healer | d8d8e2bd36c25798e8243ccb42440baf3f49559a1e251f2f29e70b3d46f597ed | Triage

Resubmissions

23-06-2024 06:12

240623-gyd2psscqf 10

16-07-2023 19:09

230716-xt4pkahc8t 10

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 06:12

Sharing

Report Analysis Logs

General

Target

02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe
Size

726KB
MD5

603947b90bbf3dc52aa799d6d74ecc3f
SHA1

3af5d58a9da2971fdbe0097712d19051cf0eae81
SHA256

02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f
SHA512

ead2ec945c1853cacde72d20182cdb5d282e74b6a236d4cbd191faffb68e30f3a5afab117ae3fc73a1ef8ebb8d392eee07a18143f0b52240c4ea9433f6f3df31
SSDEEP

12288:nMrty908YkYKWr3HLkkKPYPGjBbrY6t34+ZOLtQ48ErdVhR0X+5:6yakYHHfKwqY694+Zct3lXD4M

Score

10^/10

healer redline duza dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

duza

C2

83.97.73.129:19071

Attributes

auth_value
787a4e3bbc78fd525526de1098cb0621

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/memory/3972-28-0x0000000000460000-0x000000000046A000-memory.dmp	healer
behavioral2/files/0x00070000000234ec-35.dat	healer
behavioral2/memory/1672-37-0x00000000001B0000-0x00000000001BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	j7404106.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k9327528.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234e9-40.dat	family_redline
behavioral2/memory/1668-42-0x00000000000B0000-0x00000000000E0000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
5100	y3662660.exe
4636	y0062469.exe
1248	y9151891.exe
3972	j7404106.exe
1672	k9327528.exe
1668	l3382483.exe

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k9327528.exe

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3662660.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y0062469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y9151891.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3972	j7404106.exe
3972	j7404106.exe
1672	k9327528.exe
1672	k9327528.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	j7404106.exe
Token: SeDebugPrivilege	1672	k9327528.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5100	5036	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe	80
PID 5036 wrote to memory of 5100	5036	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe	80
PID 5036 wrote to memory of 5100	5036	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe	80
PID 5100 wrote to memory of 4636	5100	y3662660.exe	81
PID 5100 wrote to memory of 4636	5100	y3662660.exe	81
PID 5100 wrote to memory of 4636	5100	y3662660.exe	81
PID 4636 wrote to memory of 1248	4636	y0062469.exe	82
PID 4636 wrote to memory of 1248	4636	y0062469.exe	82
PID 4636 wrote to memory of 1248	4636	y0062469.exe	82
PID 1248 wrote to memory of 3972	1248	y9151891.exe	83
PID 1248 wrote to memory of 3972	1248	y9151891.exe	83
PID 1248 wrote to memory of 3972	1248	y9151891.exe	83
PID 1248 wrote to memory of 1672	1248	y9151891.exe	85
PID 1248 wrote to memory of 1672	1248	y9151891.exe	85
PID 4636 wrote to memory of 1668	4636	y0062469.exe	86
PID 4636 wrote to memory of 1668	4636	y0062469.exe	86
PID 4636 wrote to memory of 1668	4636	y0062469.exe	86

C:\Users\Admin\AppData\Local\Temp\02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe
"C:\Users\Admin\AppData\Local\Temp\02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3662660.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3662660.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0062469.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0062469.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y9151891.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y9151891.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7404106.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7404106.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9327528.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9327528.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe
      4⤵
      Executes dropped EXE
      PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3662660.exe

Filesize
526KB

MD5
6289824a1644a295ca95c7618dfc2d57

SHA1
99dcc49a413a1cd103f3b84d63893f5693274f8a

SHA256
e4cdc42e8afc467142a629153fcfccf450227e6b3705d1c27bf779197ef1f546

SHA512
b15bb7263b9d05f326b7e42e6e7cc518b098614a94918aa25693747176801c0d983139b21e6214192bbd99b01fe483deb55d12255d0f48e6b838ed7b48faa700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0062469.exe

Filesize
354KB

MD5
caf9369f954917ec47ca66553998f145

SHA1
82f19fa39e630efce6562a44b74c332338f5c12f

SHA256
fe80270bc8981afb506e4aeb7781fbdb90b137c6ea7ec728f793413a4ecb2837

SHA512
88bddd3273f2d3b873f1414afdc4e21c1b8664cf2248e219e937e22ecb4a9309a2984406910ade9847a77bdd768636b9c0ac5cd7f46621b387241efeb7bd1f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe

Filesize
172KB

MD5
271700b19d450d6ec7df159584d5afdf

SHA1
52f6143c0f0f92c58757ab92af3401c19a8fe91a

SHA256
4dd3ce52ec8a76830130c2fff28eccddb6091417f50126ede4b36371525b4ba5

SHA512
aced014acce41469c11c1ba14f0faa6ccc53cb03cd045dd0944eb55b528967ae7870ecd163bff2bf7a52c58b861edec186390fcacb647048c43e7e60d2f22779

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y9151891.exe

Filesize
199KB

MD5
b536677bdd86084d557d956c8a1f9e82

SHA1
6be501a406dca1cade61a126ace78800895b14ba

SHA256
a76a9bb01ee56d41b16aa1454920546376f3d59152e25f0e2c58fe6744dcd7a6

SHA512
7d18a8abfe7570b3313e030f990650e6203dafbb9de18e3e75e2634f2a9c952a8be56a5739f767032e924bbe0b5643fcd092c4cfad2654e5b8e3925556fbbaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7404106.exe

Filesize
102KB

MD5
d4f4ac636a8e6b2d06da0e5b2ae19ad4

SHA1
f468bca795e587529c49d31dcfe657b97da7b44b

SHA256
c110ec903537181eca058ba0e1b702c084c4d5c6920d2edfcadbc7a314c32add

SHA512
cef572a202012404013cc725b32c4f888c0ea786cb4c1be1f5b401e5ba1d078d318e75092d83960b71c23891a7832717f85d9f5bbecdb55ba9a93751684d9c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9327528.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1668-43-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1668-42-0x00000000000B0000-0x00000000000E0000-memory.dmp

Filesize
192KB

Download
memory/1668-44-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/1668-45-0x0000000004C40000-0x0000000004D4A000-memory.dmp

Filesize
1.0MB

Download
memory/1668-46-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/1668-47-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Filesize
240KB

Download
memory/1668-48-0x0000000004D50000-0x0000000004D9C000-memory.dmp

Filesize
304KB

Download
memory/1672-37-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/3972-28-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download