healer | d8d8e2bd36c25798e8243ccb42440baf3f49559a1e251f2f29e70b3d46f597ed

Resubmissions

23-06-2024 06:12

240623-gyd2psscqf 10

16-07-2023 19:09

230716-xt4pkahc8t 10

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe
Size

787KB
MD5

36b9237f9ecf4c5c108cd7f67404b0e6
SHA1

4ccd5b450d77b42a4485bb2ddddce85c4dd89758
SHA256

053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799
SHA512

1208a186e7ea814a817b9d59ff4a09a56ad94d5ea6e56bc5cfa9ae0a0f170c81b592b47de3d940b5cc2daf64ca582272fce2b77a0858a0909c926baa65e6b04a
SSDEEP

12288:lMroy9052D1VtAZGIKEkY0BaLiTBFbtcqMQ8e76H+4MEARgmWP:tyw2DSsrEkZDz8lHO2P

Score

10^/10

healer redline grom dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

grom

83.97.73.129:19071

Attributes

auth_value
2193aac8692a5e1ec66d9db9fa25ee00

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2836-29-0x0000000000470000-0x000000000047A000-memory.dmp	healer
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\p9233288.exe	healer
behavioral3/memory/4456-38-0x0000000000700000-0x000000000070A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

o1463937.exep9233288.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	o1463937.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p9233288.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p9233288.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral3/memory/5096-44-0x0000000000630000-0x0000000000660000-memory.dmp family_redline
Executes dropped EXE 6 IoCs

Processes:

z9821491.exez9676291.exez8837151.exeo1463937.exep9233288.exer2365043.exe

pid process

3452 z9821491.exe
1540 z9676291.exe
4492 z8837151.exe
2836 o1463937.exe
4456 p9233288.exe
5096 r2365043.exe

resource	yara_rule
behavioral3/memory/5096-44-0x0000000000630000-0x0000000000660000-memory.dmp	family_redline

pid	process
3452	z9821491.exe
1540	z9676291.exe
4492	z8837151.exe
2836	o1463937.exe
4456	p9233288.exe
5096	r2365043.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

o1463937.exep9233288.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	o1463937.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p9233288.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exez9821491.exez9676291.exez8837151.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9821491.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9676291.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z8837151.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

o1463937.exep9233288.exe

pid process

2836 o1463937.exe
2836 o1463937.exe
4456 p9233288.exe
4456 p9233288.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

o1463937.exep9233288.exe

description pid process

Token: SeDebugPrivilege 2836 o1463937.exe
Token: SeDebugPrivilege 4456 p9233288.exe

pid	process
2836	o1463937.exe
2836	o1463937.exe
4456	p9233288.exe
4456	p9233288.exe

description	pid	process
Token: SeDebugPrivilege	2836	o1463937.exe
Token: SeDebugPrivilege	4456	p9233288.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exez9821491.exez9676291.exez8837151.exe

description	pid	process	target process
PID 4996 wrote to memory of 3452	4996	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe	z9821491.exe
PID 4996 wrote to memory of 3452	4996	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe	z9821491.exe
PID 4996 wrote to memory of 3452	4996	053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe	z9821491.exe
PID 3452 wrote to memory of 1540	3452	z9821491.exe	z9676291.exe
PID 3452 wrote to memory of 1540	3452	z9821491.exe	z9676291.exe
PID 3452 wrote to memory of 1540	3452	z9821491.exe	z9676291.exe
PID 1540 wrote to memory of 4492	1540	z9676291.exe	z8837151.exe
PID 1540 wrote to memory of 4492	1540	z9676291.exe	z8837151.exe
PID 1540 wrote to memory of 4492	1540	z9676291.exe	z8837151.exe
PID 4492 wrote to memory of 2836	4492	z8837151.exe	o1463937.exe
PID 4492 wrote to memory of 2836	4492	z8837151.exe	o1463937.exe
PID 4492 wrote to memory of 2836	4492	z8837151.exe	o1463937.exe
PID 4492 wrote to memory of 4456	4492	z8837151.exe	p9233288.exe
PID 4492 wrote to memory of 4456	4492	z8837151.exe	p9233288.exe
PID 1540 wrote to memory of 5096	1540	z9676291.exe	r2365043.exe
PID 1540 wrote to memory of 5096	1540	z9676291.exe	r2365043.exe
PID 1540 wrote to memory of 5096	1540	z9676291.exe	r2365043.exe

