healer | 0fdbc770ea66f062af959235a3a6559123d5408a322c111592ef584215ef81c4

General

Target

x8731362.exe
Size

320KB
MD5

faa8635b24a3c8c194ea66f37770732e
SHA1

7a45390809e3fb5a228396d3b5ff05b3a99bc9be
SHA256

0fdbc770ea66f062af959235a3a6559123d5408a322c111592ef584215ef81c4
SHA512

e269067cd43197b7d6c6901cb3ab55cec1a7e8aeb80f9a1b938bfcb3b4d0cb847a90766fc22ac393f7c035022911fe5ace8ce56c3268fdc3503f60b266789db3
SSDEEP

6144:Khy+bnr+cp0yN90QENl926D2lD3Ka815dCpo8vYvZtAj0nwr43dlN4ZGEA:7Mroy90zl926SlDyBzPvzAj1EGjA

Score

10^/10

healer redline vasha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

vasha

C2

77.91.124.82:19071

Attributes

auth_value
42fc61786274daca54d589b85a2c1954

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4708-7-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 2 IoCs

Processes:

g7935047.exeh3626941.exe

pid process

3096 g7935047.exe
1020 h3626941.exe

pid	process
3096	g7935047.exe
1020	h3626941.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

x8731362.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	x8731362.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

g7935047.exe

description pid process target process

PID 3096 set thread context of 4708 3096 g7935047.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

4708 AppLaunch.exe
4708 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4708 AppLaunch.exe

description	pid	process	target process
PID 3096 set thread context of 4708	3096	g7935047.exe	AppLaunch.exe

pid	process
4708	AppLaunch.exe
4708	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4708	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

x8731362.exeg7935047.exe

description	pid	process	target process
PID 4428 wrote to memory of 3096	4428	x8731362.exe	g7935047.exe
PID 4428 wrote to memory of 3096	4428	x8731362.exe	g7935047.exe
PID 4428 wrote to memory of 3096	4428	x8731362.exe	g7935047.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 3096 wrote to memory of 4708	3096	g7935047.exe	AppLaunch.exe
PID 4428 wrote to memory of 1020	4428	x8731362.exe	h3626941.exe
PID 4428 wrote to memory of 1020	4428	x8731362.exe	h3626941.exe
PID 4428 wrote to memory of 1020	4428	x8731362.exe	h3626941.exe

C:\Users\Admin\AppData\Local\Temp\x8731362.exe
"C:\Users\Admin\AppData\Local\Temp\x8731362.exe"
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4428

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
- Executes dropped EXE
PID:1020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Impair Defenses

1

T1562

Disable or Modify Tools

1

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
Filesize
236KB

MD5
ae3c2011e6b28a83ed5ec20506e2e3eb

SHA1
34bcdb009271f3301b37346648ade33ceecf9556

SHA256
797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

SHA512
8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7935047.exe
Filesize
236KB

MD5
ae3c2011e6b28a83ed5ec20506e2e3eb

SHA1
34bcdb009271f3301b37346648ade33ceecf9556

SHA256
797cfa22728210b5dfc1b746fda10be7684798629c168664d754440882c5dbcf

SHA512
8c8f8a783cd2fa9de0a23735c958dab8563b7f100e77c3e821287a7a07d05db398dd2a3a00b447c11b34d89b0c48ef497a869003582159e7e6c134bba6cd3138

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
Filesize
174KB

MD5
43acc3d174d9c2da4013def25ed93107

SHA1
c0e91ed2ab5c607fc0b22c8f4209db792c26fa5f

SHA256
745e358e9b0eefe2efe8d14cdbf17a194b81a80f929df4514cc3fed696d259ee

SHA512
6ddecd71a2e5f9d6670f297513fe3db5e2ed4e859857d8a25a42dbcfe03e6d5f70762af836061a0ebfdfc05be6ca102d6b9116fe6e627a989811da07c59b9614

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h3626941.exe
Filesize
174KB

MD5
43acc3d174d9c2da4013def25ed93107

SHA1
c0e91ed2ab5c607fc0b22c8f4209db792c26fa5f

SHA256
745e358e9b0eefe2efe8d14cdbf17a194b81a80f929df4514cc3fed696d259ee

SHA512
6ddecd71a2e5f9d6670f297513fe3db5e2ed4e859857d8a25a42dbcfe03e6d5f70762af836061a0ebfdfc05be6ca102d6b9116fe6e627a989811da07c59b9614

Download Submit
memory/1020-17-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6MB

Download
memory/1020-14-0x0000000000B80000-0x0000000000BB0000-memory.dmp

Filesize
192KB

Download
memory/1020-16-0x0000000005340000-0x0000000005346000-memory.dmp

Filesize
24KB

Download
memory/1020-18-0x000000000AED0000-0x000000000B4D6000-memory.dmp

Filesize
6MB

Download
memory/1020-19-0x000000000A9D0000-0x000000000AADA000-memory.dmp

Filesize
1MB

Download
memory/1020-20-0x000000000A8C0000-0x000000000A8D2000-memory.dmp

Filesize
72KB

Download
memory/1020-21-0x000000000A920000-0x000000000A95E000-memory.dmp

Filesize
248KB

Download
memory/1020-26-0x000000000A970000-0x000000000A9BB000-memory.dmp

Filesize
300KB

Download
memory/1020-47-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6MB

Download
memory/4708-15-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6MB

Download
memory/4708-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4708-31-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6MB

Download
memory/4708-46-0x0000000073080000-0x000000007376E000-memory.dmp

Filesize
6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads