healer | e660be79de0932d6c5c0f1b65dc5d842ed790962625d5dd8731c30f46ae264a2

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205.exe
Size

769KB
MD5

a28e02cea1b7ab4227eb6f443baaa343
SHA1

4e453fcdee3aa118a5309f8c4001d6348a153df2
SHA256

4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205
SHA512

daffff5dcddf3ac30b09019d9fbc0a0fe5d73de9a91bf192d2947f91f4cb1adb9e3c5142bdb5a373b203aea47fb7c35c5737aa60bbd03b3ca008f3de55e8b1dd
SSDEEP

24576:AyAg9hkKCZrEzgPM+sf19KHtnLHJiLLx3Zm:HAumKVw29KNnNi3x3

Score

10^/10

healer redline virad dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral11/memory/1200-21-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral11/files/0x00070000000233ed-24.dat	family_redline
behavioral11/memory/396-25-0x0000000000470000-0x00000000004A0000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
3732	x1280632.exe
1052	x4259739.exe
1584	g7067525.exe
396	i8842500.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1280632.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x4259739.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 1200	1584	g7067525.exe	89

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3684	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1200	AppLaunch.exe
1200	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	AppLaunch.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3732	2188	4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205.exe	83
PID 2188 wrote to memory of 3732	2188	4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205.exe	83
PID 2188 wrote to memory of 3732	2188	4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205.exe	83
PID 3732 wrote to memory of 1052	3732	x1280632.exe	84
PID 3732 wrote to memory of 1052	3732	x1280632.exe	84
PID 3732 wrote to memory of 1052	3732	x1280632.exe	84
PID 1052 wrote to memory of 1584	1052	x4259739.exe	85
PID 1052 wrote to memory of 1584	1052	x4259739.exe	85
PID 1052 wrote to memory of 1584	1052	x4259739.exe	85
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1584 wrote to memory of 1200	1584	g7067525.exe	89
PID 1052 wrote to memory of 396	1052	x4259739.exe	90
PID 1052 wrote to memory of 396	1052	x4259739.exe	90
PID 1052 wrote to memory of 396	1052	x4259739.exe	90

C:\Users\Admin\AppData\Local\Temp\4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205.exe
"C:\Users\Admin\AppData\Local\Temp\4dc93952d5fe7ecacd61cc033cbd3cdb682618f54ff89b22880ba0684a40e205.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1280632.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1280632.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4259739.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4259739.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7067525.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7067525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i8842500.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i8842500.exe
      4⤵
      Executes dropped EXE
      PID:396

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1280632.exe

Filesize
493KB

MD5
14d4fa67a18aaada1644fc4dcc93596a

SHA1
d2db0e8278c0b57d06568226eddddf84763858a4

SHA256
e6925295a5cfdfaeaf0a5a31ee18e5fc986d8604c06b154354156463dbe75c62

SHA512
2d4aa7045a04eb13fca037dd1a667991398d98f3027e406839da813fdeb82ca570878f646119c24731e5dac4af62528cd12181a6dbc27c2ae864620e7c555b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4259739.exe

Filesize
327KB

MD5
ee3092ac4282ceb8582ce9298f3c6acd

SHA1
971119c9b747e162ab3a53e3fbd0e1c34cf0a656

SHA256
c1fa2783a470f3ceedf70fe345456bd71a1bb5af4d284a7ad18b05600ccd65a4

SHA512
ae9cc6cb16aae4c12052c06a4775a1a336f43c54de2cac9d6b8d63e55d366b0dd92236ef679a849f06c4e049e1537037400678e3997153c19e8954513d7f36fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7067525.exe

Filesize
256KB

MD5
0b2b8cdcfe0ac349caf9180ea5c19b6a

SHA1
5ec6eaf29bee4a054786585874d7c06f34554f14

SHA256
bcf979e5c4785bce1c222d454afdafebeb4d4838dbecf4d1a805012fb182bf7d

SHA512
49936df995ee506a6abbf66871dd63dfe90567336323afea186dcc5ccd70defe183ae115ed526ea5babc559fd5108365ee56102e7e920af76af13d60a6f1691d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i8842500.exe

Filesize
175KB

MD5
deeabb1c71c0c7d46203ca087cb11c16

SHA1
659c18947ddb81906bf0965574ea53fb0d63ca3e

SHA256
4f143fb700e8636254580c55580a5cb9dd3deeb6c7f67d59b30f7ddb4c764ef3

SHA512
e0731c58ed9ffd1fa64a0191c48f237e3c595d9f819ef4273ac91ccfa991460e17350aadca9d761ba6674b24b4a6d2145de2cbc57c916f0bfbf787909a8cadb7

Download Submit
memory/396-25-0x0000000000470000-0x00000000004A0000-memory.dmp

Filesize
192KB

Download
memory/396-26-0x0000000000C90000-0x0000000000C96000-memory.dmp

Filesize
24KB

Download
memory/396-27-0x0000000005490000-0x0000000005AA8000-memory.dmp

Filesize
6.1MB

Download
memory/396-28-0x0000000004F80000-0x000000000508A000-memory.dmp

Filesize
1.0MB

Download
memory/396-29-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/396-30-0x0000000004E70000-0x0000000004EAC000-memory.dmp

Filesize
240KB

Download
memory/396-31-0x0000000004EB0000-0x0000000004EFC000-memory.dmp

Filesize
304KB

Download
memory/1200-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download