healer | d8d8e2bd36c25798e8243ccb42440baf3f49559a1e251f2f29e70b3d46f597ed

Resubmissions

23-06-2024 06:12

240623-gyd2psscqf 10

16-07-2023 19:09

230716-xt4pkahc8t 10

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe
Size

726KB
MD5

603947b90bbf3dc52aa799d6d74ecc3f
SHA1

3af5d58a9da2971fdbe0097712d19051cf0eae81
SHA256

02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f
SHA512

ead2ec945c1853cacde72d20182cdb5d282e74b6a236d4cbd191faffb68e30f3a5afab117ae3fc73a1ef8ebb8d392eee07a18143f0b52240c4ea9433f6f3df31
SSDEEP

12288:nMrty908YkYKWr3HLkkKPYPGjBbrY6t34+ZOLtQ48ErdVhR0X+5:6yakYHHfKwqY694+Zct3lXD4M

Score

10^/10

healer redline duza dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

duza

83.97.73.129:19071

Attributes

auth_value
787a4e3bbc78fd525526de1098cb0621

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3972-28-0x0000000000460000-0x000000000046A000-memory.dmp	healer
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9327528.exe	healer
behavioral2/memory/1672-37-0x00000000001B0000-0x00000000001BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

j7404106.exek9327528.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k9327528.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	j7404106.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k9327528.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe family_redline
behavioral2/memory/1668-42-0x00000000000B0000-0x00000000000E0000-memory.dmp family_redline
Executes dropped EXE 6 IoCs

Processes:

y3662660.exey0062469.exey9151891.exej7404106.exek9327528.exel3382483.exe

pid process

5100 y3662660.exe
4636 y0062469.exe
1248 y9151891.exe
3972 j7404106.exe
1672 k9327528.exe
1668 l3382483.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe	family_redline
behavioral2/memory/1668-42-0x00000000000B0000-0x00000000000E0000-memory.dmp	family_redline

pid	process
5100	y3662660.exe
4636	y0062469.exe
1248	y9151891.exe
3972	j7404106.exe
1672	k9327528.exe
1668	l3382483.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

j7404106.exek9327528.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	j7404106.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k9327528.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exey3662660.exey0062469.exey9151891.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3662660.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y0062469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y9151891.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

j7404106.exek9327528.exe

pid process

3972 j7404106.exe
3972 j7404106.exe
1672 k9327528.exe
1672 k9327528.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

j7404106.exek9327528.exe

description pid process

Token: SeDebugPrivilege 3972 j7404106.exe
Token: SeDebugPrivilege 1672 k9327528.exe

pid	process
3972	j7404106.exe
3972	j7404106.exe
1672	k9327528.exe
1672	k9327528.exe

description	pid	process
Token: SeDebugPrivilege	3972	j7404106.exe
Token: SeDebugPrivilege	1672	k9327528.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exey3662660.exey0062469.exey9151891.exe

description	pid	process	target process
PID 5036 wrote to memory of 5100	5036	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe	y3662660.exe
PID 5036 wrote to memory of 5100	5036	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe	y3662660.exe
PID 5036 wrote to memory of 5100	5036	02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe	y3662660.exe
PID 5100 wrote to memory of 4636	5100	y3662660.exe	y0062469.exe
PID 5100 wrote to memory of 4636	5100	y3662660.exe	y0062469.exe
PID 5100 wrote to memory of 4636	5100	y3662660.exe	y0062469.exe
PID 4636 wrote to memory of 1248	4636	y0062469.exe	y9151891.exe
PID 4636 wrote to memory of 1248	4636	y0062469.exe	y9151891.exe
PID 4636 wrote to memory of 1248	4636	y0062469.exe	y9151891.exe
PID 1248 wrote to memory of 3972	1248	y9151891.exe	j7404106.exe
PID 1248 wrote to memory of 3972	1248	y9151891.exe	j7404106.exe
PID 1248 wrote to memory of 3972	1248	y9151891.exe	j7404106.exe
PID 1248 wrote to memory of 1672	1248	y9151891.exe	k9327528.exe
PID 1248 wrote to memory of 1672	1248	y9151891.exe	k9327528.exe
PID 4636 wrote to memory of 1668	4636	y0062469.exe	l3382483.exe
PID 4636 wrote to memory of 1668	4636	y0062469.exe	l3382483.exe
PID 4636 wrote to memory of 1668	4636	y0062469.exe	l3382483.exe

