healer | 023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab

General

Target

023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe
Size

389KB
MD5

10a8a4be5b6f6644696f6e204b567388
SHA1

3d8ba77c381c1b2fe8c760446a92166e6b90a415
SHA256

023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab
SHA512

f7557a3c891c2af00d9664938673a692e86ae6c67e7c2c669b22bcd18450c5fc65035c8fc448fb2250a47b43762193d0799a0fb586ea13c3ec95ebba33e5a262
SSDEEP

6144:KOy+bnr+Lp0yN90QEwf/AirvTU07jytXLQwW4JZdlWNWywjZ4x8jFDSmjZJ:iMrny90zirUdtrWwZdlYw28jxSsZJ

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023266-145.dat	healer
behavioral1/files/0x0007000000023266-146.dat	healer
behavioral1/memory/2532-147-0x00000000003A0000-0x00000000003AA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	p6104690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p6104690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p6104690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p6104690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p6104690.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p6104690.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
928	z7868915.exe
2532	p6104690.exe
2092	r0376993.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p6104690.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z7868915.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7868915.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	p6104690.exe
2532	p6104690.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	p6104690.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 928	3440	023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe	85
PID 3440 wrote to memory of 928	3440	023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe	85
PID 3440 wrote to memory of 928	3440	023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe	85
PID 928 wrote to memory of 2532	928	z7868915.exe	86
PID 928 wrote to memory of 2532	928	z7868915.exe	86
PID 928 wrote to memory of 2092	928	z7868915.exe	94
PID 928 wrote to memory of 2092	928	z7868915.exe	94
PID 928 wrote to memory of 2092	928	z7868915.exe	94

C:\Users\Admin\AppData\Local\Temp\023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe
"C:\Users\Admin\AppData\Local\Temp\023336483f6affe46a0faa30c6dea5dd7f1090b346af5655e61c8bbce02a42ab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7868915.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7868915.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p6104690.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p6104690.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0376993.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0376993.exe
    3⤵
    - Executes dropped EXE
    PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7868915.exe

Filesize
206KB

MD5
ecb8e4d2197ed18f7c0233047fbd8a44

SHA1
bb080d190cd4466754d0f1b17f925a30bf2f5776

SHA256
d4f282afede4072216b5d2cf0020ec4f9d21037b435fe4b9b3124efcb5da41d1

SHA512
b73adb8b3f3794ed06a62955f3658c7da248044ecbfb90e1d2b08c5d08d541a166df0e586e6dde6a964d48aa9a68dacd6278f3cde575cda794d62c5d88f39b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7868915.exe

Filesize
206KB

MD5
ecb8e4d2197ed18f7c0233047fbd8a44

SHA1
bb080d190cd4466754d0f1b17f925a30bf2f5776

SHA256
d4f282afede4072216b5d2cf0020ec4f9d21037b435fe4b9b3124efcb5da41d1

SHA512
b73adb8b3f3794ed06a62955f3658c7da248044ecbfb90e1d2b08c5d08d541a166df0e586e6dde6a964d48aa9a68dacd6278f3cde575cda794d62c5d88f39b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p6104690.exe

Filesize
15KB

MD5
9721707d1c4f8a05e6bacc23a38036b2

SHA1
f0eebc15cda33a65ae70a54215e831a645e39eaf

SHA256
e186adaf253266151e0b3bc3bf4673f86325e867ee2bac70b502aec5d686cf37

SHA512
dda8ff8f7c36e9ce8098eb6628c349c05f8124013619d457633d813d586f26ad49e22b499442b423477452e3cc803f1ca65a75f6fca17c4e4ea17792a98a6cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p6104690.exe

Filesize
15KB

MD5
9721707d1c4f8a05e6bacc23a38036b2

SHA1
f0eebc15cda33a65ae70a54215e831a645e39eaf

SHA256
e186adaf253266151e0b3bc3bf4673f86325e867ee2bac70b502aec5d686cf37

SHA512
dda8ff8f7c36e9ce8098eb6628c349c05f8124013619d457633d813d586f26ad49e22b499442b423477452e3cc803f1ca65a75f6fca17c4e4ea17792a98a6cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0376993.exe

Filesize
174KB

MD5
cedec7c88254bedf818ce36fc5e1fb75

SHA1
dbd2ec208c10755f540640cf18aa3e72556babcc

SHA256
0d72b7ae232dd313898c2270009b479b8c642b1798ad53f761a45ab41b0f2621

SHA512
75699e31c014dc4e33001af5d41d0c96ea7118fe18af6af05eeeeb8832874bb464549ac62aa2611685beb3128caafcd12048a51b2e28209a534d2c9b61c71e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0376993.exe

Filesize
174KB

MD5
cedec7c88254bedf818ce36fc5e1fb75

SHA1
dbd2ec208c10755f540640cf18aa3e72556babcc

SHA256
0d72b7ae232dd313898c2270009b479b8c642b1798ad53f761a45ab41b0f2621

SHA512
75699e31c014dc4e33001af5d41d0c96ea7118fe18af6af05eeeeb8832874bb464549ac62aa2611685beb3128caafcd12048a51b2e28209a534d2c9b61c71e2c

Download Submit
memory/2092-157-0x000000000A100000-0x000000000A20A000-memory.dmp

Filesize
1.0MB

Download
memory/2092-154-0x0000000000150000-0x0000000000180000-memory.dmp

Filesize
192KB

Download
memory/2092-155-0x00000000742D0000-0x0000000074A80000-memory.dmp

Filesize
7.7MB

Download
memory/2092-156-0x000000000A580000-0x000000000AB98000-memory.dmp

Filesize
6.1MB

Download
memory/2092-158-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/2092-159-0x000000000A040000-0x000000000A052000-memory.dmp

Filesize
72KB

Download
memory/2092-160-0x000000000A0A0000-0x000000000A0DC000-memory.dmp

Filesize
240KB

Download
memory/2092-161-0x00000000742D0000-0x0000000074A80000-memory.dmp

Filesize
7.7MB

Download
memory/2092-162-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/2532-150-0x00007FFAD44F0000-0x00007FFAD4FB1000-memory.dmp

Filesize
10.8MB

Download
memory/2532-148-0x00007FFAD44F0000-0x00007FFAD4FB1000-memory.dmp

Filesize
10.8MB

Download
memory/2532-147-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads