healer | 54a724762de2b08068bc2bf0fc6c7404bb89bdf62f75cac32b4fb8687c10c747

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe
Size

1.0MB
MD5

250d1ecad815535932db86d951b6f70d
SHA1

9d56851eda02a979043c33ec98883e2655bacc30
SHA256

e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a
SHA512

ede2fc99fe086f427355d95e2b4fad0289da828f3105c5c2b9b48a8aee213928299725b55d066df7ce2f3c139ecdf38ff418bf20ac36244678f0f0d0a7a05c65
SSDEEP

24576:wyt+dYi+Bu0wW31dx/UEvzxRTkICQ/digppmVnXrBh:3tmYiN0t3VfB5VdpAV1

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral14/memory/4740-23-0x0000000000420000-0x000000000042A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0376940.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0376940.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral14/memory/4864-32-0x0000000000460000-0x0000000000490000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
2672	y4046657.exe
5052	y7493625.exe
4740	k0376940.exe
4864	l8136250.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0376940.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0376940.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4046657.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7493625.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1796	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	k0376940.exe
4740	k0376940.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	k0376940.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 2672	4192	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe	83
PID 4192 wrote to memory of 2672	4192	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe	83
PID 4192 wrote to memory of 2672	4192	e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe	83
PID 2672 wrote to memory of 5052	2672	y4046657.exe	84
PID 2672 wrote to memory of 5052	2672	y4046657.exe	84
PID 2672 wrote to memory of 5052	2672	y4046657.exe	84
PID 5052 wrote to memory of 4740	5052	y7493625.exe	85
PID 5052 wrote to memory of 4740	5052	y7493625.exe	85
PID 5052 wrote to memory of 4740	5052	y7493625.exe	85
PID 5052 wrote to memory of 4864	5052	y7493625.exe	97
PID 5052 wrote to memory of 4864	5052	y7493625.exe	97
PID 5052 wrote to memory of 4864	5052	y7493625.exe	97

C:\Users\Admin\AppData\Local\Temp\e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe
"C:\Users\Admin\AppData\Local\Temp\e81854abc9bd7ae970c918e0839982609691e44919d3a96eee12840676c28e1a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4046657.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4046657.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7493625.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7493625.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0376940.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0376940.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8136250.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8136250.exe
      4⤵
      Executes dropped EXE
      PID:4864

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4046657.exe

Filesize
891KB

MD5
632d34cbac048fae16fe87464e3a7863

SHA1
5a3b1318c0a3f49db4a6b50f1a793c4467270acb

SHA256
7baf3c9e70fb5602c411a2a26e560d838749d33b049ae714a239cd8e723d0fa9

SHA512
6c7267a7cd1cd7d5656e4ec510995c051c2b4765268fa77a3281d60c9ebd625c8e6dfec407991f379ad0136bba2bb7c1dc8d126c6fc05ad8e68e377c9c071c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7493625.exe

Filesize
708KB

MD5
126a71b0cadb61f9955dfb0afde13398

SHA1
9eb772b2a8b827afee01748cf145d45c13b0eeec

SHA256
fb4aad226f160ee99a11e53b3be48122a02426e78831e3af9b3d0c5732864b67

SHA512
45a4e81984557481d49caa986e509a379346d9c5ebee6c6c0b8a26a44e4564ec0d4ca648561e3b7aef8d90afd17ded42843bb261fea9e7d5b1a4c211fd4662d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0376940.exe

Filesize
576KB

MD5
cff8a2e59615a98cbf918dd8e077a389

SHA1
e11fc159e3d8583828982cffea34f067a2660590

SHA256
41cf136363e0a0111f1e5fea2446d7b81e6e8027eb980eea8f287f2223007e52

SHA512
e6fff9eddf47925ee859feb22b8fc1ab5a34bc2d7fa95afbfcf477ac0ba584a2c1142dde0860f13d3951c8c1486af0e7567638227434d07a13e3239e590aa23f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8136250.exe

Filesize
738KB

MD5
641fecb9ab08e2dbfa0b0f8581d046b0

SHA1
3be3feebf527ee4af1e17ea538d5a206dd47e125

SHA256
2252e0014da1473abf0117224b9286e9e06734ef6ab647451554447dd7d9d5d8

SHA512
34958e973573d1a50aa79217b1b8adcd6cd0d071ec4eaa9c010780d115b87d30df22503fd5f3e8aba5e22a4633a4b3a6f95b94e2850573e3aa7d4d651aede00a

Download Submit
memory/4740-23-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/4740-21-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4864-32-0x0000000000460000-0x0000000000490000-memory.dmp

Filesize
192KB

Download
memory/4864-36-0x0000000002430000-0x0000000002436000-memory.dmp

Filesize
24KB

Download
memory/4864-37-0x00000000050D0000-0x00000000056E8000-memory.dmp

Filesize
6.1MB

Download
memory/4864-38-0x0000000004AC0000-0x0000000004BCA000-memory.dmp

Filesize
1.0MB

Download
memory/4864-39-0x0000000004C00000-0x0000000004C12000-memory.dmp

Filesize
72KB

Download
memory/4864-40-0x0000000004C20000-0x0000000004C5C000-memory.dmp

Filesize
240KB

Download
memory/4864-41-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Filesize
304KB

Download