healer | ffe8fa0cf1ed446eeb9dc6eef440d6e2121396f13b66e26a431adcd9f2d605e3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe
Size

628KB
MD5

128b755cd25a91c7322dd65c70ff4f7a
SHA1

c61f3449981c9389672005c0976b26a2f5288950
SHA256

8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5
SHA512

06573cef4530821eb96c797802a3920c98781aeb7b75fc3812c9b4b11cf49e04706580be12a1a6f7b856725e1371c5d178699cc25e22cd4105cd8ef7a4eef441
SSDEEP

12288:xMr+y90wTyutwnA6Swsg7w2OwEpzU+5kbesfe6g4mEk0A80:zyRP/HgB0pzU+eyLx4Zk070

Score

10^/10

healer redline buben dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

buben

77.91.124.82:19071

Attributes

auth_value
c62fa04aa45f5b78f62d2c21fcbefdec

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral18/memory/3424-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral18/files/0x0007000000023430-17.dat	family_redline
behavioral18/memory/3892-19-0x0000000000860000-0x0000000000890000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
1560	x6712598.exe
2636	g5675384.exe
3892	h1166075.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x6712598.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2636 set thread context of 3424	2636	g5675384.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3320	2636	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3424	AppLaunch.exe
3424	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 1560	3964	8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe	84
PID 3964 wrote to memory of 1560	3964	8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe	84
PID 3964 wrote to memory of 1560	3964	8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe	84
PID 1560 wrote to memory of 2636	1560	x6712598.exe	85
PID 1560 wrote to memory of 2636	1560	x6712598.exe	85
PID 1560 wrote to memory of 2636	1560	x6712598.exe	85
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 2636 wrote to memory of 3424	2636	g5675384.exe	88
PID 1560 wrote to memory of 3892	1560	x6712598.exe	93
PID 1560 wrote to memory of 3892	1560	x6712598.exe	93
PID 1560 wrote to memory of 3892	1560	x6712598.exe	93

C:\Users\Admin\AppData\Local\Temp\8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe
"C:\Users\Admin\AppData\Local\Temp\8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6712598.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6712598.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5675384.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5675384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 584
      4⤵
      Program crash
      PID:3320
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1166075.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1166075.exe
    3⤵
    - Executes dropped EXE
    PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2636 -ip 2636
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6712598.exe

Filesize
443KB

MD5
14af3187195ca11ff6f1455ed1a03b96

SHA1
76e62d3dbd6f2daaa690602d5ab0cc5d0b60c8fc

SHA256
796ad9df894fba0df29f9dc90f4d1741dc436eba68503d9cd8dcff5ebac65026

SHA512
fa63a527359daf4dde455aba264fe6059b7ea96e5735e923f43e1822eacf13e6d1cd669261fe5cf9e750bcd2c8b9b33205cf5f049d59342df10dbfb4577cd70a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5675384.exe

Filesize
861KB

MD5
624be5e5545abc5ebee0d55b266b9310

SHA1
1a2924902fc7d05a3e343ab6b3abfb07fcd54266

SHA256
1552ecbd24ac9ee229416c679673cae800c48490e241721f91b538355702d3e7

SHA512
f78db8733e1c5ed94dd384d091244bf781e8e1c1c27182705d0537fc2049b13e643b5a5de13ef207430c5cc74c8350447b040ccfda25e14c789e4c58366bf589

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1166075.exe

Filesize
174KB

MD5
c6e8730d9d8f1a8e339ac201594a15f3

SHA1
f27ff1a5a9a7cb1e1374f21b0297054df9c17e36

SHA256
0dc67f2e648d4d96be4dccd6b9d8b0dda074c8b04f6d95c9a2827a157d0b6519

SHA512
a9a69e1b1162ae7ac25e62bb45c856eeae7b8532307903669d8a428abd5c548ffba921a4a3c5e24092f236340edd0385a846380f188cc5d38d08aa9baebe433d

Download Submit
memory/3424-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3424-15-0x00000000740AE000-0x00000000740AF000-memory.dmp

Filesize
4KB

Download
memory/3892-19-0x0000000000860000-0x0000000000890000-memory.dmp

Filesize
192KB

Download
memory/3892-20-0x00000000011D0000-0x00000000011D6000-memory.dmp

Filesize
24KB

Download
memory/3892-21-0x00000000057D0000-0x0000000005DE8000-memory.dmp

Filesize
6.1MB

Download
memory/3892-22-0x00000000052C0000-0x00000000053CA000-memory.dmp

Filesize
1.0MB

Download
memory/3892-23-0x00000000051F0000-0x0000000005202000-memory.dmp

Filesize
72KB

Download
memory/3892-24-0x0000000005250000-0x000000000528C000-memory.dmp

Filesize
240KB

Download
memory/3892-25-0x00000000053D0000-0x000000000541C000-memory.dmp

Filesize
304KB

Download