healer | 2dc65011521e7ad60108888f5371fb028a91e927b1073cb9289f80fd02ee1763

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe
Size

478KB
MD5

7f14be90da456e71fecfd8ac89d2cd2b
SHA1

87e9180ae88e72d5f10549bed0ab35814771fac6
SHA256

79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70
SHA512

e42e3a3ef28fcae134e58e3f308c678bc3ee9fdc3e4b8b1235f6ef0de67abd0a6ea20a8cbf31b6087e6f8e7f83c5742959153e453e675f4494162625044835d4
SSDEEP

12288:kMrQy90LlnmDAGXyy1TBdamxmuEW9YWJyclYT:UyilnmDAF4T/+uf9YMtYT

Score

10^/10

healer redline mufos dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mufos

217.196.96.102:4132

Attributes

auth_value
136f202e6569ad5815c34377858a255c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral11/memory/3812-15-0x0000000002400000-0x000000000241A000-memory.dmp	healer
behavioral11/memory/3812-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral11/memory/3812-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-19-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral11/memory/3812-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a5678297.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5678297.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5678297.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral11/memory/4876-54-0x0000000000360000-0x000000000038E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1201133.exe	family_redline

Executes dropped EXE 3 IoCs

Processes:

v3671290.exea5678297.exeb1201133.exe

pid process

3236 v3671290.exe
3812 a5678297.exe
4876 b1201133.exe

pid	process
3236	v3671290.exe
3812	a5678297.exe
4876	b1201133.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a5678297.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a5678297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5678297.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v3671290.exe79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v3671290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1256 sc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a5678297.exe

pid process

3812 a5678297.exe
3812 a5678297.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a5678297.exe

description pid process

Token: SeDebugPrivilege 3812 a5678297.exe

pid	process
1256	sc.exe

pid	process
3812	a5678297.exe
3812	a5678297.exe

description	pid	process
Token: SeDebugPrivilege	3812	a5678297.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exev3671290.exe

description	pid	process	target process
PID 432 wrote to memory of 3236	432	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe	v3671290.exe
PID 432 wrote to memory of 3236	432	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe	v3671290.exe
PID 432 wrote to memory of 3236	432	79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe	v3671290.exe
PID 3236 wrote to memory of 3812	3236	v3671290.exe	a5678297.exe
PID 3236 wrote to memory of 3812	3236	v3671290.exe	a5678297.exe
PID 3236 wrote to memory of 3812	3236	v3671290.exe	a5678297.exe
PID 3236 wrote to memory of 4876	3236	v3671290.exe	b1201133.exe
PID 3236 wrote to memory of 4876	3236	v3671290.exe	b1201133.exe
PID 3236 wrote to memory of 4876	3236	v3671290.exe	b1201133.exe

C:\Users\Admin\AppData\Local\Temp\79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe
"C:\Users\Admin\AppData\Local\Temp\79eaddd1dc15f0cdf5e503c8eff40a9cabfc9aca470a302c9e868d65a3670c70.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:432

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3671290.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3671290.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3236

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5678297.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5678297.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1201133.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1201133.exe
3⤵
- Executes dropped EXE
PID:4876

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3671290.exe
Filesize
307KB

MD5
edb0f1d0bd19d03925773ecc34e1fe50

SHA1
7668fb84e1d9fdfb88f096000020039200ece193

SHA256
8d15ef2fb7dc2170557c6e394c005175be4e28ccb189e6d691367ce1b6ca5fd2

SHA512
dd9f6972694a26b5ab945fe797619417f5d89860f671fb5305fc78333d1e17bae27664aea3abf42839dfea63403353eaea19d846c86ad0cc5641d9c36dd7c660

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5678297.exe
Filesize
181KB

MD5
2cfaae5f88f0b6329711faa063db83fd

SHA1
cc44557537f335858b1f733e5088f4da32f734ce

SHA256
5430132a3271c8b1a9a115cdbbe1f0dc366c2d15cd5e4eca8b461a0f8c117d9b

SHA512
3657d9790c955bf2388b8f15ada4759301485bb637fc41ad37341587fa320a20c7cef6853df05d15de3cd219a121ce3a45ce982c78522c0bb92eaa374daba91d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1201133.exe
Filesize
168KB

MD5
fe6c5d5eb3809fb323f7eca654f7c1d9

SHA1
44e2c7a624fa1cf273d4e7476870a9b185801bd6

SHA256
16c404c340c3e1a2738908be6ef00f7adec098237e6b6f912c4194d3c5bd9aa5

SHA512
2469aa21c524ba33e4e2e9499d87f6a36d4d3764e7c58805e1364543ebe9c5fe559da9ebeca9ed94b8aa7f88204c375df26a0f6e1e9d45dd06dafe585304ecbf

Download Submit
memory/3812-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-17-0x0000000004BD0000-0x0000000005174000-memory.dmp

Filesize
5.6MB

Download
memory/3812-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/3812-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-19-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-47-0x0000000074810000-0x0000000074FC0000-memory.dmp

Filesize
7.7MB

Download
memory/3812-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-15-0x0000000002400000-0x000000000241A000-memory.dmp

Filesize
104KB

Download
memory/3812-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-16-0x0000000074810000-0x0000000074FC0000-memory.dmp

Filesize
7.7MB

Download
memory/3812-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-48-0x0000000074810000-0x0000000074FC0000-memory.dmp

Filesize
7.7MB

Download
memory/3812-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3812-50-0x0000000074810000-0x0000000074FC0000-memory.dmp

Filesize
7.7MB

Download
memory/3812-14-0x000000007481E000-0x000000007481F000-memory.dmp

Filesize
4KB

Download
memory/4876-54-0x0000000000360000-0x000000000038E000-memory.dmp

Filesize
184KB

Download
memory/4876-55-0x00000000024B0000-0x00000000024B6000-memory.dmp

Filesize
24KB

Download
memory/4876-56-0x00000000053D0000-0x00000000059E8000-memory.dmp

Filesize
6.1MB

Download
memory/4876-58-0x0000000004E20000-0x0000000004E32000-memory.dmp

Filesize
72KB

Download
memory/4876-57-0x0000000004EF0000-0x0000000004FFA000-memory.dmp

Filesize
1.0MB

Download
memory/4876-59-0x0000000004E80000-0x0000000004EBC000-memory.dmp

Filesize
240KB

Download
memory/4876-60-0x0000000005000000-0x000000000504C000-memory.dmp

Filesize
304KB

Download