healer | 692e82b585be9ac7cc8c88f2eeb475fcf42fed96a7b5572934f45018a5f7f2d1

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24.exe
Size

662KB
MD5

ad556af301bc23d9d68e88347510597a
SHA1

33c98a0a8322aa276c825a76dfbe90eb89adb0ed
SHA256

9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24
SHA512

13b7701cdd1b901df94c7c4dafb68bd37949c822aceb29aa55d04bb5084772c9886f9e8de81e4ed221cfb6c44fa101f395120c02d520fc9fcf03e42e2b80303d
SSDEEP

12288:3Mr2y90oQvlJuZN/gE/AT4aV+nD/xybAP5fI8CR5dXyALD8J0v:RyRQvlcND/AT/V+tpP5fVCjdiALYJ0v

Score

10^/10

healer redline mrak dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral10/memory/4660-21-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral10/memory/1736-25-0x0000000000830000-0x0000000000860000-memory.dmp	family_redline
behavioral10/files/0x000700000002340d-24.dat	family_redline

Executes dropped EXE 4 IoCs

pid	Process
5036	x8157062.exe
5096	x9442367.exe
1240	g6603557.exe
1736	i4410075.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8157062.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x9442367.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 4660	1240	g6603557.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3488	1240	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4660	AppLaunch.exe
4660	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	AppLaunch.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 5036	4508	9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24.exe	83
PID 4508 wrote to memory of 5036	4508	9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24.exe	83
PID 4508 wrote to memory of 5036	4508	9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24.exe	83
PID 5036 wrote to memory of 5096	5036	x8157062.exe	84
PID 5036 wrote to memory of 5096	5036	x8157062.exe	84
PID 5036 wrote to memory of 5096	5036	x8157062.exe	84
PID 5096 wrote to memory of 1240	5096	x9442367.exe	85
PID 5096 wrote to memory of 1240	5096	x9442367.exe	85
PID 5096 wrote to memory of 1240	5096	x9442367.exe	85
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 1240 wrote to memory of 4660	1240	g6603557.exe	87
PID 5096 wrote to memory of 1736	5096	x9442367.exe	94
PID 5096 wrote to memory of 1736	5096	x9442367.exe	94
PID 5096 wrote to memory of 1736	5096	x9442367.exe	94

C:\Users\Admin\AppData\Local\Temp\9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24.exe
"C:\Users\Admin\AppData\Local\Temp\9296923f571779b37e571b296a597c9c5eb71a0a616bfd3ddab9f7d20c509c24.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8157062.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8157062.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9442367.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9442367.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6603557.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6603557.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 556
        5⤵
        Program crash
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4410075.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4410075.exe
      4⤵
      Executes dropped EXE
      PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1240 -ip 1240
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8157062.exe

Filesize
440KB

MD5
16654be0a6b9fcc34c39b6e591340fe0

SHA1
be62555eb0ecfceea1dead4cc4374da86d433f73

SHA256
46e8bb0baf56bdb40cb17b8ad98db6d55568622f60c41273c8269b7045a2a209

SHA512
f4ac5c3d704abd49576680e3d483e7ed78ff00755eb0def9009ba8ded67aeae691f5a02c6e8b9ddd0d5ccc936e39f1efe64747d71917a9f41ed07aeb9685f10b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x9442367.exe

Filesize
274KB

MD5
0c9441b51f1681088cd920785936c076

SHA1
aa49e5b1b01eb77d4a2db72ed0fb57e89d0ffd51

SHA256
3895ad643b9fb1fd943dc88b1218ab1f9ab229e098eff720b9ac0dacad0a3edf

SHA512
c90dd796609f000fa192abad2fe6e11193d70b59888d1fc259f78536f1c0f079a757df2e09272fa838f228debf22081e6a2e52232400ee469982ebcd56bae355

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6603557.exe

Filesize
135KB

MD5
748d8130ad48f5c7791666eeeba868db

SHA1
cc5ff50dd58d6f4b2968cd5720e484d584adb18e

SHA256
cc955cfcc6c535c64b2e255386637f87a91821144c766cc17320c7c0b3b8efde

SHA512
daebe7c16a0dfccfa9f86ffe04f58805925a4958be4ffa1455f7376b5026c92f69d3888453ba684c60a7e68d073f7af90e9473af574c3f2ea2d4d3443eecd806

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4410075.exe

Filesize
176KB

MD5
756f51fcbebaa6ed794be46e0e615858

SHA1
856acc1832bb654eb514b7df1fa882f3c59a097f

SHA256
3f741ae6dfc446f3e5f5ba6282a1245cc4fc847ed7d21303a9b0d8553e194c38

SHA512
b1a7e093bb8cf374c14416181aacaaaa5d8203489954a3b77053dd367b720078bc47eee369dd659a062aa758c5d555547f0d791377416464e5809e279cc183d6

Download Submit
memory/1736-25-0x0000000000830000-0x0000000000860000-memory.dmp

Filesize
192KB

Download
memory/1736-26-0x00000000028A0000-0x00000000028A6000-memory.dmp

Filesize
24KB

Download
memory/1736-27-0x0000000005790000-0x0000000005DA8000-memory.dmp

Filesize
6.1MB

Download
memory/1736-28-0x0000000005280000-0x000000000538A000-memory.dmp

Filesize
1.0MB

Download
memory/1736-29-0x00000000051B0000-0x00000000051C2000-memory.dmp

Filesize
72KB

Download
memory/1736-30-0x0000000005210000-0x000000000524C000-memory.dmp

Filesize
240KB

Download
memory/1736-31-0x0000000005390000-0x00000000053DC000-memory.dmp

Filesize
304KB

Download
memory/4660-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download