healer | e510eb004c3f163b6d476aebac17617de993a7a0ea7dbf178449c1f345ebab0b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe
Size 511KB
Sample241109-d2c22ayrdq
SHA256 7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b
MD5 f5edc71dee702c11351951d3dc5f8c48
SHA1 32138f7a7bc344eab27815d879f04b213a688e62
SHA512 e2f444025fe5b301d739e75d4eeb50e55bacd401005f0b0f247c01075a7228e7f07b5bbdb5f43be82f09d9ed2d425e06d15ec1c48564f33915098547161200df
SSDEEP 12288:PBEiZHdBaDrb6ibufsa4W9Xk5640GWJfpMMjhg1mVko:PBU9b6XklvsfpvK18ko
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer redline redko discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

redko

62.204.41.170:4179

Attributes

auth_value
9bcf7b0620ff067017d66b9a5d80b547

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b3d-16.dat	healer
behavioral2/memory/3212-19-0x0000000000AC0000-0x0000000000ACA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	loda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	loda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	loda.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b41-27.dat	family_redline
behavioral2/memory/2332-30-0x00000000002C0000-0x00000000002F2000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1312	hook.exe
3212	loda.exe
2332	redko.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	loda.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hook.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hook.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	redko.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3212	loda.exe
3212	loda.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	loda.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1312	3936	7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe	90
PID 3936 wrote to memory of 1312	3936	7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe	90
PID 3936 wrote to memory of 1312	3936	7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe	90
PID 1312 wrote to memory of 3212	1312	hook.exe	91
PID 1312 wrote to memory of 3212	1312	hook.exe	91
PID 1312 wrote to memory of 2332	1312	hook.exe	104
PID 1312 wrote to memory of 2332	1312	hook.exe	104
PID 1312 wrote to memory of 2332	1312	hook.exe	104

C:\Users\Admin\AppData\Local\Temp\7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe
"C:\Users\Admin\AppData\Local\Temp\7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hook.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hook.exe
Size 192KB
SHA256 cabfabebf356f52925d5b5aa2a50e4979e020db5cca00f3e36c94aacff53fe8d
MD5 cd804ba80f2ec30311965af7071eb96a
SHA1 d2256177e0e934624e0821a86c9aeffb075607e9
SHA512 bce8b566fac667133a8ffc1c4be5dd6ea4eaa7ec9de8a3127b589606902476f974fcf6e9db331e3768d301b64234fac26a2e83fbbd1eaf3846495dc6f76da608
SSDEEP 3072:2OhX0N7+f135GWp1icKAArDZz4N9GhbkrNEk1/N4S0KEvkEEwqbDTdsYGF297/:bhEN7+bp0yN90QEsGS0yEtG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

loda.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\loda.exe
Size 11KB
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

redko.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\redko.exe
Size 175KB
SHA256 1ab89ee322d5eb379129abd500726a8d709899b44f12825457902d360810f38c
MD5 bc928465d24e037fb2009bd5668c80f5
SHA1 3ac1119fe355f2dae8d78bbe867c0cd24b9564a2
SHA512 951621178d8e0f63daea8e725d1e19968b7da3714b66f82a6ab6ef075a7b1fbb295b92efa9e57f06b6e5dda126c5e5927fb190fde0944c5a55ed69e98ee2cfe6
SSDEEP 3072:yxqZWJBaKULo3sKanNeZ59Yhy/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwV:gqZIsKweYh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2332-37-0x00000000745EE000-0x00000000745EF000-memory.dmp

Download

memory/2332-35-0x0000000004CF0000-0x0000000004D3C000-memory.dmp

Download

memory/2332-34-0x0000000004D50000-0x0000000004D8C000-memory.dmp

Download

memory/2332-33-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

Download

memory/2332-32-0x0000000004DA0000-0x0000000004EAA000-memory.dmp

Download

memory/2332-31-0x0000000005230000-0x0000000005848000-memory.dmp

Download

memory/2332-30-0x00000000002C0000-0x00000000002F2000-memory.dmp

Download

memory/2332-29-0x00000000745EE000-0x00000000745EF000-memory.dmp

Download

memory/3212-18-0x00007FFD8D053000-0x00007FFD8D055000-memory.dmp

Download

memory/3212-24-0x00007FFD8D053000-0x00007FFD8D055000-memory.dmp

Download

memory/3212-19-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

Download

memory/3936-23-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3936-22-0x0000000002250000-0x00000000022BC000-memory.dmp

Download

memory/3936-21-0x0000000000400000-0x00000000004ED000-memory.dmp

Download

memory/3936-20-0x0000000000770000-0x0000000000870000-memory.dmp

Download

memory/3936-1-0x0000000000770000-0x0000000000870000-memory.dmp

Download

memory/3936-3-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3936-2-0x0000000002250000-0x00000000022BC000-memory.dmp

Download