000000021CA000-memory.dmp

Filesize
104KB

Download
memory/2480-31-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-16-0x0000000004BF0000-0x0000000005194000-memory.dmp

Filesize
5.6MB

Download
memory/2480-27-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-23-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-21-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-20-0x00000000024B0000-0x00000000024C2000-memory.dmp

Filesize
72KB

Download
memory/2480-48-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/2480-50-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/2480-14-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Filesize
4KB

Download
memory/3660-54-0x0000000000920000-0x000000000094E000-memory.dmp

Filesize
184KB

Download
memory/3660-55-0x00000000011E0000-0x00000000011E6000-memory.dmp

Filesize
24KB

Download
memory/3660-56-0x000000000ADA0000-0x000000000B3B8000-memory.dmp

Filesize
6.1MB

Download
memory/3660-57-0x000000000A8D0000-0x000000000A9DA000-memory.dmp

Filesize
1.0MB

Download
memory/3660-58-0x000000000A800000-0x000000000A812000-memory.dmp

Filesize
72KB

Download
memory/3660-59-0x000000000A860000-0x000000000A89C000-memory.dmp

Filesize
240KB

Download
memory/3660-60-0x0000000002980000-0x00000000029CC000-memory.dmp

Filesize
304KB

Download