C:\Users\Admin\AppData\Local\Temp\02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe
"C:\Users\Admin\AppData\Local\Temp\02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3662660.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3662660.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5100

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0062469.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0062469.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4636

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y9151891.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y9151891.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7404106.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7404106.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9327528.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9327528.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe
4⤵
- Executes dropped EXE
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3662660.exe
Filesize
526KB

MD5
6289824a1644a295ca95c7618dfc2d57

SHA1
99dcc49a413a1cd103f3b84d63893f5693274f8a

SHA256
e4cdc42e8afc467142a629153fcfccf450227e6b3705d1c27bf779197ef1f546

SHA512
b15bb7263b9d05f326b7e42e6e7cc518b098614a94918aa25693747176801c0d983139b21e6214192bbd99b01fe483deb55d12255d0f48e6b838ed7b48faa700

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y0062469.exe
Filesize
354KB

MD5
caf9369f954917ec47ca66553998f145

SHA1
82f19fa39e630efce6562a44b74c332338f5c12f

SHA256
fe80270bc8981afb506e4aeb7781fbdb90b137c6ea7ec728f793413a4ecb2837

SHA512
88bddd3273f2d3b873f1414afdc4e21c1b8664cf2248e219e937e22ecb4a9309a2984406910ade9847a77bdd768636b9c0ac5cd7f46621b387241efeb7bd1f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3382483.exe
Filesize
172KB

MD5
271700b19d450d6ec7df159584d5afdf

SHA1
52f6143c0f0f92c58757ab92af3401c19a8fe91a

SHA256
4dd3ce52ec8a76830130c2fff28eccddb6091417f50126ede4b36371525b4ba5

SHA512
aced014acce41469c11c1ba14f0faa6ccc53cb03cd045dd0944eb55b528967ae7870ecd163bff2bf7a52c58b861edec186390fcacb647048c43e7e60d2f22779

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y9151891.exe
Filesize
199KB

MD5
b536677bdd86084d557d956c8a1f9e82

SHA1
6be501a406dca1cade61a126ace78800895b14ba

SHA256
a76a9bb01ee56d41b16aa1454920546376f3d59152e25f0e2c58fe6744dcd7a6

SHA512
7d18a8abfe7570b3313e030f990650e6203dafbb9de18e3e75e2634f2a9c952a8be56a5739f767032e924bbe0b5643fcd092c4cfad2654e5b8e3925556fbbaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j7404106.exe
Filesize
102KB

MD5
d4f4ac636a8e6b2d06da0e5b2ae19ad4

SHA1
f468bca795e587529c49d31dcfe657b97da7b44b

SHA256
c110ec903537181eca058ba0e1b702c084c4d5c6920d2edfcadbc7a314c32add

SHA512
cef572a202012404013cc725b32c4f888c0ea786cb4c1be1f5b401e5ba1d078d318e75092d83960b71c23891a7832717f85d9f5bbecdb55ba9a93751684d9c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k9327528.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1668-43-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1668-42-0x00000000000B0000-0x00000000000E0000-memory.dmp

Filesize
192KB

Download
memory/1668-44-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/1668-45-0x0000000004C40000-0x0000000004D4A000-memory.dmp

Filesize
1.0MB

Download
memory/1668-46-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/1668-47-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Filesize
240KB

Download
memory/1668-48-0x0000000004D50000-0x0000000004D9C000-memory.dmp

Filesize
304KB

Download
memory/1672-37-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/3972-28-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download