healer | 2dae798f2fcb49ad5f375700dcbe54c08e9cc5c25fe542ebd7939aa5f5f023aa

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686.exe
Size

472KB
MD5

9356a23c1646ba20d0c9835c21cdbe9a
SHA1

ec98fa4e32404b377df2b2602d386cd057265c0c
SHA256

9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686
SHA512

8b4e5529ab5706631e49cb7d300954ac68c08b7529e2a607f541a1b9d8a2c5e69636ab96be88503cb966d24f5b0a2311a000c22c899f28f17f5c5120e529009d
SSDEEP

12288:SMrny90yzEsfm9kzqGttN+E62pnVoa60+4k:ty/EAx3o6Vg

Score

10^/10

healer redline moner dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

moner

77.91.124.82:19071

Attributes

auth_value
a94cd9e01643e1945b296c28a2f28707

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral12/memory/1440-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x00070000000233e6-16.dat	family_redline
behavioral12/memory/1652-18-0x0000000000DC0000-0x0000000000DF0000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
2224	x4266548.exe
3020	g9526465.exe
1652	i8813857.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4266548.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 1440	3020	g9526465.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1440	AppLaunch.exe
1440	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2224	5112	9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686.exe	82
PID 5112 wrote to memory of 2224	5112	9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686.exe	82
PID 5112 wrote to memory of 2224	5112	9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686.exe	82
PID 2224 wrote to memory of 3020	2224	x4266548.exe	83
PID 2224 wrote to memory of 3020	2224	x4266548.exe	83
PID 2224 wrote to memory of 3020	2224	x4266548.exe	83
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 3020 wrote to memory of 1440	3020	g9526465.exe	86
PID 2224 wrote to memory of 1652	2224	x4266548.exe	87
PID 2224 wrote to memory of 1652	2224	x4266548.exe	87
PID 2224 wrote to memory of 1652	2224	x4266548.exe	87

C:\Users\Admin\AppData\Local\Temp\9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686.exe
"C:\Users\Admin\AppData\Local\Temp\9e061347f64310d6e4bee03e70c36999f9e81fbcbba43f870f821e4fff10c686.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4266548.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4266548.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9526465.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9526465.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i8813857.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i8813857.exe
    3⤵
    - Executes dropped EXE
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4266548.exe

Filesize
306KB

MD5
4156732772b28c8bcc49af5e4223c8d7

SHA1
53f30d46876bfc9eaf57f4cfd3c7efb57645c543

SHA256
ba8d323ebba47c56444eb0989f62c54f06023b75b889b9137c83099022efc65b

SHA512
9aa96f4bafc960822061a00b449717eb96bbc808f05163bd408e584590679f7c2cee826b15b6e119cbed2a11ccc7c4c4174122e0657fc27b9021932dd7cdd929

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9526465.exe

Filesize
213KB

MD5
d9c9645eb14e0bc129120a208fa6bb4a

SHA1
281c85ff5b0c854e8d7f6d219dd4385f1d19006c

SHA256
84a0083fdb9925c25f22a46084fb2308793030687c05847da8f021d21a7cbda1

SHA512
cac15f1d832435501b915e9f4a80463e8d38ea72cb56b673a86e225cc841e8f02a7850fd432adfdd9414b22731038a8972189d003ceb84fe25a089f6bd80f706

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i8813857.exe

Filesize
174KB

MD5
780d09f1aab511ec4af3b49c0111b63f

SHA1
473abe67ad4a0218ddeef21bf42499c8d264502f

SHA256
dc668b2d2d7b5d70d3a41743ff6a8b9b9262b106b8705c7f44ef35d786c9f0c2

SHA512
c1551f20a122c7ba39adaedd5ddb378bbd471640ee79152667715458f7cca653682da2b19c112a31f681d248ed332d04d9e24f051c61ca11f6429d131e6083a7

Download Submit
memory/1440-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1652-18-0x0000000000DC0000-0x0000000000DF0000-memory.dmp

Filesize
192KB

Download
memory/1652-19-0x00000000055E0000-0x00000000055E6000-memory.dmp

Filesize
24KB

Download
memory/1652-20-0x0000000005D30000-0x0000000006348000-memory.dmp

Filesize
6.1MB

Download
memory/1652-21-0x0000000005820000-0x000000000592A000-memory.dmp

Filesize
1.0MB

Download
memory/1652-22-0x0000000005750000-0x0000000005762000-memory.dmp

Filesize
72KB

Download
memory/1652-23-0x00000000057B0000-0x00000000057EC000-memory.dmp

Filesize
240KB

Download
memory/1652-24-0x0000000005930000-0x000000000597C000-memory.dmp

Filesize
304KB

Download