healer | 7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb

General

Target

7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb.exe
Size

753KB
MD5

cd477aac77d7453206b9e984a4444fc3
SHA1

c798de0cf5623a3d7b4beb0e8fa98bb6f32e91b9
SHA256

7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb
SHA512

a9ac3f52f11f0d4c439cbbcf99a864928b5fd4713bc867cc28d33655276e8c853310e7b4d28d99d64bab94377f199b35da24e68d11a0b260a099e1fb583764f8
SSDEEP

12288:qMrYy90EqcrEywjFwiKj1PC4/JTc557oUsiB3yPC/oVSnuFlx1GM7Hzj:eyUOiKFC4BTI57oUEkoVcWvnj

Score

10^/10

healer redline dusa dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dusa

C2

83.97.73.127:19045

Attributes

auth_value
ee896466545fedf9de5406175fb82de5

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/316-23-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
2380	y9143845.exe
1244	y5457738.exe
4612	k5231148.exe
3368	l3651390.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5457738.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9143845.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4612 set thread context of 316	4612	k5231148.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
316	AppLaunch.exe
316	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	AppLaunch.exe
Token: SeManageVolumePrivilege	3504	svchost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2380	4264	7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb.exe	84
PID 4264 wrote to memory of 2380	4264	7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb.exe	84
PID 4264 wrote to memory of 2380	4264	7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb.exe	84
PID 2380 wrote to memory of 1244	2380	y9143845.exe	85
PID 2380 wrote to memory of 1244	2380	y9143845.exe	85
PID 2380 wrote to memory of 1244	2380	y9143845.exe	85
PID 1244 wrote to memory of 4612	1244	y5457738.exe	86
PID 1244 wrote to memory of 4612	1244	y5457738.exe	86
PID 1244 wrote to memory of 4612	1244	y5457738.exe	86
PID 4612 wrote to memory of 316	4612	k5231148.exe	89
PID 4612 wrote to memory of 316	4612	k5231148.exe	89
PID 4612 wrote to memory of 316	4612	k5231148.exe	89
PID 4612 wrote to memory of 316	4612	k5231148.exe	89
PID 4612 wrote to memory of 316	4612	k5231148.exe	89
PID 1244 wrote to memory of 3368	1244	y5457738.exe	90
PID 1244 wrote to memory of 3368	1244	y5457738.exe	90
PID 1244 wrote to memory of 3368	1244	y5457738.exe	90

C:\Users\Admin\AppData\Local\Temp\7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb.exe
"C:\Users\Admin\AppData\Local\Temp\7106d40d171b3795f4583a91e1b105bd7fc2cb102e290d33d9bbd01ce12622bb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9143845.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9143845.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5457738.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5457738.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5231148.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5231148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3651390.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3651390.exe
      4⤵
      Executes dropped EXE
      PID:3368

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9143845.exe

Filesize
454KB

MD5
6a89839bef7babff13f0294d47999d4d

SHA1
2440d22d80ac9182bf20a23b7c941d26ef230bec

SHA256
3736edc6b042256963bec450a629d417abc7420e91c6a92c2798779dc9d709fc

SHA512
72228db8e23fb2fde2ab30fb55ade211c702f7ebb94f6f09258a1c8757f356208256340790705b5fe6e9a18cb0465f76d58e0435ef337a28724d409b55b241ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9143845.exe

Filesize
454KB

MD5
6a89839bef7babff13f0294d47999d4d

SHA1
2440d22d80ac9182bf20a23b7c941d26ef230bec

SHA256
3736edc6b042256963bec450a629d417abc7420e91c6a92c2798779dc9d709fc

SHA512
72228db8e23fb2fde2ab30fb55ade211c702f7ebb94f6f09258a1c8757f356208256340790705b5fe6e9a18cb0465f76d58e0435ef337a28724d409b55b241ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5457738.exe

Filesize
282KB

MD5
a037743c2a6055e38a8c91b96a57d545

SHA1
6257e2ffd34798f5f8d1a3432723dd014d0fe76f

SHA256
9c6cbdb70bcb4fea1fad0edf981595ae659bb7b30f185aee6734c2ed1a1e2e27

SHA512
b9efdb8164ddd70b941c6b64d280786d27a0be93bb0cea0fc89d40a8393a68352caab34fb735e8b0ff55a522c3a22cfe2a5480463a6cdd2e0fec9a6d22c1e1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5457738.exe

Filesize
282KB

MD5
a037743c2a6055e38a8c91b96a57d545

SHA1
6257e2ffd34798f5f8d1a3432723dd014d0fe76f

SHA256
9c6cbdb70bcb4fea1fad0edf981595ae659bb7b30f185aee6734c2ed1a1e2e27

SHA512
b9efdb8164ddd70b941c6b64d280786d27a0be93bb0cea0fc89d40a8393a68352caab34fb735e8b0ff55a522c3a22cfe2a5480463a6cdd2e0fec9a6d22c1e1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5231148.exe

Filesize
169KB

MD5
57c4bc75f678ff9e333d9554e447766b

SHA1
567b479ab59a67fff64ea7be793c55ade1b08137

SHA256
e3f1b34eb94e0a77996ada95bda0559de49353a6c54694d96958a4643db47705

SHA512
005a5481d4d19c7a2a89d34ba3f84cb99622241b8f1860c12df54652a888caeee6e806bb1c928b7217bbd325cb1f96aabcc7191745fa7c833be723a67c809dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5231148.exe

Filesize
169KB

MD5
57c4bc75f678ff9e333d9554e447766b

SHA1
567b479ab59a67fff64ea7be793c55ade1b08137

SHA256
e3f1b34eb94e0a77996ada95bda0559de49353a6c54694d96958a4643db47705

SHA512
005a5481d4d19c7a2a89d34ba3f84cb99622241b8f1860c12df54652a888caeee6e806bb1c928b7217bbd325cb1f96aabcc7191745fa7c833be723a67c809dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3651390.exe

Filesize
168KB

MD5
08ff3d597c112cef0dacdf77e020d580

SHA1
693de4609e08f7626d05c78b848abefa2e83a0df

SHA256
c61e7f08640e7270f85e6f526f6f4d9ed9218df37c250d9fd59006ac3a895429

SHA512
418c4042d92057fbe2e2fb488632d59f64b4d6f3b50f5be89c35d713f9a4d6712094ef944404752df685cd177fe78376c12e8bd0cb00ac4b47d10c77a0cf4415

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3651390.exe

Filesize
168KB

MD5
08ff3d597c112cef0dacdf77e020d580

SHA1
693de4609e08f7626d05c78b848abefa2e83a0df

SHA256
c61e7f08640e7270f85e6f526f6f4d9ed9218df37c250d9fd59006ac3a895429

SHA512
418c4042d92057fbe2e2fb488632d59f64b4d6f3b50f5be89c35d713f9a4d6712094ef944404752df685cd177fe78376c12e8bd0cb00ac4b47d10c77a0cf4415

Download Submit
memory/316-43-0x0000000074720000-0x0000000074ED0000-memory.dmp

Filesize
7.7MB

Download
memory/316-23-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/316-41-0x0000000074720000-0x0000000074ED0000-memory.dmp

Filesize
7.7MB

Download
memory/316-32-0x0000000074720000-0x0000000074ED0000-memory.dmp

Filesize
7.7MB

Download
memory/3368-40-0x00000000052C0000-0x000000000530C000-memory.dmp

Filesize
304KB

Download
memory/3368-45-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/3368-35-0x00000000056B0000-0x0000000005CC8000-memory.dmp

Filesize
6.1MB

Download
memory/3368-36-0x00000000051B0000-0x00000000052BA000-memory.dmp

Filesize
1.0MB

Download
memory/3368-37-0x00000000050E0000-0x00000000050F2000-memory.dmp

Filesize
72KB

Download
memory/3368-38-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/3368-39-0x0000000005140000-0x000000000517C000-memory.dmp

Filesize
240KB

Download
memory/3368-33-0x0000000002A40000-0x0000000002A46000-memory.dmp

Filesize
24KB

Download
memory/3368-31-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/3368-34-0x0000000074720000-0x0000000074ED0000-memory.dmp

Filesize
7.7MB

Download
memory/3368-44-0x0000000074720000-0x0000000074ED0000-memory.dmp

Filesize
7.7MB

Download
memory/3504-62-0x00000212D0240000-0x00000212D0250000-memory.dmp

Filesize
64KB

Download
memory/3504-46-0x00000212D0140000-0x00000212D0150000-memory.dmp

Filesize
64KB

Download
memory/3504-78-0x00000212D8560000-0x00000212D8561000-memory.dmp

Filesize
4KB

Download
memory/3504-80-0x00000212D8590000-0x00000212D8591000-memory.dmp

Filesize
4KB

Download
memory/3504-81-0x00000212D8590000-0x00000212D8591000-memory.dmp

Filesize
4KB

Download
memory/3504-82-0x00000212D86A0000-0x00000212D86A1000-memory.dmp

Filesize
4KB

Download
memory/4612-22-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads