healer | 1aa612c673e0e8506776c3b8740894f0947bb33bd7b5f22dc14212289801a024

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe
Size

465KB
MD5

5c67808b656205321897724516b25c6a
SHA1

3e940a5fea71a3c510eabaebfc346b6cede331f8
SHA256

b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd
SHA512

656aa047c084f5b81903ee4ef2e8e87c0d557218fefd4c84e9e2aecffba9a7147a89a97b5f954e24dd07643749ea63c04ae4c326baa1298e7d0a635c44a0c8c7
SSDEEP

12288:YMrOy90fn0NKjKQhHA1SFyw64y2DTM+q4:WyPoK4gm64y200

Score

10^/10

healer redline buben dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

buben

77.91.124.82:19071

Attributes

auth_value
c62fa04aa45f5b78f62d2c21fcbefdec

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral15/memory/2900-7-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral15/files/0x0007000000023418-10.dat	family_redline
behavioral15/memory/2576-12-0x00000000008A0000-0x00000000008D0000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1820	g2779674.exe
2576	h2878870.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1820 set thread context of 2900	1820	g2779674.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2448	1820	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	AppLaunch.exe
2900	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 1820	3296	b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe	83
PID 3296 wrote to memory of 1820	3296	b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe	83
PID 3296 wrote to memory of 1820	3296	b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe	83
PID 1820 wrote to memory of 4592	1820	g2779674.exe	85
PID 1820 wrote to memory of 4592	1820	g2779674.exe	85
PID 1820 wrote to memory of 4592	1820	g2779674.exe	85
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 1820 wrote to memory of 2900	1820	g2779674.exe	86
PID 3296 wrote to memory of 2576	3296	b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe	92
PID 3296 wrote to memory of 2576	3296	b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe	92
PID 3296 wrote to memory of 2576	3296	b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe	92

C:\Users\Admin\AppData\Local\Temp\b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe
"C:\Users\Admin\AppData\Local\Temp\b12350798c654ae949a005844c65ef16d136ad08598227c8041fe8bb48e6dcbd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g2779674.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g2779674.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 140
    3⤵
    - Program crash
    PID:2448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h2878870.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h2878870.exe
  2⤵
  - Executes dropped EXE
  PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1820 -ip 1820
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g2779674.exe

Filesize
899KB

MD5
e829ce547c5be1cd263c88beec82f48d

SHA1
5c4568f0f9eb99439898e32cbf75b6d69efb7453

SHA256
5af500b6b3b8be045d276abce5be151c057b739ff9439f9fb4740285fb54277d

SHA512
1d11ffdfbf497815c5c588f5b6eb2ede1b4994d2f0167fca7977133f31fb7c7bdfc82ae52199cd4ca277a256e8f78efb5249aa7d62882c42778921c5b3806ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h2878870.exe

Filesize
174KB

MD5
1b51b2d863f4bf00441ad1efd2880ce8

SHA1
d571b8c09671d4db37be6c2e62b753787a248e85

SHA256
0c6731f17d8873eb91514cb5a0419b9a23704a143fb414cd5cb38132efc05944

SHA512
0bf3570620819244f966fd2c8b90ecf72f5123b371e8a79839674962bb9f542ccf166bbae304e604af811c4f3472c5166dc274a31e8f99d9ab47dbcbcd537271

Download Submit
memory/2576-12-0x00000000008A0000-0x00000000008D0000-memory.dmp

Filesize
192KB

Download
memory/2576-13-0x0000000001240000-0x0000000001246000-memory.dmp

Filesize
24KB

Download
memory/2576-14-0x00000000058B0000-0x0000000005EC8000-memory.dmp

Filesize
6.1MB

Download
memory/2576-15-0x00000000053A0000-0x00000000054AA000-memory.dmp

Filesize
1.0MB

Download
memory/2576-16-0x0000000005220000-0x0000000005232000-memory.dmp

Filesize
72KB

Download
memory/2576-17-0x0000000005290000-0x00000000052CC000-memory.dmp

Filesize
240KB

Download
memory/2576-18-0x00000000052D0000-0x000000000531C000-memory.dmp

Filesize
304KB

Download
memory/2900-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2900-8-0x00000000740CE000-0x00000000740CF000-memory.dmp

Filesize
4KB

Download