healer | 81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e

General

Target

81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe
Size

389KB
MD5

7d1fed48cf233d36969d449caeb35bc6
SHA1

5e533c4ea4d3b07bcd94bacef079342b32c244bc
SHA256

81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e
SHA512

c908d6096ca62fd89b1a48e06584a70dacd78a2bf51f37384c0ffb5c7a5657a42924dd29c97ad71e543172aa09e310f187a1e56073385807febe646712492b46
SSDEEP

6144:KWy+bnr+6p0yN90QEKC01kWKjZNrQR5izw2wBT5I13oNkHLmPrVAeeJ/:uMr+y90M8zw2WEoLjGeY/

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023202-146.dat	healer
behavioral1/files/0x0007000000023202-145.dat	healer
behavioral1/memory/4748-147-0x0000000000030000-0x000000000003A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p3197565.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p3197565.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p3197565.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p3197565.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p3197565.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p3197565.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2844	z3781362.exe
4748	p3197565.exe
3524	r6639296.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p3197565.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z3781362.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3781362.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3496	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	p3197565.exe
4748	p3197565.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	p3197565.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2844	4052	81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe	85
PID 4052 wrote to memory of 2844	4052	81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe	85
PID 4052 wrote to memory of 2844	4052	81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe	85
PID 2844 wrote to memory of 4748	2844	z3781362.exe	86
PID 2844 wrote to memory of 4748	2844	z3781362.exe	86
PID 2844 wrote to memory of 3524	2844	z3781362.exe	95
PID 2844 wrote to memory of 3524	2844	z3781362.exe	95
PID 2844 wrote to memory of 3524	2844	z3781362.exe	95

C:\Users\Admin\AppData\Local\Temp\81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe
"C:\Users\Admin\AppData\Local\Temp\81bf65e6cd65809f4e6885ac684a7d8b17b39bd28c147068431bf802d5a8b12e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3781362.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3781362.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3197565.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3197565.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6639296.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6639296.exe
    3⤵
    - Executes dropped EXE
    PID:3524

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3781362.exe

Filesize
206KB

MD5
0158a2846f4870a13d89130776f94f3a

SHA1
65a3e06f198d31bf16e7d7d2ca3669747b760abd

SHA256
564365a019d0bbf1e8e054fd7a762554a7c79f4427496260611867ec720c3d0d

SHA512
0ac88aa65fa0229800dbc67dabd181f2cdfd3fad9471521fb79293d694b67401c62530cccb0a09d83736e4376c9fdbf6d1abaa9652ba6ef03aea5c631e2c92c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3781362.exe

Filesize
206KB

MD5
0158a2846f4870a13d89130776f94f3a

SHA1
65a3e06f198d31bf16e7d7d2ca3669747b760abd

SHA256
564365a019d0bbf1e8e054fd7a762554a7c79f4427496260611867ec720c3d0d

SHA512
0ac88aa65fa0229800dbc67dabd181f2cdfd3fad9471521fb79293d694b67401c62530cccb0a09d83736e4376c9fdbf6d1abaa9652ba6ef03aea5c631e2c92c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3197565.exe

Filesize
14KB

MD5
853f33178e3deac986888368f161d4d0

SHA1
0394993da5f97172835879539304572d696a570b

SHA256
e7ca9b7d8b03778c9c8b30e64bcfe18a2c2d77ddcf339ebe58c17c95685c758e

SHA512
8d8e0b99a0a21aa6dff956dbdedd27246f0bcc2764049960c1b3f2dee003e988cf58cee8cbf71e2403a8d30e642d26dfc4eb10dec9a9f9472513177b6ef2da60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p3197565.exe

Filesize
14KB

MD5
853f33178e3deac986888368f161d4d0

SHA1
0394993da5f97172835879539304572d696a570b

SHA256
e7ca9b7d8b03778c9c8b30e64bcfe18a2c2d77ddcf339ebe58c17c95685c758e

SHA512
8d8e0b99a0a21aa6dff956dbdedd27246f0bcc2764049960c1b3f2dee003e988cf58cee8cbf71e2403a8d30e642d26dfc4eb10dec9a9f9472513177b6ef2da60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6639296.exe

Filesize
172KB

MD5
371788f99a9ca1b21104ef7acc0da5e3

SHA1
bee9925f0e9b3b0b254505bb92175a7a0f5375b8

SHA256
b6286136ca94a0c4e11f0f7e988444b9bfd462478cfcbb8c5a3caac49f029700

SHA512
fa25fafc7c1f67fae8817ce30addb2d828c1ff123011148fbbab48e4fc0f54f158d31c0a34043e241683042448293cec02c5bc2e5ea257e26602df7df971856f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6639296.exe

Filesize
172KB

MD5
371788f99a9ca1b21104ef7acc0da5e3

SHA1
bee9925f0e9b3b0b254505bb92175a7a0f5375b8

SHA256
b6286136ca94a0c4e11f0f7e988444b9bfd462478cfcbb8c5a3caac49f029700

SHA512
fa25fafc7c1f67fae8817ce30addb2d828c1ff123011148fbbab48e4fc0f54f158d31c0a34043e241683042448293cec02c5bc2e5ea257e26602df7df971856f

Download Submit
memory/3524-157-0x0000000005950000-0x0000000005A5A000-memory.dmp

Filesize
1.0MB

Download
memory/3524-155-0x0000000074380000-0x0000000074B30000-memory.dmp

Filesize
7.7MB

Download
memory/3524-154-0x0000000000D50000-0x0000000000D80000-memory.dmp

Filesize
192KB

Download
memory/3524-156-0x0000000005E60000-0x0000000006478000-memory.dmp

Filesize
6.1MB

Download
memory/3524-158-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/3524-159-0x0000000005810000-0x0000000005822000-memory.dmp

Filesize
72KB

Download
memory/3524-160-0x0000000005880000-0x00000000058BC000-memory.dmp

Filesize
240KB

Download
memory/3524-161-0x0000000074380000-0x0000000074B30000-memory.dmp

Filesize
7.7MB

Download
memory/3524-162-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/4748-150-0x00007FFA0AA80000-0x00007FFA0B541000-memory.dmp

Filesize
10.8MB

Download
memory/4748-148-0x00007FFA0AA80000-0x00007FFA0B541000-memory.dmp

Filesize
10.8MB

Download
memory/4748-147-0x0000000000030000-0x000000000003A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads