healer | a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8

General

Target

a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe
Size

389KB
MD5

cc931a1f40b737a0c88c6a42bb68effd
SHA1

5b9931c45c5fa3efe4fbd37251a2f42f22ddc7d6
SHA256

a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8
SHA512

0c58f62981b9049052aaa53c0ec3e25d60bed383fb728e09e0b98f30d86f232f68833a92d846e58a5206067f2032a6125f8f45eca51dd9d9d770943b95dfb203
SSDEEP

6144:Kpy+bnr+Up0yN90QEoDsVSgXEGc7MEYKLKVJD8K5768Ldd/tQ4Z2L9iDv5iBn:HMrMy90OOlUGREYkw+07nG9LUDsBn

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000800000002320c-145.dat	healer
behavioral1/files/0x000800000002320c-146.dat	healer
behavioral1/memory/1776-147-0x0000000000790000-0x000000000079A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p8657797.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p8657797.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p8657797.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p8657797.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p8657797.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p8657797.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3192	z0216621.exe
1776	p8657797.exe
4292	r7322492.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p8657797.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z0216621.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0216621.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2696	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1776	p8657797.exe
1776	p8657797.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	p8657797.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3192	2588	a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe	86
PID 2588 wrote to memory of 3192	2588	a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe	86
PID 2588 wrote to memory of 3192	2588	a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe	86
PID 3192 wrote to memory of 1776	3192	z0216621.exe	87
PID 3192 wrote to memory of 1776	3192	z0216621.exe	87
PID 3192 wrote to memory of 4292	3192	z0216621.exe	94
PID 3192 wrote to memory of 4292	3192	z0216621.exe	94
PID 3192 wrote to memory of 4292	3192	z0216621.exe	94

C:\Users\Admin\AppData\Local\Temp\a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe
"C:\Users\Admin\AppData\Local\Temp\a16dcd1fa129aafce3008428793020dafff1128bf9d83a16b9421c1aad1afcb8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0216621.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0216621.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8657797.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8657797.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7322492.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7322492.exe
    3⤵
    - Executes dropped EXE
    PID:4292

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0216621.exe

Filesize
206KB

MD5
05226cb32037b3186881ba16444c571d

SHA1
4c8123c805d1d719bbe853887d3149720d3bb0db

SHA256
ffcaa70b9ed704eb04641e37f7b31dc1c82ed750a1c5bc9ff4dae033e811de70

SHA512
50e835df0aec4bd321e3df9d3fda9afba21a9feec9b3d8ee12935d14f88be9f48f93ccd513d6a60257b04d039756bebbb6bc6bad439baafd7f7185c4e633f909

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0216621.exe

Filesize
206KB

MD5
05226cb32037b3186881ba16444c571d

SHA1
4c8123c805d1d719bbe853887d3149720d3bb0db

SHA256
ffcaa70b9ed704eb04641e37f7b31dc1c82ed750a1c5bc9ff4dae033e811de70

SHA512
50e835df0aec4bd321e3df9d3fda9afba21a9feec9b3d8ee12935d14f88be9f48f93ccd513d6a60257b04d039756bebbb6bc6bad439baafd7f7185c4e633f909

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8657797.exe

Filesize
15KB

MD5
b4eb588b40d6b2f4f0faf12c062d6f99

SHA1
e6af831616ffe16fe6471b86e4f4c15f5e0ca190

SHA256
39686596781192f3efa7cbac14f9aa093b3129a810b34e9daa79be4c6eee53bb

SHA512
5089eaf2926aa88d69205ff38b6ba68c6d8534bf55189e2a648295b6ac6e5e4fbaec55643c066221e3d3cb532fb7d6cc8ef088f4d6974c325f62103ad63bd55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8657797.exe

Filesize
15KB

MD5
b4eb588b40d6b2f4f0faf12c062d6f99

SHA1
e6af831616ffe16fe6471b86e4f4c15f5e0ca190

SHA256
39686596781192f3efa7cbac14f9aa093b3129a810b34e9daa79be4c6eee53bb

SHA512
5089eaf2926aa88d69205ff38b6ba68c6d8534bf55189e2a648295b6ac6e5e4fbaec55643c066221e3d3cb532fb7d6cc8ef088f4d6974c325f62103ad63bd55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7322492.exe

Filesize
175KB

MD5
0d0ebca9296c287c38ad007945cc68ea

SHA1
660e3114fc78d1bc7335936c636385b05e94cc44

SHA256
be07f6018112266a6774c10cf83980507f3a701eb21036349eaaeb6e452f3b07

SHA512
8ef28cfdb81dd0136910b5d1d850d48ee455c94c393f4a934eb99f9fd6f28daf1d3c0c773eee06dd6e602ddc13b5357d83ecf850ac8069500a3feeb0a81b36f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7322492.exe

Filesize
175KB

MD5
0d0ebca9296c287c38ad007945cc68ea

SHA1
660e3114fc78d1bc7335936c636385b05e94cc44

SHA256
be07f6018112266a6774c10cf83980507f3a701eb21036349eaaeb6e452f3b07

SHA512
8ef28cfdb81dd0136910b5d1d850d48ee455c94c393f4a934eb99f9fd6f28daf1d3c0c773eee06dd6e602ddc13b5357d83ecf850ac8069500a3feeb0a81b36f1

Download Submit
memory/1776-147-0x0000000000790000-0x000000000079A000-memory.dmp

Filesize
40KB

Download
memory/1776-150-0x00007FFA0CAF0000-0x00007FFA0D5B1000-memory.dmp

Filesize
10.8MB

Download
memory/1776-148-0x00007FFA0CAF0000-0x00007FFA0D5B1000-memory.dmp

Filesize
10.8MB

Download
memory/4292-154-0x0000000000340000-0x0000000000370000-memory.dmp

Filesize
192KB

Download
memory/4292-155-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/4292-156-0x000000000A630000-0x000000000AC48000-memory.dmp

Filesize
6.1MB

Download
memory/4292-157-0x000000000A1B0000-0x000000000A2BA000-memory.dmp

Filesize
1.0MB

Download
memory/4292-158-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/4292-159-0x000000000A0F0000-0x000000000A102000-memory.dmp

Filesize
72KB

Download
memory/4292-160-0x000000000A150000-0x000000000A18C000-memory.dmp

Filesize
240KB

Download
memory/4292-161-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/4292-162-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads