healer | ffe8fa0cf1ed446eeb9dc6eef440d6e2121396f13b66e26a431adcd9f2d605e3

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe
Size

729KB
MD5

82c85db59edaa8dc52bf1c07c43bf40b
SHA1

94560464456584401c8bb85a979a43cd91dde5dc
SHA256

5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7
SHA512

4c5e45ccf84d7fae3168c99afacefc436faa185eeb1038b11ffeb3bb120515a4ba61756c84c5fa9c60d81774c8de1841372cffdfb60d7d151fc8923a124e179d
SSDEEP

12288:uMrvy90TqAzTul9aPd5v/QYxKNFAdtI2DPCztUKAMhFN+08EvFne99jnEl5m4cdz:xyKX3R5HSIt3u2B8FN709Il5hy/r7zJ

Score

10^/10

healer redline ramon dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ramon

77.91.124.82:19071

Attributes

auth_value
3197576965d9513f115338c233015b40

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral11/memory/2124-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral11/files/0x000700000002347e-16.dat	family_redline
behavioral11/memory/4920-18-0x0000000000940000-0x0000000000970000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
244	x9581646.exe
692	g5930192.exe
4920	h9341362.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9581646.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 692 set thread context of 2124	692	g5930192.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	AppLaunch.exe
2124	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	AppLaunch.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 244	4868	5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe	83
PID 4868 wrote to memory of 244	4868	5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe	83
PID 4868 wrote to memory of 244	4868	5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe	83
PID 244 wrote to memory of 692	244	x9581646.exe	84
PID 244 wrote to memory of 692	244	x9581646.exe	84
PID 244 wrote to memory of 692	244	x9581646.exe	84
PID 692 wrote to memory of 1456	692	g5930192.exe	86
PID 692 wrote to memory of 1456	692	g5930192.exe	86
PID 692 wrote to memory of 1456	692	g5930192.exe	86
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 692 wrote to memory of 2124	692	g5930192.exe	87
PID 244 wrote to memory of 4920	244	x9581646.exe	88
PID 244 wrote to memory of 4920	244	x9581646.exe	88
PID 244 wrote to memory of 4920	244	x9581646.exe	88

C:\Users\Admin\AppData\Local\Temp\5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe
"C:\Users\Admin\AppData\Local\Temp\5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9581646.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9581646.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5930192.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5930192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1456
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9341362.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9341362.exe
    3⤵
    - Executes dropped EXE
    PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9581646.exe

Filesize
563KB

MD5
22965f7ec6f49c719bbae6f273909843

SHA1
902ad7a28c271298606ead82823c78aa31ea032d

SHA256
e5850ab8ff6f6795ef16fc89ad74de650d9c9f9553c6c777f91f78e8924a19c8

SHA512
230f15569b329c11a5d587e58e03af97cd8d9356d2c25baaca36d6ba910bedd74f9a2a663ebbf224377e76b4e2afae679965f62e496b20cbff6ad49ceb932e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5930192.exe

Filesize
1.6MB

MD5
eb3c0509f21f9d835a123677b6bbcb74

SHA1
86efb4b4e51a5d401a4e1d01e0cd3ba4d698a8fd

SHA256
83705d942d7b4383c880655f8fe209940e96a4be2cb7fa06aaccde563433ceff

SHA512
593228c929b5301fbd6ecff79dd300664cba57fe7bfa4d94d5d0b0eda27c13e30b7e05015a516138d66b7da4cbff42f9db37e3f673979e705e61f14838f5d2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9341362.exe

Filesize
174KB

MD5
fe84e130785d60cc5d8850a4894ef7a0

SHA1
7fcc729ad8bc46daf45957b9578c6cc8ae08c391

SHA256
77496efa7a2d722a7841136d62f21e701ce9d4c3c87eb799c0de54e978289313

SHA512
5e2cea1922e6a6ad8d45e1767817ed62e554127e279a6cea81030757c43677937e3ad1d956ebed9ef6ce2a62bd6f09af760cd4382b26753269c38c4aaf9ce26c

Download Submit
memory/2124-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4920-18-0x0000000000940000-0x0000000000970000-memory.dmp

Filesize
192KB

Download
memory/4920-19-0x00000000076F0000-0x00000000076F6000-memory.dmp

Filesize
24KB

Download
memory/4920-20-0x000000000AD70000-0x000000000B388000-memory.dmp

Filesize
6.1MB

Download
memory/4920-21-0x000000000A8F0000-0x000000000A9FA000-memory.dmp

Filesize
1.0MB

Download
memory/4920-22-0x000000000A830000-0x000000000A842000-memory.dmp

Filesize
72KB

Download
memory/4920-23-0x000000000A890000-0x000000000A8CC000-memory.dmp

Filesize
240KB

Download
memory/4920-24-0x0000000004CF0000-0x0000000004D3C000-memory.dmp

Filesize
304KB

Download