healer | 5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4

General

Target

5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe
Size

389KB
MD5

4c0ee4575495af04e7c58bab38be728f
SHA1

38ec99bddfc7371bff0271d5b06618c4b8edc28a
SHA256

5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4
SHA512

ab43f5567edc99ea8e02c50003fd6ab33d6fda09e7317ce0f4c45618626a2aa7bde9e631e34668eeaa81ad72c1e977c24cd0a49edebee62666b729a471447538
SSDEEP

12288:fMrby90gtNYRCQoiYZivJRwpuYisdDZpD:8yTEgZwAuYisdD7D

Score

10^/10

healer redline nasa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes

auth_value
6da71218d8a9738ea3a9a78b5677589b

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001af86-129.dat	healer
behavioral1/files/0x000700000001af86-130.dat	healer
behavioral1/memory/920-131-0x0000000000830000-0x000000000083A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	p7643138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	p7643138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	p7643138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	p7643138.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	p7643138.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
2852	z1186614.exe
920	p7643138.exe
1244	r6799250.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	p7643138.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1186614.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z1186614.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
920	p7643138.exe
920	p7643138.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	p7643138.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2852	3116	5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe	70
PID 3116 wrote to memory of 2852	3116	5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe	70
PID 3116 wrote to memory of 2852	3116	5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe	70
PID 2852 wrote to memory of 920	2852	z1186614.exe	71
PID 2852 wrote to memory of 920	2852	z1186614.exe	71
PID 2852 wrote to memory of 1244	2852	z1186614.exe	72
PID 2852 wrote to memory of 1244	2852	z1186614.exe	72
PID 2852 wrote to memory of 1244	2852	z1186614.exe	72

C:\Users\Admin\AppData\Local\Temp\5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe
"C:\Users\Admin\AppData\Local\Temp\5066fa88809775351ad7659df9361b186e76559f207314f8d5d64128aea78db4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1186614.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1186614.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7643138.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7643138.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6799250.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6799250.exe
    3⤵
    - Executes dropped EXE
    PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1186614.exe

Filesize
206KB

MD5
7e63b6b595edc3bbdf51cd6d1d43db8c

SHA1
3526e65c8970b7f4e1264f3b797db0415b25d7af

SHA256
25c2569b594d011b77479b8ce2ac398637ca41ee739edcf8e163987ef72903a9

SHA512
2d940115fe821173bc30277b0f4450a0656fe9dd9d5f97ec1834bec865e51808aae4cfd16503fe76e367878865ae7e6ca47773d28bbddda31bb38f94e8f0a0e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1186614.exe

Filesize
206KB

MD5
7e63b6b595edc3bbdf51cd6d1d43db8c

SHA1
3526e65c8970b7f4e1264f3b797db0415b25d7af

SHA256
25c2569b594d011b77479b8ce2ac398637ca41ee739edcf8e163987ef72903a9

SHA512
2d940115fe821173bc30277b0f4450a0656fe9dd9d5f97ec1834bec865e51808aae4cfd16503fe76e367878865ae7e6ca47773d28bbddda31bb38f94e8f0a0e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7643138.exe

Filesize
15KB

MD5
7f9ba5f0a0165d70810fbee527b0ec21

SHA1
e77cf10f7ff03bf130eca445b1c5987503776350

SHA256
8828b5e32a6d2bb33dc4ffa91fe84f1b9664ae8da8567197480b7a9f41b49794

SHA512
97f002106af2b4b73c5c8380e40097b3640c11d0928216e2b308398ce2c90d41fe689d88e57835a543b48affb5aa1434027974b437601c2cf9aa54ea5a1922f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p7643138.exe

Filesize
15KB

MD5
7f9ba5f0a0165d70810fbee527b0ec21

SHA1
e77cf10f7ff03bf130eca445b1c5987503776350

SHA256
8828b5e32a6d2bb33dc4ffa91fe84f1b9664ae8da8567197480b7a9f41b49794

SHA512
97f002106af2b4b73c5c8380e40097b3640c11d0928216e2b308398ce2c90d41fe689d88e57835a543b48affb5aa1434027974b437601c2cf9aa54ea5a1922f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6799250.exe

Filesize
175KB

MD5
64b4c13fbc7fbd5849c4abaa28fbf637

SHA1
bd8eb63a81dd7d0eaec05afab1e7dc8f9bfcb126

SHA256
e26700d0ac5bc64d43eaeed369a9598accf95c195011578455e630a35b8c115c

SHA512
4ca081f77c91b74e58261778ec0688b6ebc93662958785f1141204c99b8b58048696c0dba319fe5f3b225dc86f48e18fd153714dbc3e5ceeb403bcaadc24c6f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6799250.exe

Filesize
175KB

MD5
64b4c13fbc7fbd5849c4abaa28fbf637

SHA1
bd8eb63a81dd7d0eaec05afab1e7dc8f9bfcb126

SHA256
e26700d0ac5bc64d43eaeed369a9598accf95c195011578455e630a35b8c115c

SHA512
4ca081f77c91b74e58261778ec0688b6ebc93662958785f1141204c99b8b58048696c0dba319fe5f3b225dc86f48e18fd153714dbc3e5ceeb403bcaadc24c6f5

Download Submit
memory/920-131-0x0000000000830000-0x000000000083A000-memory.dmp

Filesize
40KB

Download
memory/920-134-0x00007FF9CB960000-0x00007FF9CC34C000-memory.dmp

Filesize
9.9MB

Download
memory/920-132-0x00007FF9CB960000-0x00007FF9CC34C000-memory.dmp

Filesize
9.9MB

Download
memory/1244-138-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/1244-139-0x0000000072FC0000-0x00000000736AE000-memory.dmp

Filesize
6.9MB

Download
memory/1244-140-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Filesize
24KB

Download
memory/1244-141-0x000000000A640000-0x000000000AC46000-memory.dmp

Filesize
6.0MB

Download
memory/1244-142-0x000000000A160000-0x000000000A26A000-memory.dmp

Filesize
1.0MB

Download
memory/1244-143-0x000000000A090000-0x000000000A0A2000-memory.dmp

Filesize
72KB

Download
memory/1244-144-0x000000000A0F0000-0x000000000A12E000-memory.dmp

Filesize
248KB

Download
memory/1244-145-0x000000000A270000-0x000000000A2BB000-memory.dmp

Filesize
300KB

Download
memory/1244-146-0x0000000072FC0000-0x00000000736AE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads