healer | 0585e6076efbd458084570eedaa67d5aa4ab5d9e84dab51575700d81fc62b339

General

Target

2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe
Size

549KB
MD5

2cf3440b2d80262ff7e81b5e204dbd20
SHA1

d6356872e9a662519642cc082e006f8740acdf6b
SHA256

0585e6076efbd458084570eedaa67d5aa4ab5d9e84dab51575700d81fc62b339
SHA512

b4119ab90a205788b835899937ce4bd4582f635839ce2864d4adcfe684a1b372b94071c1f49469c9fdb0575719f4ab23a3bb4a959d23e9cc36b9353c780cd4b0
SSDEEP

12288:6MrMy90IsGEEvxrgzFE9q68EslUpPdxzEKz41d0E50Uo:6yDsErf9N+lUbx0p50Uo

Score

10^/10

healer redline norm dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.68.70:19073

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/3216-14-0x0000000000500000-0x000000000050A000-memory.dmp	healer
behavioral1/files/0x0007000000023476-23.dat	healer
behavioral1/memory/2260-25-0x00000000008C0000-0x00000000008CA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8956746.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b9445885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b9445885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b9445885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b9445885.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a8956746.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8956746.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8956746.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8956746.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8956746.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b9445885.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b9445885.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2020-30-0x0000000000550000-0x0000000000580000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
4412	v5404905.exe
3216	a8956746.exe
2260	b9445885.exe
2020	c0447071.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a8956746.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8956746.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b9445885.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5404905.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3216	a8956746.exe
3216	a8956746.exe
2260	b9445885.exe
2260	b9445885.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	a8956746.exe
Token: SeDebugPrivilege	2260	b9445885.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4412	2864	2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe	83
PID 2864 wrote to memory of 4412	2864	2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe	83
PID 2864 wrote to memory of 4412	2864	2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe	83
PID 4412 wrote to memory of 3216	4412	v5404905.exe	84
PID 4412 wrote to memory of 3216	4412	v5404905.exe	84
PID 4412 wrote to memory of 3216	4412	v5404905.exe	84
PID 4412 wrote to memory of 2260	4412	v5404905.exe	95
PID 4412 wrote to memory of 2260	4412	v5404905.exe	95
PID 2864 wrote to memory of 2020	2864	2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe	96
PID 2864 wrote to memory of 2020	2864	2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe	96
PID 2864 wrote to memory of 2020	2864	2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe	96

C:\Users\Admin\AppData\Local\Temp\2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2cf3440b2d80262ff7e81b5e204dbd20_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5404905.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5404905.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8956746.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8956746.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9445885.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9445885.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0447071.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0447071.exe
  2⤵
  - Executes dropped EXE
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0447071.exe

Filesize
1.3MB

MD5
f562171d84a24d8e9dd4b9b963a3c9a5

SHA1
8e6a66a1ff0977a40e3a092c11f9c7b944e39f54

SHA256
c0d0e395859918cbcc6915501a3acb89f4a07925cba31f8db92d9c6ad3f44e56

SHA512
239cdbcf2bd7693c34e0320eda1b2abf446a69807398e7e00e3799348eeb7ce05554da19da0f70174a399c2531bc2b70a828a7b90a108b372e6ece15c02f31b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5404905.exe

Filesize
216KB

MD5
095a749df5b15e24eab3b2f6bad2ef63

SHA1
73c4f165fb2a86bb56a18c5556523dc768978bff

SHA256
0cfb7bdfd0142bd4c25025a21a3127f49a2c95413e22ac887048fb79fd0ded75

SHA512
8725015ee28e53136f45569e31cc99b8dfbd36a85e71c2969ad5f9c8c8de663f48b82d5c10e2a8168b77326a1cc9d43f62c5cf845322219ac190cc714dfb0988

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8956746.exe

Filesize
185KB

MD5
263befbc9f53ae6a8836ea233ead58dc

SHA1
a32170410e34bd3525d0df8c57a6693b0e9549d5

SHA256
3cea536de2994de5250096d9fb20b5e64906f488f22d5a242050fb7e40915705

SHA512
850edfb97d52ea6fef814f3931a166dd6778918407f068927d6af7fae27c1d4af10292e0389b3402079f17ce9bbf7f92f35eadc2f9a080a3af2a0a857ffd163b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9445885.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/2020-37-0x00000000051D0000-0x00000000052DA000-memory.dmp

Filesize
1.0MB

Download
memory/2020-30-0x0000000000550000-0x0000000000580000-memory.dmp

Filesize
192KB

Download
memory/2020-35-0x0000000006EF0000-0x0000000006EF6000-memory.dmp

Filesize
24KB

Download
memory/2020-36-0x0000000004B70000-0x0000000005188000-memory.dmp

Filesize
6.1MB

Download
memory/2020-38-0x0000000005310000-0x0000000005322000-memory.dmp

Filesize
72KB

Download
memory/2020-39-0x0000000005330000-0x000000000536C000-memory.dmp

Filesize
240KB

Download
memory/2020-40-0x00000000053D0000-0x000000000541C000-memory.dmp

Filesize
304KB

Download
memory/2260-25-0x00000000008C0000-0x00000000008CA000-memory.dmp

Filesize
40KB

Download
memory/3216-19-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3216-18-0x0000000000410000-0x0000000000425000-memory.dmp

Filesize
84KB

Download
memory/3216-14-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads