healer | d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77

General

Target

d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe
Size

389KB
MD5

a7b11d69d97cc765f11a42cd44464f05
SHA1

5a8f7af21f617e81d3d2f47b76ced3d7edb15681
SHA256

d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77
SHA512

436e936007def7fb84ed60d0258feb9c053479891d19eb640357ff3853c9987d757b153d26ab8d326776def54c274a8dff24af44da85e44a644aaae5b0607bc0
SSDEEP

6144:Kgy+bnr+5p0yN90QEB9k3vBt6mHDQvgB4ikaVIIhX3dMfiHwG6iE0WCzIb0p:EMr5y90Jkfv6mHEvo4ikh8nUij6iPgm

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001afe0-129.dat	healer
behavioral1/files/0x000700000001afe0-130.dat	healer
behavioral1/memory/4328-131-0x0000000000090000-0x000000000009A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p9279846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p9279846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p9279846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p9279846.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p9279846.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
388	z8510486.exe
4328	p9279846.exe
384	r2366493.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p9279846.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z8510486.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z8510486.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	p9279846.exe
4328	p9279846.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	p9279846.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 388	1928	d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe	70
PID 1928 wrote to memory of 388	1928	d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe	70
PID 1928 wrote to memory of 388	1928	d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe	70
PID 388 wrote to memory of 4328	388	z8510486.exe	71
PID 388 wrote to memory of 4328	388	z8510486.exe	71
PID 388 wrote to memory of 384	388	z8510486.exe	72
PID 388 wrote to memory of 384	388	z8510486.exe	72
PID 388 wrote to memory of 384	388	z8510486.exe	72

C:\Users\Admin\AppData\Local\Temp\d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe
"C:\Users\Admin\AppData\Local\Temp\d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe
    3⤵
    - Executes dropped EXE
    PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe

Filesize
206KB

MD5
abef71969f621b096119dde240a98be9

SHA1
df40430ba952d5adfad043a7f50b4acd19604440

SHA256
917d34dd1e19da9b4f421bdbd3c2122f70c923353b827ace159d30a2a9315d54

SHA512
92cddb5de433d023c4c660adffd2095371eb35169e9a9959b11f8f2071d1807815f51f18019c21feb16e5f1bb251d08bec4cb8029b41614bc3469ae85ce443d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8510486.exe

Filesize
206KB

MD5
abef71969f621b096119dde240a98be9

SHA1
df40430ba952d5adfad043a7f50b4acd19604440

SHA256
917d34dd1e19da9b4f421bdbd3c2122f70c923353b827ace159d30a2a9315d54

SHA512
92cddb5de433d023c4c660adffd2095371eb35169e9a9959b11f8f2071d1807815f51f18019c21feb16e5f1bb251d08bec4cb8029b41614bc3469ae85ce443d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe

Filesize
15KB

MD5
707032d7184f6c1e6a9c408374f3952f

SHA1
28e1a736574d68b027a1e11d489497dbf8e621d8

SHA256
c88a1a24b0e9b2922d01334680defb263bfa6d8d9ae9d838cc0fdf48307b5934

SHA512
9a973496d9faa8e014f9664ccda114fe9b0b8f60987ee3cd5fdfb732ff07614a2c113b8cab734cc3393d1fa359b7fc6b0b7327985c9fbe5c8c5f24d9fdeb02f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p9279846.exe

Filesize
15KB

MD5
707032d7184f6c1e6a9c408374f3952f

SHA1
28e1a736574d68b027a1e11d489497dbf8e621d8

SHA256
c88a1a24b0e9b2922d01334680defb263bfa6d8d9ae9d838cc0fdf48307b5934

SHA512
9a973496d9faa8e014f9664ccda114fe9b0b8f60987ee3cd5fdfb732ff07614a2c113b8cab734cc3393d1fa359b7fc6b0b7327985c9fbe5c8c5f24d9fdeb02f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe

Filesize
174KB

MD5
30bafade03d77b96bddc0e3eaffe81b9

SHA1
9fb93ef406f4f424baa8c8507c0a37da10b3c8ed

SHA256
4eda8ad90040a90c9b8ac30a2b0d43df6026c9630b466777b51234764379c8ca

SHA512
27c76dda83ae53c9d5f03e6573176ea976c61ff40c3d5cbf5dab61802c44864e444cd9df5e6a5cb18d437d229a3a84361907b5d31c152d21e827fe13d68b0427

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2366493.exe

Filesize
174KB

MD5
30bafade03d77b96bddc0e3eaffe81b9

SHA1
9fb93ef406f4f424baa8c8507c0a37da10b3c8ed

SHA256
4eda8ad90040a90c9b8ac30a2b0d43df6026c9630b466777b51234764379c8ca

SHA512
27c76dda83ae53c9d5f03e6573176ea976c61ff40c3d5cbf5dab61802c44864e444cd9df5e6a5cb18d437d229a3a84361907b5d31c152d21e827fe13d68b0427

Download Submit
memory/384-141-0x000000000B330000-0x000000000B936000-memory.dmp

Filesize
6.0MB

Download
memory/384-138-0x0000000000FE0000-0x0000000001010000-memory.dmp

Filesize
192KB

Download
memory/384-139-0x00000000736B0000-0x0000000073D9E000-memory.dmp

Filesize
6.9MB

Download
memory/384-140-0x00000000018F0000-0x00000000018F6000-memory.dmp

Filesize
24KB

Download
memory/384-142-0x000000000AE30000-0x000000000AF3A000-memory.dmp

Filesize
1.0MB

Download
memory/384-143-0x000000000AD20000-0x000000000AD32000-memory.dmp

Filesize
72KB

Download
memory/384-144-0x000000000AD80000-0x000000000ADBE000-memory.dmp

Filesize
248KB

Download
memory/384-145-0x000000000ADD0000-0x000000000AE1B000-memory.dmp

Filesize
300KB

Download
memory/384-146-0x00000000736B0000-0x0000000073D9E000-memory.dmp

Filesize
6.9MB

Download
memory/4328-134-0x00007FF8EBA70000-0x00007FF8EC45C000-memory.dmp

Filesize
9.9MB

Download
memory/4328-132-0x00007FF8EBA70000-0x00007FF8EC45C000-memory.dmp

Filesize
9.9MB

Download
memory/4328-131-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads