healer | 2c01e17d41a4593f93f10f51a6f06e99b5858a94bf07ef143ffc6dd758a1a8aa

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe
Size

593KB
MD5

ceeb4befaf7e9d80afc9c6dee12b6310
SHA1

e260dd80b10d44d0522226c207c43748b859122b
SHA256

2c01e17d41a4593f93f10f51a6f06e99b5858a94bf07ef143ffc6dd758a1a8aa
SHA512

d7c1a9acd472c99fed274c7bdcee37aaa3943af1ebc8c5a105b4edbfd6e4c9f807542b592aecfa52d5ab45686977e95a0ee33b8db39e1bd6e4389339bf259d85
SSDEEP

12288:gy90kukXimYvUW1k1wSTk06Jl54PNPURSFQkD:gyckT5ek1wSTfM4NPCSFQI

Score

10^/10

healer redline zgrat dropper evasion infostealer persistence rat trojan

Malware Config

Signatures

Detect ZGRat V1 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1536-51-0x00000000024F0000-0x000000000252C000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-53-0x0000000004E40000-0x0000000004E7A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-87-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-85-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-83-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-81-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-79-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-77-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-75-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-73-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-71-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-69-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-67-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-65-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-63-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-61-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-59-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-57-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-55-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-54-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_zgrat_v1

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4280-12-0x0000000000A90000-0x0000000000AAA000-memory.dmp	healer
behavioral1/memory/4280-14-0x00000000028C0000-0x00000000028D8000-memory.dmp	healer
behavioral1/memory/4280-20-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-42-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-40-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-36-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-35-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-32-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-30-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-29-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-26-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-24-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-22-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-18-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-16-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-38-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer
behavioral1/memory/4280-15-0x00000000028C0000-0x00000000028D2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

45953239.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	45953239.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	45953239.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	45953239.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	45953239.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	45953239.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	45953239.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1536-51-0x00000000024F0000-0x000000000252C000-memory.dmp	family_redline
behavioral1/memory/1536-53-0x0000000004E40000-0x0000000004E7A000-memory.dmp	family_redline
behavioral1/memory/1536-87-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-85-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-83-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-81-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-79-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-77-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-75-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-73-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-71-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-69-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-67-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-65-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-63-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-61-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-59-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-57-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-55-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline
behavioral1/memory/1536-54-0x0000000004E40000-0x0000000004E75000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 2 IoCs

Processes:

45953239.exerk259606.exe

pid process

4280 45953239.exe
1536 rk259606.exe

pid	process
4280	45953239.exe
1536	rk259606.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

45953239.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	45953239.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	45953239.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5108 4280 WerFault.exe 45953239.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

45953239.exe

pid process

4280 45953239.exe
4280 45953239.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

45953239.exerk259606.exe

description pid process

Token: SeDebugPrivilege 4280 45953239.exe
Token: SeDebugPrivilege 1536 rk259606.exe

pid	pid_target	process	target process
5108	4280	WerFault.exe	45953239.exe

pid	process
4280	45953239.exe
4280	45953239.exe

description	pid	process
Token: SeDebugPrivilege	4280	45953239.exe
Token: SeDebugPrivilege	1536	rk259606.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe

description	pid	process	target process
PID 3432 wrote to memory of 4280	3432	ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe	45953239.exe
PID 3432 wrote to memory of 4280	3432	ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe	45953239.exe
PID 3432 wrote to memory of 4280	3432	ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe	45953239.exe
PID 3432 wrote to memory of 1536	3432	ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe	rk259606.exe
PID 3432 wrote to memory of 1536	3432	ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe	rk259606.exe
PID 3432 wrote to memory of 1536	3432	ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe	rk259606.exe

C:\Users\Admin\AppData\Local\Temp\ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ceeb4befaf7e9d80afc9c6dee12b6310_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3432

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\45953239.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\45953239.exe
2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 968
3⤵
- Program crash
PID:5108

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk259606.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk259606.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4280 -ip 4280
1⤵
PID:3392

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\45953239.exe
Filesize
377KB

MD5
54e8e25f5398e5bcc4f3ba6a8ca83f8b

SHA1
074cde6f42aa8a98fcca9ff63303617bf012a87b

SHA256
9bcf3935cf9780f5ec38d09e08f82737aa0e7bb587615f35fb3099c36e95230d

SHA512
8a714d1d632cc3178d0785bd361f3845be224aa7b87258a46467c858c0c1ec20196ce329a984bc8a30a3b0445449b679de853c5e5ba0a35824c22b1d6afb1747

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk259606.exe
Filesize
459KB

MD5
21f612126ff1ba55c0a232ee639832b9

SHA1
7159c50575e311f5cd287703e09d8d3a6847b12f

SHA256
94141402770301535736e7886f3710f4ec1afd6d14a31fec73b9b819d9c1ddf9

SHA512
a5e8728066d61331d82eb0cf8cd50c60261b11b5564ca46a42cdc6e1e6be04147c0e317b74877fb608dcb907acd551e4e22dfe8d97f7bed20657417811583916

Download Submit
memory/1536-67-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-61-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-51-0x00000000024F0000-0x000000000252C000-memory.dmp

Filesize
240KB

Download
memory/1536-850-0x0000000004970000-0x00000000049BC000-memory.dmp

Filesize
304KB

Download
memory/1536-53-0x0000000004E40000-0x0000000004E7A000-memory.dmp

Filesize
232KB

Download
memory/1536-849-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/1536-848-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/1536-847-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/1536-846-0x0000000007900000-0x0000000007F18000-memory.dmp

Filesize
6.1MB

Download
memory/1536-54-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-55-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-57-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-59-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-87-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-63-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-52-0x0000000000400000-0x0000000000817000-memory.dmp

Filesize
4.1MB

Download
memory/1536-65-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-69-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-71-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-73-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-75-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-77-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-79-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-81-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-83-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/1536-85-0x0000000004E40000-0x0000000004E75000-memory.dmp

Filesize
212KB

Download
memory/4280-13-0x0000000004FD0000-0x0000000005574000-memory.dmp

Filesize
5.6MB

Download
memory/4280-24-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-9-0x00000000008F0000-0x000000000091D000-memory.dmp

Filesize
180KB

Download
memory/4280-11-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/4280-10-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4280-46-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4280-45-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/4280-15-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-38-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-16-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-18-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-8-0x0000000000AC0000-0x0000000000BC0000-memory.dmp

Filesize
1024KB

Download
memory/4280-22-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-26-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-29-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-30-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-32-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-35-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-36-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-40-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-42-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-20-0x00000000028C0000-0x00000000028D2000-memory.dmp

Filesize
72KB

Download
memory/4280-14-0x00000000028C0000-0x00000000028D8000-memory.dmp

Filesize
96KB

Download
memory/4280-12-0x0000000000A90000-0x0000000000AAA000-memory.dmp

Filesize
104KB

Download