healer | 87e2f19d070b4fcf5e3514e43e25b6a720ef862178a6068227278bb26c5487ec

General

Target

198603d17746063bbcb7f248a.exe
Size

538KB
MD5

198603d17746063bbcb7f248a4f62f73
SHA1

3696dbcbd0acf06dc051cf350da3d71b7d29cb65
SHA256

87e2f19d070b4fcf5e3514e43e25b6a720ef862178a6068227278bb26c5487ec
SHA512

37985970189b69e40207db2237139c295e215536b818a658d8d2c6bc22ac54e679e1ac4c014b2a317119a1731b30d515f3400145f16c8e335b3cd74e2987ab24
SSDEEP

12288:xegHDVz47sr4wY1aHmra1coPp6XmGd4nSG:Rjt47snYoucI/dSS

Score

10^/10

healer redline kira dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kira

C2

77.91.68.48:19071

Attributes

auth_value
1677a40fd8997eb89377e1681911e9c6

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/4876-153-0x00000000004F0000-0x00000000004FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8802469.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1048	y2083379.exe
4876	k8802469.exe
2244	l8002337.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k8802469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8802469.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	198603d17746063bbcb7f248a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	198603d17746063bbcb7f248a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y2083379.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2083379.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4876	k8802469.exe
4876	k8802469.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	k8802469.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1048	1296	198603d17746063bbcb7f248a.exe	86
PID 1296 wrote to memory of 1048	1296	198603d17746063bbcb7f248a.exe	86
PID 1296 wrote to memory of 1048	1296	198603d17746063bbcb7f248a.exe	86
PID 1048 wrote to memory of 4876	1048	y2083379.exe	87
PID 1048 wrote to memory of 4876	1048	y2083379.exe	87
PID 1048 wrote to memory of 4876	1048	y2083379.exe	87
PID 1048 wrote to memory of 2244	1048	y2083379.exe	89
PID 1048 wrote to memory of 2244	1048	y2083379.exe	89
PID 1048 wrote to memory of 2244	1048	y2083379.exe	89

C:\Users\Admin\AppData\Local\Temp\198603d17746063bbcb7f248a.exe
"C:\Users\Admin\AppData\Local\Temp\198603d17746063bbcb7f248a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe
    3⤵
    - Executes dropped EXE
    PID:2244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe

Filesize
261KB

MD5
4f5a8efc33c6bde999182b2f98b35837

SHA1
eb749f0b56bf8e11b9ab72797462150effa14e27

SHA256
affce7573b4af34ac560ccfda4d558df29e593d63f69ed6f8c6c709d825cc9b2

SHA512
79f1e7c2c17c3134ec9a39faa30dfc227c8da6c24d3f6a740d5dd16d6ea53a0901ea3261987cd1d8ce2cda5e9439ba1d5a7da5f2c8510da335fcdda5dde9629a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2083379.exe

Filesize
261KB

MD5
4f5a8efc33c6bde999182b2f98b35837

SHA1
eb749f0b56bf8e11b9ab72797462150effa14e27

SHA256
affce7573b4af34ac560ccfda4d558df29e593d63f69ed6f8c6c709d825cc9b2

SHA512
79f1e7c2c17c3134ec9a39faa30dfc227c8da6c24d3f6a740d5dd16d6ea53a0901ea3261987cd1d8ce2cda5e9439ba1d5a7da5f2c8510da335fcdda5dde9629a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8802469.exe

Filesize
104KB

MD5
46851bd132ce787eb0185630569a22c8

SHA1
457f7bfca1418efad5af2a5a05510a1b5eae7fe2

SHA256
0588497d58f95be73407b0432d905949621ff44580ff03542ac45bc4e7b47c39

SHA512
3cff5e6e10acc1351d6cb71c9b4e9188915ed478b944767ddc47085dc8624da1eddbeed04cee808d9c72ff6cb667a4e421ed3adfc25dee8f036163eff937cff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8002337.exe

Filesize
266KB

MD5
339fea5ace9bc79c0f45ff3b6fccb3f5

SHA1
ad800dae6b13e14fad9ca23b7d684b6bdcfb60ed

SHA256
6dd73949dca275923972db03173de271488439c167b24b7bd7a4bc74ea357430

SHA512
f48c71d4a2b6cab4154115b4526f564a68b8beb6587c901027e6e6a6b381b8e511aa4f3ce500c70f487268c273d620e823d00e8bf87f6b44a469588aea3cbc1e

Download Submit
memory/1296-133-0x00000000006C0000-0x0000000000734000-memory.dmp

Filesize
464KB

Download
memory/2244-162-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/2244-167-0x0000000009EF0000-0x000000000A508000-memory.dmp

Filesize
6.1MB

Download
memory/2244-168-0x000000000A620000-0x000000000A72A000-memory.dmp

Filesize
1.0MB

Download
memory/2244-169-0x000000000A510000-0x000000000A522000-memory.dmp

Filesize
72KB

Download
memory/2244-170-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/2244-171-0x000000000A530000-0x000000000A56C000-memory.dmp

Filesize
240KB

Download
memory/2244-172-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/4876-153-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads