healer | d8d8e2bd36c25798e8243ccb42440baf3f49559a1e251f2f29e70b3d46f597ed | Triage

Resubmissions

23-06-2024 06:12

240623-gyd2psscqf 10

16-07-2023 19:09

230716-xt4pkahc8t 10

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 06:12

Sharing

Report Analysis Logs

General

Target

07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe
Size

787KB
MD5

b9c9f8149471777598683a218736c2df
SHA1

37742f6bd47a5a6697615f083dae05d4d2f24b38
SHA256

07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c
SHA512

18b161a37c5ac4ec9734f2481190e50b8d00c5a3d5c406ecb2e77092a3af0874b5f01da5694eb34481d947960b098026ce8575d5b88c676926564d22320a3fa6
SSDEEP

12288:yMray90VrufvvB9pzkydTWjtKXbAN95yilwCzaowl9/vp++B20:kydpFTWjtKMONc+d

Score

10^/10

healer redline grom dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

grom

C2

83.97.73.129:19071

Attributes

auth_value
2193aac8692a5e1ec66d9db9fa25ee00

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral6/memory/568-29-0x0000000000540000-0x000000000054A000-memory.dmp	healer
behavioral6/files/0x0007000000023688-36.dat	healer
behavioral6/memory/3928-38-0x0000000000C90000-0x0000000000C9A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b2992082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b2992082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2457677.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b2992082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b2992082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2457677.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2457677.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b2992082.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b2992082.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a2457677.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2457677.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2457677.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral6/memory/3276-43-0x0000000000520000-0x0000000000550000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
1740	v4685395.exe
5024	v7971535.exe
776	v4359797.exe
568	a2457677.exe
3928	b2992082.exe
3276	c5056218.exe

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a2457677.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2457677.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b2992082.exe

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4685395.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7971535.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v4359797.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
568	a2457677.exe
568	a2457677.exe
3928	b2992082.exe
3928	b2992082.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	a2457677.exe
Token: SeDebugPrivilege	3928	b2992082.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 1740	3628	07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe	83
PID 3628 wrote to memory of 1740	3628	07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe	83
PID 3628 wrote to memory of 1740	3628	07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe	83
PID 1740 wrote to memory of 5024	1740	v4685395.exe	84
PID 1740 wrote to memory of 5024	1740	v4685395.exe	84
PID 1740 wrote to memory of 5024	1740	v4685395.exe	84
PID 5024 wrote to memory of 776	5024	v7971535.exe	85
PID 5024 wrote to memory of 776	5024	v7971535.exe	85
PID 5024 wrote to memory of 776	5024	v7971535.exe	85
PID 776 wrote to memory of 568	776	v4359797.exe	86
PID 776 wrote to memory of 568	776	v4359797.exe	86
PID 776 wrote to memory of 568	776	v4359797.exe	86
PID 776 wrote to memory of 3928	776	v4359797.exe	92
PID 776 wrote to memory of 3928	776	v4359797.exe	92
PID 5024 wrote to memory of 3276	5024	v7971535.exe	93
PID 5024 wrote to memory of 3276	5024	v7971535.exe	93
PID 5024 wrote to memory of 3276	5024	v7971535.exe	93

C:\Users\Admin\AppData\Local\Temp\07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe
"C:\Users\Admin\AppData\Local\Temp\07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4685395.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4685395.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7971535.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7971535.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4359797.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4359797.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2457677.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2457677.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2992082.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2992082.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5056218.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5056218.exe
      4⤵
      Executes dropped EXE
      PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4685395.exe

Filesize
593KB

MD5
df3ed35595e7e344ac2225272ca6656d

SHA1
6481822e9009464bbf2e234e17131a531a77f156

SHA256
ffc74b5a10e32b12c6ff6f01e998b1222e3af10be0b67976e38bc7dd883fed81

SHA512
9f8e13ddab84e3ba5405b304db2ca27493f86fc5ed77f12cec8912c16adf7d1673bdda20b3ccd9adb1f98e8c1f7afe762a2f6737b907d2ba6b11a8b7d19b3baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7971535.exe

Filesize
421KB

MD5
777c0a5cab6dad75367466eea8f4f99a

SHA1
baa3bb2f3b027b22c3a31e260bcb066269d801e2

SHA256
308570021ba0b58a3f5642f11e10e6c118c3c6d48de7b93740fe794fe6c3c203

SHA512
4198e6bf650771c5065404b188b8d7a121104f121e98e6d77c435d7d5882ba4457a15bc84859a97781bcb46245979a479da7418285d0523bcb6161afbe978a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c5056218.exe

Filesize
251KB

MD5
8ebb652107071f5ab8b44f6e82d6cf5f

SHA1
80683f489e33ac490a4567617452b8a67e7edb79

SHA256
adff798caade8a719ba6cda92bd72ca870299f6914f6b1cd6ee6803ca12ae041

SHA512
af2f5e5e888ec194e774ea8fe8a1456e423eb35031bd28d7b108d84089dc128b19fc796e05531ca4323cf4f3ad695a805912860622ce09f2d83585e620124b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4359797.exe

Filesize
227KB

MD5
f450c694e85356307b283e415e3ae7c0

SHA1
915610c2b2f5788ce5f98bb112b07dc6cfc3c281

SHA256
74b8482a898b61f13eefcdf29c05eb9639251adf75480df6e0f253370b92e07e

SHA512
d67f932f72c24de4b1dd2c91b5875f69ca23201515b04aa4f89c30b65f3989be8208d72a05752ff3d23abc6fecd845c6787537b12893b97b5c4a3a7c798e4bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2457677.exe

Filesize
176KB

MD5
211a06e9ae68ced1234252a48696431b

SHA1
69950e2ee2fafd177d1a295836713bfd8d18df9c

SHA256
0bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d

SHA512
b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2992082.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/568-28-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/568-29-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download
memory/3276-43-0x0000000000520000-0x0000000000550000-memory.dmp

Filesize
192KB

Download
memory/3276-48-0x00000000023D0000-0x00000000023D6000-memory.dmp

Filesize
24KB

Download
memory/3276-49-0x0000000009F40000-0x000000000A558000-memory.dmp

Filesize
6.1MB

Download
memory/3276-50-0x000000000A560000-0x000000000A66A000-memory.dmp

Filesize
1.0MB

Download
memory/3276-51-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3276-52-0x000000000A670000-0x000000000A6AC000-memory.dmp

Filesize
240KB

Download
memory/3276-53-0x0000000002320000-0x000000000236C000-memory.dmp

Filesize
304KB

Download
memory/3928-38-0x0000000000C90000-0x0000000000C9A000-memory.dmp

Filesize
40KB

Download