C:\Users\Admin\AppData\Local\Temp\053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe
"C:\Users\Admin\AppData\Local\Temp\053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4996

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9821491.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9821491.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3452

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9676291.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9676291.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8837151.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8837151.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4492

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o1463937.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o1463937.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\p9233288.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\p9233288.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2365043.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2365043.exe
4⤵
- Executes dropped EXE
PID:5096

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9821491.exe
Filesize
593KB

MD5
f945267dddff61f9d38bb3df99448dc0

SHA1
f93e26c77aa382e29ffb318cc54a2056b48f89a9

SHA256
9092ab63010fed6a3724188fa2318396f05e13751a6d764509abd12387dfc992

SHA512
72e309ee593e8ed992ba8a5c7f68cc1e7e2e4cb73046faf1ec74eec70f5d69e6683defb5353e8457993508cbf1a23e0717f9858b19a5dbf75443983abce3f56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9676291.exe
Filesize
421KB

MD5
9317029894a912d9473a2ae52b82340b

SHA1
a62f06447fa6c5217f080314e98304cea3884dd4

SHA256
bda370090cffdd941053123c99e19b0c28973639d580e50c57c46dc462b9041c

SHA512
a8adebf777fb37dccb1122f48adb2c6be919617d5bbc43fbd4dd3463427bd4e3248ffab87fb1ac403953557127a40f756e1d584f3a4484621c134cc39054c8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2365043.exe
Filesize
251KB

MD5
2db816bdda1418080b87a0d1cf8c884b

SHA1
07992b73cb3c712772c190ac6ced460219cb9a1d

SHA256
7e173199111546404d7f4254a9d03f6079c0191ead5f1abc80c213783b1ae71b

SHA512
c879e11ffaf08b1ecc6a15f8d86fc92dbbc230b0c2c80ab9a9c83db09dda98b017f28192eeaae08618c50f20e8fb538d31c7aff247627e7d46cd28a8d8277f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8837151.exe
Filesize
227KB

MD5
1eb34fe477ae48ebb74e5d8876e532ab

SHA1
4ecae97dc11a179234aeda06851fc2680227fb79

SHA256
fab94cff5e131a6a1f0ad11eb136913fc2e430d49bca7995455358a6afdc6189

SHA512
0ea05079e8c50fa46a5ee24579e57692d32953eb53ba4b02b4067ff826c99631be30cce952830156a56a87ede7ccbd207b9cca8c1c001727e9d12d2b0b858bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o1463937.exe
Filesize
176KB

MD5
211a06e9ae68ced1234252a48696431b

SHA1
69950e2ee2fafd177d1a295836713bfd8d18df9c

SHA256
0bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d

SHA512
b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\p9233288.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/2836-28-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2836-29-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/4456-38-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/5096-44-0x0000000000630000-0x0000000000660000-memory.dmp

Filesize
192KB

Download
memory/5096-48-0x0000000002420000-0x0000000002426000-memory.dmp

Filesize
24KB

Download
memory/5096-49-0x0000000005150000-0x0000000005768000-memory.dmp

Filesize
6.1MB

Download
memory/5096-50-0x0000000004B30000-0x0000000004C3A000-memory.dmp

Filesize
1.0MB

Download
memory/5096-51-0x0000000004AF0000-0x0000000004B02000-memory.dmp

Filesize
72KB

Download
memory/5096-52-0x0000000004C40000-0x0000000004C7C000-memory.dmp

Filesize
240KB

Download
memory/5096-53-0x0000000004CD0000-0x0000000004D1C000-memory.dmp

Filesize
304KB

Download