healer | 5e831beab1114ac9acd665a6dc93e4478c72f9985bcae804c34864e3b6ee4705

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe
Size

266KB
MD5

92b109b60e7e409e768386150758814f
SHA1

199d17111133687ceb174167c8162e04b9ff6a4c
SHA256

92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1
SHA512

19f721fdbf6f3bdb6eed738f1470b21e64781aed40f96fd754930bd0c757067c2ee9618a131fe85e3bde3f582018aab39df6c94a7b1f4b3ecf81b17982f392f4
SSDEEP

6144:KIy+bnr+xp0yN90QE2Y3j+u6lkZh77lmNst3OnIpQP0HEbiqMx:MMr5y90d3j+u6lkj7lmmlqIpJHEGqMx

Score

10^/10

healer redline jokes dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

jokes

77.91.124.82:19071

Attributes

auth_value
fb7b36b70ae30fb2b72f789037350cdb

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral12/memory/4692-7-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x0007000000023456-10.dat	family_redline
behavioral12/memory/3960-12-0x0000000000620000-0x0000000000650000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
5088	g3403947.exe
3960	i2809977.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4692	5088	g3403947.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	5088	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	AppLaunch.exe
4692	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 5088	1844	92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe	85
PID 1844 wrote to memory of 5088	1844	92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe	85
PID 1844 wrote to memory of 5088	1844	92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe	85
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 5088 wrote to memory of 4692	5088	g3403947.exe	86
PID 1844 wrote to memory of 3960	1844	92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe	93
PID 1844 wrote to memory of 3960	1844	92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe	93
PID 1844 wrote to memory of 3960	1844	92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe	93

C:\Users\Admin\AppData\Local\Temp\92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe
"C:\Users\Admin\AppData\Local\Temp\92d5779e2c52f5941931dde42396f724a8986970826adad853ad885da3caccc1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g3403947.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g3403947.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 552
    3⤵
    - Program crash
    PID:812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2809977.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2809977.exe
  2⤵
  - Executes dropped EXE
  PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5088 -ip 5088
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g3403947.exe

Filesize
125KB

MD5
331e732137f9d80ad6911b6f3549d0af

SHA1
072d2aef9398ab3ccdb9c9705006ee3aa5993510

SHA256
cdc8c2b7b5d6f6cef80f057e7ea95a949398347d9dc9767e1be55bd240a3d5ea

SHA512
9a67c2b8f455ab9fd1d128b8841da66f8e5ae15664403a9f66f4bf3140071d8517584df8b27244d287f91c1dd4f2d05e7fbd3ca5851e1a8ffccf5c8df218a94d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2809977.exe

Filesize
174KB

MD5
fd8e3bc08ab5384eae01ffdae9783518

SHA1
346dc291db40ea11e7bed8a9805bbac3d6a70b9c

SHA256
eca59614c21fc65afac11396bd35b5ca98f36fd1773225c95eca73685cba69df

SHA512
92e60da84c9872f9c98db15316bdcf2049c6e8b65be4ba559ecc4f063aeae8e5572fac1149e7c85a67729dd1014c35f4ca4cf0a0266da8adbc70161e14a5786a

Download Submit
memory/3960-14-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/3960-12-0x0000000000620000-0x0000000000650000-memory.dmp

Filesize
192KB

Download
memory/3960-13-0x0000000002900000-0x0000000002906000-memory.dmp

Filesize
24KB

Download
memory/3960-15-0x0000000005610000-0x0000000005C28000-memory.dmp

Filesize
6.1MB

Download
memory/3960-16-0x0000000005100000-0x000000000520A000-memory.dmp

Filesize
1.0MB

Download
memory/3960-17-0x0000000004EB0000-0x0000000004EC2000-memory.dmp

Filesize
72KB

Download
memory/3960-18-0x0000000005030000-0x000000000506C000-memory.dmp

Filesize
240KB

Download
memory/3960-19-0x0000000005070000-0x00000000050BC000-memory.dmp

Filesize
304KB

Download
memory/3960-21-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4692-8-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/4692-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download