healer | ce1edda49414a8c5bcc05c927f22ae0e33975fbec5615318d9409ab928d9a4bc

General

Target

fd1fe3fb4d03454d29243889d6d77a10.exe
Size

529KB
MD5

fd1fe3fb4d03454d29243889d6d77a10
SHA1

41ef2be9c75f78e6081441acb7b30798151c18dc
SHA256

ce1edda49414a8c5bcc05c927f22ae0e33975fbec5615318d9409ab928d9a4bc
SHA512

6f90d436ba2dfa3a0f1e182105a52ed8d6b7763788f87536cef6d630e268ca7f1503172c948318a8f04f1fc51d2507a574f738ade8fc861ed849084d66f10b16
SSDEEP

12288:KZi2WfvkaRdnQgIRFWvdUh5KSFBzcDYbk1m5xIYcOtwYY0:KZi2Mvk82gzdULzcDYbHLIYcOtN

Score

10^/10

healer redline furod dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

furod

C2

77.91.68.70:19073

Attributes

auth_value
d2386245fe11799b28b4521492a5879d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/4448-153-0x0000000000470000-0x000000000047A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8627452.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k8627452.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8627452.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8627452.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8627452.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8627452.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4748	y0529027.exe
4448	k8627452.exe
2836	l5438312.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k8627452.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8627452.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	fd1fe3fb4d03454d29243889d6d77a10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd1fe3fb4d03454d29243889d6d77a10.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y0529027.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0529027.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	k8627452.exe
4448	k8627452.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	k8627452.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4748	2624	fd1fe3fb4d03454d29243889d6d77a10.exe	85
PID 2624 wrote to memory of 4748	2624	fd1fe3fb4d03454d29243889d6d77a10.exe	85
PID 2624 wrote to memory of 4748	2624	fd1fe3fb4d03454d29243889d6d77a10.exe	85
PID 4748 wrote to memory of 4448	4748	y0529027.exe	86
PID 4748 wrote to memory of 4448	4748	y0529027.exe	86
PID 4748 wrote to memory of 4448	4748	y0529027.exe	86
PID 4748 wrote to memory of 2836	4748	y0529027.exe	88
PID 4748 wrote to memory of 2836	4748	y0529027.exe	88
PID 4748 wrote to memory of 2836	4748	y0529027.exe	88

C:\Users\Admin\AppData\Local\Temp\fd1fe3fb4d03454d29243889d6d77a10.exe
"C:\Users\Admin\AppData\Local\Temp\fd1fe3fb4d03454d29243889d6d77a10.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0529027.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0529027.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8627452.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8627452.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5438312.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5438312.exe
    3⤵
    - Executes dropped EXE
    PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0529027.exe

Filesize
260KB

MD5
ce877a6d68cebbe0dfc45fa72003384e

SHA1
5494b5f4d0aeee018ca4ff06d136357b16d20873

SHA256
2e3be5f79c10d0f06e700523966629be7326d23398033c67e59d2d6a43dcab90

SHA512
9472ed52cbfac99198390ae792d04ee506a2d10ce18ce013dedbebe9c57269046050d19d1b3d5c435c1900160ce7eb508cef87fecfd49fced9127e65c887578f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0529027.exe

Filesize
260KB

MD5
ce877a6d68cebbe0dfc45fa72003384e

SHA1
5494b5f4d0aeee018ca4ff06d136357b16d20873

SHA256
2e3be5f79c10d0f06e700523966629be7326d23398033c67e59d2d6a43dcab90

SHA512
9472ed52cbfac99198390ae792d04ee506a2d10ce18ce013dedbebe9c57269046050d19d1b3d5c435c1900160ce7eb508cef87fecfd49fced9127e65c887578f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8627452.exe

Filesize
96KB

MD5
888e49c9918ab78e37204ed32fd8fb16

SHA1
427bab835488f33624571ae7ee48a8ab2caec055

SHA256
5295de0766f555faac1381909f9ab44e1e66dbc208c460fe537666baa0b386da

SHA512
fde151156cd0bc576d3fc2cca3313a2eb79d84348dacfef54cd6b8677bd155fca4b04be83ae8b6f1855dcc976fe331786a08124aa655364750924e1ef90c08c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8627452.exe

Filesize
96KB

MD5
888e49c9918ab78e37204ed32fd8fb16

SHA1
427bab835488f33624571ae7ee48a8ab2caec055

SHA256
5295de0766f555faac1381909f9ab44e1e66dbc208c460fe537666baa0b386da

SHA512
fde151156cd0bc576d3fc2cca3313a2eb79d84348dacfef54cd6b8677bd155fca4b04be83ae8b6f1855dcc976fe331786a08124aa655364750924e1ef90c08c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5438312.exe

Filesize
257KB

MD5
099233585c4ee1bd473a5ab98c5ddd7f

SHA1
0632f7c870a6c8ee2a5f113da44adf39e9fcb03b

SHA256
d3942ca636743cb925f702fc875e8d13a3dc7eb7104e25dab9d118a0f5d17d61

SHA512
c854579137ba488370cef451061dc0a083754e5d7f4245c9f5b4181d97c205a30c7159259761c4464a1e9f413b9ef0d59908f1d0046e8057c6349fc8088250c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5438312.exe

Filesize
257KB

MD5
099233585c4ee1bd473a5ab98c5ddd7f

SHA1
0632f7c870a6c8ee2a5f113da44adf39e9fcb03b

SHA256
d3942ca636743cb925f702fc875e8d13a3dc7eb7104e25dab9d118a0f5d17d61

SHA512
c854579137ba488370cef451061dc0a083754e5d7f4245c9f5b4181d97c205a30c7159259761c4464a1e9f413b9ef0d59908f1d0046e8057c6349fc8088250c6

Download Submit
memory/2624-133-0x0000000000840000-0x00000000008B4000-memory.dmp

Filesize
464KB

Download
memory/2836-162-0x0000000000560000-0x0000000000590000-memory.dmp

Filesize
192KB

Download
memory/2836-167-0x000000000A5F0000-0x000000000AC08000-memory.dmp

Filesize
6.1MB

Download
memory/2836-168-0x000000000A000000-0x000000000A10A000-memory.dmp

Filesize
1.0MB

Download
memory/2836-169-0x000000000A140000-0x000000000A152000-memory.dmp

Filesize
72KB

Download
memory/2836-170-0x000000000A160000-0x000000000A19C000-memory.dmp

Filesize
240KB

Download
memory/2836-171-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2836-172-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/4448-153-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads