healer | c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b

General

Target

c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe
Size

389KB
MD5

177cc2b3781056cb89ff026657ed3de6
SHA1

8abe82aa72e9078bbe718a1b40ea0d1f03783f51
SHA256

c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b
SHA512

bc171c6cf6c641e526e81196c7680ebbd60728678aa1bd6a9e9ceab9bd743e55ee0acf1098597715098072c39f79cf86198eeb2973f38e4428bfea2165f2c2e6
SSDEEP

12288:0Mrny90j4TvR6br5IAMdFTUjiBrGXtkoPS:LyKOJd+jiBrKrS

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001af92-129.dat	healer
behavioral1/files/0x000700000001af92-130.dat	healer
behavioral1/memory/4948-131-0x0000000000380000-0x000000000038A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p1974841.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p1974841.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p1974841.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p1974841.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p1974841.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
364	z8068302.exe
4948	p1974841.exe
1932	r2782175.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p1974841.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z8068302.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z8068302.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	p1974841.exe
4948	p1974841.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	p1974841.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 364	3968	c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe	69
PID 3968 wrote to memory of 364	3968	c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe	69
PID 3968 wrote to memory of 364	3968	c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe	69
PID 364 wrote to memory of 4948	364	z8068302.exe	70
PID 364 wrote to memory of 4948	364	z8068302.exe	70
PID 364 wrote to memory of 1932	364	z8068302.exe	71
PID 364 wrote to memory of 1932	364	z8068302.exe	71
PID 364 wrote to memory of 1932	364	z8068302.exe	71

C:\Users\Admin\AppData\Local\Temp\c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe
"C:\Users\Admin\AppData\Local\Temp\c4e498dee19d585afa45ef25cfa9911d4b278fe589e0bba2eda15af7376bc17b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8068302.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8068302.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1974841.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1974841.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2782175.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2782175.exe
    3⤵
    - Executes dropped EXE
    PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8068302.exe

Filesize
206KB

MD5
463244d34781a376f4c62de910e0099f

SHA1
95bea120676e9e7186416f7c20f20a0d6d1ceb0a

SHA256
6a7a8456644fbefdde0343bd8b7f2e75fe99c40cbb7c5a5602f00e8cd39f2122

SHA512
50f521f1f66f98903a940f7ae87f518eca970f752d839a073e33478c794212a3d79e844e37044c85783b2d4f0ecfa7e2ad53946d5424932e7047ecc9dafbdd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8068302.exe

Filesize
206KB

MD5
463244d34781a376f4c62de910e0099f

SHA1
95bea120676e9e7186416f7c20f20a0d6d1ceb0a

SHA256
6a7a8456644fbefdde0343bd8b7f2e75fe99c40cbb7c5a5602f00e8cd39f2122

SHA512
50f521f1f66f98903a940f7ae87f518eca970f752d839a073e33478c794212a3d79e844e37044c85783b2d4f0ecfa7e2ad53946d5424932e7047ecc9dafbdd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1974841.exe

Filesize
14KB

MD5
cb899191cc56c84c0f641c2ca8de89e3

SHA1
3bed6ad621ae5d854b5607e0dc6a1a6619e19938

SHA256
e19e970557c5ae2a75ac6f2fd9feaeb17135a42bfbcbcc271a526139f122b59c

SHA512
6537b208a2f29c8deaa2c1251501b4523dea2bd4f12f0a55a80120aac7bdb39a8adb08f98aba81fa77a4f370ec528840d454338d6412ce4c7d26e1138a73ae4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p1974841.exe

Filesize
14KB

MD5
cb899191cc56c84c0f641c2ca8de89e3

SHA1
3bed6ad621ae5d854b5607e0dc6a1a6619e19938

SHA256
e19e970557c5ae2a75ac6f2fd9feaeb17135a42bfbcbcc271a526139f122b59c

SHA512
6537b208a2f29c8deaa2c1251501b4523dea2bd4f12f0a55a80120aac7bdb39a8adb08f98aba81fa77a4f370ec528840d454338d6412ce4c7d26e1138a73ae4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2782175.exe

Filesize
172KB

MD5
eab893932f0e2926d48f41c0f7e4f126

SHA1
b9edc905d67f6400d2afae73a1e2cf3ce8c39535

SHA256
33ac96f14a4d2b49944a172ac71a0561f765d0491429aec6a58ad8f8aec9c4ff

SHA512
5f9e898dc638e7c37ec79602faa85caa599fa7bef61f1b0926982bfe746da115be9076874e128c17f747bdc7b3ba0ff8ab7b847db9e04d3c28f8fb99cb84c927

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2782175.exe

Filesize
172KB

MD5
eab893932f0e2926d48f41c0f7e4f126

SHA1
b9edc905d67f6400d2afae73a1e2cf3ce8c39535

SHA256
33ac96f14a4d2b49944a172ac71a0561f765d0491429aec6a58ad8f8aec9c4ff

SHA512
5f9e898dc638e7c37ec79602faa85caa599fa7bef61f1b0926982bfe746da115be9076874e128c17f747bdc7b3ba0ff8ab7b847db9e04d3c28f8fb99cb84c927

Download Submit
memory/1932-141-0x000000000A490000-0x000000000AA96000-memory.dmp

Filesize
6.0MB

Download
memory/1932-138-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/1932-139-0x0000000073290000-0x000000007397E000-memory.dmp

Filesize
6.9MB

Download
memory/1932-140-0x0000000000720000-0x0000000000726000-memory.dmp

Filesize
24KB

Download
memory/1932-142-0x0000000009FE0000-0x000000000A0EA000-memory.dmp

Filesize
1.0MB

Download
memory/1932-143-0x0000000009F10000-0x0000000009F22000-memory.dmp

Filesize
72KB

Download
memory/1932-144-0x0000000009F70000-0x0000000009FAE000-memory.dmp

Filesize
248KB

Download
memory/1932-145-0x000000000A0F0000-0x000000000A13B000-memory.dmp

Filesize
300KB

Download
memory/1932-146-0x0000000073290000-0x000000007397E000-memory.dmp

Filesize
6.9MB

Download
memory/4948-134-0x00007FFCC4660000-0x00007FFCC504C000-memory.dmp

Filesize
9.9MB

Download
memory/4948-132-0x00007FFCC4660000-0x00007FFCC504C000-memory.dmp

Filesize
9.9MB

Download
memory/4948-131-0x0000000000380000-0x000000000038A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads