healer | 47203fc7445c1e0e06643f363dd7d86ccc46b70ab234e5fbfe72badfdd6704ae

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe
Size

731KB
MD5

112db50547c96fbd04324315704f6e9e
SHA1

418dd3a11725960471343871707ee5fe19499344
SHA256

5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded
SHA512

9587f5f04c4f2c2b771669cc5e7b33c961330dfe571eecffc5b68b7de14c269ad970236b139a5ddeea9c54f13086dd53578d657943c601513f383e6215b8af47
SSDEEP

12288:yMrhy90NIIWVW8iKoQOYUxgVQbrpqBImN3V9zMniNPmRSIQPgOb5G/iGKzKh:7yWlWzOQOYK3pqBbbqidmgIsgOb4zKzm

Score

10^/10

healer redline ramon dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ramon

77.91.124.82:19071

Attributes

auth_value
3197576965d9513f115338c233015b40

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral5/memory/4948-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7554652.exe	family_redline
behavioral5/memory/216-18-0x00000000005D0000-0x0000000000600000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

x2952874.exeg5097699.exei7554652.exe

pid process

4956 x2952874.exe
4612 g5097699.exe
216 i7554652.exe

pid	process
4956	x2952874.exe
4612	g5097699.exe
216	i7554652.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exex2952874.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2952874.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

g5097699.exe

description pid process target process

PID 4612 set thread context of 4948 4612 g5097699.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

4948 AppLaunch.exe
4948 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4948 AppLaunch.exe

description	pid	process	target process
PID 4612 set thread context of 4948	4612	g5097699.exe	AppLaunch.exe

pid	process
4948	AppLaunch.exe
4948	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4948	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exex2952874.exeg5097699.exe

description	pid	process	target process
PID 1204 wrote to memory of 4956	1204	5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe	x2952874.exe
PID 1204 wrote to memory of 4956	1204	5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe	x2952874.exe
PID 1204 wrote to memory of 4956	1204	5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe	x2952874.exe
PID 4956 wrote to memory of 4612	4956	x2952874.exe	g5097699.exe
PID 4956 wrote to memory of 4612	4956	x2952874.exe	g5097699.exe
PID 4956 wrote to memory of 4612	4956	x2952874.exe	g5097699.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4612 wrote to memory of 4948	4612	g5097699.exe	AppLaunch.exe
PID 4956 wrote to memory of 216	4956	x2952874.exe	i7554652.exe
PID 4956 wrote to memory of 216	4956	x2952874.exe	i7554652.exe
PID 4956 wrote to memory of 216	4956	x2952874.exe	i7554652.exe

C:\Users\Admin\AppData\Local\Temp\5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe
"C:\Users\Admin\AppData\Local\Temp\5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2952874.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2952874.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4956

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5097699.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5097699.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7554652.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7554652.exe
3⤵
- Executes dropped EXE
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2952874.exe

Filesize
566KB

MD5
054e7213bf2d3a995fefc15c3186b012

SHA1
8a1de7ed0324a36de175585ba62d3e5c7ad3ef3d

SHA256
f6dad52c3f4377d04183dfc4baff82ea3bb21d5cbe14cfd5ee3511405dc2e63a

SHA512
378eb4149f992d5dec6d49fb24076c3a9c7e583be3a78e30afec150a18c6e5cc62fd1d9cd6e36344448d6e2518322d111996fad444b70389c0b26d0a6d96ad97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5097699.exe

Filesize
1.6MB

MD5
565e6aa1ec6835147af729da237c11bc

SHA1
fa1ec5a6d70ad5a21296353d482bb5a49c3f5b4d

SHA256
715b72aea95b100dc88b072df365fab27be3708ca84ed8a6ec966353e5de61f6

SHA512
7eecf29c4845a97d5f29b7e005d4d97df96eb7f3c449c55549e71e1549b91c06d31bbe99d37b52be30de23a8158f74660f3bcc25faff22081081b91a35ebb99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i7554652.exe

Filesize
174KB

MD5
e51fb989fbba83f136f1af5cf092dfc3

SHA1
a473b0c0cbf97ee54cbbffd5ad228b606043777c

SHA256
2453e485fc9226dfcbb130a292097a09325306c30797d82d3f316d25a72a59c7

SHA512
bd3abf8e0548bde13605372b1dce8c7c840a832b9018728528a66684313d52ddf46f87367b802aa99bdd11e2e52e1dc29a238caf1eb7a04a4f2d287e3978c149

Download Submit
memory/216-18-0x00000000005D0000-0x0000000000600000-memory.dmp

Filesize
192KB

Download
memory/216-19-0x0000000000E40000-0x0000000000E46000-memory.dmp

Filesize
24KB

Download
memory/216-20-0x0000000005600000-0x0000000005C18000-memory.dmp

Filesize
6.1MB

Download
memory/216-21-0x00000000050F0000-0x00000000051FA000-memory.dmp

Filesize
1.0MB

Download
memory/216-22-0x0000000004F60000-0x0000000004F72000-memory.dmp

Filesize
72KB

Download
memory/216-23-0x0000000004FE0000-0x000000000501C000-memory.dmp

Filesize
240KB

Download
memory/216-24-0x0000000005020000-0x000000000506C000-memory.dmp

Filesize
304KB

Download
memory/4948-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download