healer | 2dc65011521e7ad60108888f5371fb028a91e927b1073cb9289f80fd02ee1763

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe
Size

1.6MB
MD5

7d32073410b319d087fce19d1e06e567
SHA1

db8fc2679ad185f7593223c7c9b1bd24dc9f9c14
SHA256

a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49
SHA512

7f488b6974d89acb19da09df9784df631203f4ef1693c72092d0eb0cc3ed663332381ae3f052d479942acbf271466f2a8160009ebe0dceddc450a3b5818c6af3
SSDEEP

24576:3y9qneMGcM4DVQJBTkCn/H6tfxjl/zq9exWtOf2K1UkGmTXDqKbv4d3:C4neMZMJBT7n/+JjRq9ex0K2yDei

Score

10^/10

healer redline masha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

masha

77.91.68.48:19071

Attributes

auth_value
55b9b39a0dae383196a4b8d79e5bb805

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral15/memory/4876-28-0x0000000000640000-0x000000000064A000-memory.dmp	healer
behavioral15/files/0x0007000000023421-35.dat	healer
behavioral15/memory/1444-37-0x0000000000660000-0x000000000066A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9717694.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b3967201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b3967201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b3967201.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral15/memory/2948-43-0x0000000000580000-0x00000000005B0000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
2168	v1914298.exe
1204	v4762413.exe
5076	v1073985.exe
4876	a9717694.exe
1444	b3967201.exe
2948	c2363283.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b3967201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a9717694.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9717694.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1914298.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4762413.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v1073985.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4876	a9717694.exe
4876	a9717694.exe
1444	b3967201.exe
1444	b3967201.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	a9717694.exe
Token: SeDebugPrivilege	1444	b3967201.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2168	2748	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe	83
PID 2748 wrote to memory of 2168	2748	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe	83
PID 2748 wrote to memory of 2168	2748	a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe	83
PID 2168 wrote to memory of 1204	2168	v1914298.exe	84
PID 2168 wrote to memory of 1204	2168	v1914298.exe	84
PID 2168 wrote to memory of 1204	2168	v1914298.exe	84
PID 1204 wrote to memory of 5076	1204	v4762413.exe	85
PID 1204 wrote to memory of 5076	1204	v4762413.exe	85
PID 1204 wrote to memory of 5076	1204	v4762413.exe	85
PID 5076 wrote to memory of 4876	5076	v1073985.exe	86
PID 5076 wrote to memory of 4876	5076	v1073985.exe	86
PID 5076 wrote to memory of 4876	5076	v1073985.exe	86
PID 5076 wrote to memory of 1444	5076	v1073985.exe	95
PID 5076 wrote to memory of 1444	5076	v1073985.exe	95
PID 1204 wrote to memory of 2948	1204	v4762413.exe	96
PID 1204 wrote to memory of 2948	1204	v4762413.exe	96
PID 1204 wrote to memory of 2948	1204	v4762413.exe	96

C:\Users\Admin\AppData\Local\Temp\a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe
"C:\Users\Admin\AppData\Local\Temp\a5bd0160df71694767fdadc369e0582970a1182d88c7fea774ca4d3bdb503e49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1914298.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1914298.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4762413.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4762413.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1073985.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1073985.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9717694.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9717694.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3967201.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3967201.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2363283.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2363283.exe
      4⤵
      Executes dropped EXE
      PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1914298.exe

Filesize
1.4MB

MD5
b23e03f55fb665ef3a7c1b59ba25905c

SHA1
aa41f769ab64582e1580634ecbb93413fe8faf01

SHA256
f384aa634281296fab2d70b2976f5f6ecd6d095088753ca0d9d9818b0ac8c90a

SHA512
9b09d2694a52d85f8600119740ccf5f376bc990e440fe2d5dd419e6d560d5604f87821eed040c3ef9cbc29cbe76e36f565808a3353f0303f9ac3182c8022b6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4762413.exe

Filesize
1.3MB

MD5
6e1ec15bc7923022df460c3b3717b9f1

SHA1
5ffe926fe0f7e839c1d92789c12a10bb36569fe5

SHA256
fba0fce9dbf4e0fb93079728682e5b253bdf24a5490d20850fe61e848a7652f3

SHA512
6a1588b3cfe74f8cd8d2056fbd5ed4aa0478f1010a1f4251a98ea07317f6a71b7bbbf0cd494d4684286a252b16d129256b509be7cc9a3fdb8d98fb2c699f501c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2363283.exe

Filesize
729KB

MD5
baf9493d9c73890f8d4f4f091fd9eca6

SHA1
f54abf5bf95c1f8483f5d32ee202b20dcdba29cc

SHA256
329ab5497737e82ec1b2d6d6f6942d674dbaa2199074baaacca5b09418131749

SHA512
f967a7db1ffbad2c720c179a2a2aa7b464fc1534bca41f4205d06094f2bb9ba4e83a374efafc8c2d422d243d50f0c22ab954f783c2c8dedec9bfd89d24a5d088

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1073985.exe

Filesize
640KB

MD5
523410329da6810d2c34721fefeec97a

SHA1
4958236c7f287066d076053441437c844301108b

SHA256
f7082f4eb966435fac581a7d8229543628dba662c68ef5fe8d47ec47ea83f80b

SHA512
db15359004d1a72d2dc7c9784ad876a4b1fda6b14aca104faccd877d0094a5ff93740858f80de92af51f77bf1e1441ac0a2ba5eb5880066809208fa170a8a193

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a9717694.exe

Filesize
568KB

MD5
473158cb77f1c5092427ace743c57e6a

SHA1
81cea8ee25a9d99f0e192a76b13703dfa53e9554

SHA256
c55380f69ac05a426382a0cac0fd03dfb9096a0342d30351c13040072a77a0c9

SHA512
5d66c4dfc312369c147cdb675700336139ca878ab5ab6ebb4f175010a8ee1040becba8b0a97c045cd874c01238b38f11e06d863bd2df89548bf3914282dc182b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b3967201.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1444-37-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2948-49-0x00000000050E0000-0x00000000051EA000-memory.dmp

Filesize
1.0MB

Download
memory/2948-43-0x0000000000580000-0x00000000005B0000-memory.dmp

Filesize
192KB

Download
memory/2948-47-0x00000000023D0000-0x00000000023D6000-memory.dmp

Filesize
24KB

Download
memory/2948-48-0x0000000004AC0000-0x00000000050D8000-memory.dmp

Filesize
6.1MB

Download
memory/2948-50-0x0000000005220000-0x0000000005232000-memory.dmp

Filesize
72KB

Download
memory/2948-51-0x0000000005240000-0x000000000527C000-memory.dmp

Filesize
240KB

Download
memory/2948-52-0x00000000052E0000-0x000000000532C000-memory.dmp

Filesize
304KB

Download
memory/4876-28-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download