healer | 744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45

General

Target

744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45.exe
Size

563KB
MD5

a7bbb957c95cc482fbf153844d2ef985
SHA1

858359a1bda1b135849e4e638b1b12480e84e837
SHA256

744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45
SHA512

04c55513f5212b5ddbb899b34c91f7e7538637434daeb801b759367096e2ccedf773a1da14ca4e212637ce01c38774ab77582bf0c737f64c194d4d2b606c13fb
SSDEEP

12288:UMrfy90ZsJaqTDSvqcJoG9QaZNxPOHtrtGg/YYGoZtb:TyAsEqTDq9H6PGgEytb

Score

10^/10

healer redline dava dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dava

C2

77.91.124.54:19071

Attributes

auth_value
3ce5222c1baaa06681dfe0012ce1de23

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001af6d-136.dat	healer
behavioral1/files/0x000700000001af6d-137.dat	healer
behavioral1/memory/3164-138-0x0000000000920000-0x000000000092A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	r2662581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	r2662581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	r2662581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	r2662581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	r2662581.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
4392	z3942192.exe
3292	z2389765.exe
3164	r2662581.exe
4440	s3645993.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	r2662581.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3942192.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2389765.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3164	r2662581.exe
3164	r2662581.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	r2662581.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4392	3924	744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45.exe	70
PID 3924 wrote to memory of 4392	3924	744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45.exe	70
PID 3924 wrote to memory of 4392	3924	744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45.exe	70
PID 4392 wrote to memory of 3292	4392	z3942192.exe	71
PID 4392 wrote to memory of 3292	4392	z3942192.exe	71
PID 4392 wrote to memory of 3292	4392	z3942192.exe	71
PID 3292 wrote to memory of 3164	3292	z2389765.exe	72
PID 3292 wrote to memory of 3164	3292	z2389765.exe	72
PID 3292 wrote to memory of 4440	3292	z2389765.exe	73
PID 3292 wrote to memory of 4440	3292	z2389765.exe	73
PID 3292 wrote to memory of 4440	3292	z2389765.exe	73

C:\Users\Admin\AppData\Local\Temp\744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45.exe
"C:\Users\Admin\AppData\Local\Temp\744740aac036b70091d59100b759d69be2e44c39896c47549640adb39b7a4c45.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3942192.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3942192.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2389765.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2389765.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2662581.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2662581.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s3645993.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s3645993.exe
      4⤵
      Executes dropped EXE
      PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3942192.exe

Filesize
431KB

MD5
57fd5a7bb2385fed8328527e75be9cec

SHA1
219e69d432f344807d781fba214c8e4312632ca8

SHA256
7e33ce2dedf9ec97aad18794282d7f075552455970174f660c7c03d5980a6cd3

SHA512
c2e5b6c230a37da2f25a18bb4c64d065ad27f8d4b9a151bf7f300efba82511421cedc2aa71bd2b8d337a204fffb8fcb21f4038f504b23a1e42f09a0d5aa71f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3942192.exe

Filesize
431KB

MD5
57fd5a7bb2385fed8328527e75be9cec

SHA1
219e69d432f344807d781fba214c8e4312632ca8

SHA256
7e33ce2dedf9ec97aad18794282d7f075552455970174f660c7c03d5980a6cd3

SHA512
c2e5b6c230a37da2f25a18bb4c64d065ad27f8d4b9a151bf7f300efba82511421cedc2aa71bd2b8d337a204fffb8fcb21f4038f504b23a1e42f09a0d5aa71f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2389765.exe

Filesize
206KB

MD5
35c4803e6a8904cc1c7a92f3ce93121b

SHA1
ed039fad48abd89786d832b95b28f838b63cb4aa

SHA256
5a12cac01e4b568a3785300ac52f149e04e1f493e7c6845171b454b60a2a313c

SHA512
94d1001de074b0a2641b1642efe7bcb12b6692bf3d640e4a927523da3bb3560c68f07e490195507e7bef05bcfd85d34297529336cc783540bcfba287fe50ac82

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2389765.exe

Filesize
206KB

MD5
35c4803e6a8904cc1c7a92f3ce93121b

SHA1
ed039fad48abd89786d832b95b28f838b63cb4aa

SHA256
5a12cac01e4b568a3785300ac52f149e04e1f493e7c6845171b454b60a2a313c

SHA512
94d1001de074b0a2641b1642efe7bcb12b6692bf3d640e4a927523da3bb3560c68f07e490195507e7bef05bcfd85d34297529336cc783540bcfba287fe50ac82

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2662581.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r2662581.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s3645993.exe

Filesize
174KB

MD5
d6697deb3ae5b7fb32f56cbe43452459

SHA1
8e580e96222a22c2b5016be25a034f6e011c5e78

SHA256
fb2fd350a95db5d37f97c78da3386e8d7d31d4ce43122f9f030a3c3d20542a53

SHA512
020c9c9e9e5ac912d42d982871df494cce3d550b860da2eccf6e25ab5e4c7a8d77a924394a94f76a6cbc05ed506b91738832788804d06b7033e4cd49258c3ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s3645993.exe

Filesize
174KB

MD5
d6697deb3ae5b7fb32f56cbe43452459

SHA1
8e580e96222a22c2b5016be25a034f6e011c5e78

SHA256
fb2fd350a95db5d37f97c78da3386e8d7d31d4ce43122f9f030a3c3d20542a53

SHA512
020c9c9e9e5ac912d42d982871df494cce3d550b860da2eccf6e25ab5e4c7a8d77a924394a94f76a6cbc05ed506b91738832788804d06b7033e4cd49258c3ed1

Download Submit
memory/3164-141-0x00007FFB659C0000-0x00007FFB663AC000-memory.dmp

Filesize
9.9MB

Download
memory/3164-139-0x00007FFB659C0000-0x00007FFB663AC000-memory.dmp

Filesize
9.9MB

Download
memory/3164-138-0x0000000000920000-0x000000000092A000-memory.dmp

Filesize
40KB

Download
memory/4440-146-0x0000000072F40000-0x000000007362E000-memory.dmp

Filesize
6.9MB

Download
memory/4440-145-0x0000000000D70000-0x0000000000DA0000-memory.dmp

Filesize
192KB

Download
memory/4440-147-0x0000000003000000-0x0000000003006000-memory.dmp

Filesize
24KB

Download
memory/4440-148-0x000000000B1E0000-0x000000000B7E6000-memory.dmp

Filesize
6.0MB

Download
memory/4440-149-0x000000000ACE0000-0x000000000ADEA000-memory.dmp

Filesize
1.0MB

Download
memory/4440-150-0x000000000ABF0000-0x000000000AC02000-memory.dmp

Filesize
72KB

Download
memory/4440-151-0x000000000AC50000-0x000000000AC8E000-memory.dmp

Filesize
248KB

Download
memory/4440-152-0x000000000ADF0000-0x000000000AE3B000-memory.dmp

Filesize
300KB

Download
memory/4440-153-0x0000000072F40000-0x000000007362E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads