healer | 7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0

General

Target

7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0.exe
Size

600KB
MD5

05b7cd59f0d4be2bf064cd4073dd3976
SHA1

f4b09b7854766cebd5afb15e124d5390a4b052f3
SHA256

7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0
SHA512

59ec9afc5eb8d735d7166f451015f0bd16c4f4327620c4b32516340a09db107e4e4c44c6fec78482a1c36f7fdf86c051e4923375cbc2275d7853d9a109229b0f
SSDEEP

12288:8jiy90ZfhSLeXfOhyRc7cG+Y1VaD/DYnywatJdro1Z0GZx6iU:dyAsiSz7cGN1V0/knhatJi8uU

Score

10^/10

healer redline mucha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mucha

C2

83.97.73.131:19071

Attributes

auth_value
5d76e123341992ecf110010eb89456f0

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/4508-22-0x0000000000470000-0x000000000047A000-memory.dmp	healer
behavioral1/files/0x0007000000023415-28.dat	healer
behavioral1/memory/1004-31-0x00000000003B0000-0x00000000003BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b1800591.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b1800591.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b1800591.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1653901.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1653901.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1653901.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b1800591.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b1800591.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1653901.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1653901.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1653901.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b1800591.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4596-39-0x0000000000530000-0x0000000000560000-memory.dmp	family_redline

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 3 IoCs

resource	yara_rule
behavioral1/memory/4508-22-0x0000000000470000-0x000000000047A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x0007000000023415-28.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/1004-31-0x00000000003B0000-0x00000000003BA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral1/memory/4596-39-0x0000000000530000-0x0000000000560000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Executes dropped EXE 5 IoCs

pid	Process
956	v8554562.exe
4000	v5458650.exe
4508	a1653901.exe
1004	b1800591.exe
4596	c1374699.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1653901.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1653901.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b1800591.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8554562.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5458650.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4948	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4508	a1653901.exe
4508	a1653901.exe
1004	b1800591.exe
1004	b1800591.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	a1653901.exe
Token: SeDebugPrivilege	1004	b1800591.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 956	1412	7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0.exe	83
PID 1412 wrote to memory of 956	1412	7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0.exe	83
PID 1412 wrote to memory of 956	1412	7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0.exe	83
PID 956 wrote to memory of 4000	956	v8554562.exe	84
PID 956 wrote to memory of 4000	956	v8554562.exe	84
PID 956 wrote to memory of 4000	956	v8554562.exe	84
PID 4000 wrote to memory of 4508	4000	v5458650.exe	85
PID 4000 wrote to memory of 4508	4000	v5458650.exe	85
PID 4000 wrote to memory of 4508	4000	v5458650.exe	85
PID 4000 wrote to memory of 1004	4000	v5458650.exe	96
PID 4000 wrote to memory of 1004	4000	v5458650.exe	96
PID 956 wrote to memory of 4596	956	v8554562.exe	97
PID 956 wrote to memory of 4596	956	v8554562.exe	97
PID 956 wrote to memory of 4596	956	v8554562.exe	97

C:\Users\Admin\AppData\Local\Temp\7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0.exe
"C:\Users\Admin\AppData\Local\Temp\7bc34a2b91dd1e6d6bce7a2ed676bb50616badd70699dd6f532def3070e68ac0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8554562.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8554562.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5458650.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5458650.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1653901.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1653901.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1800591.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1800591.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1004
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1374699.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1374699.exe
    3⤵
    - Executes dropped EXE
    PID:4596

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8554562.exe

Filesize
428KB

MD5
32dad8ea517dfa3d62a21338b37014cd

SHA1
b7a586bba1bd1e82078966f5913146e40bca75b7

SHA256
53f1d04fb774ed4164ead79e0e4cc69c85e99d2c423ce1f38befdff61d064b78

SHA512
413e6826743071c88cfe72265c8a022f14b6b3d6a0a4108c199eb544c0d69e5c5c3c2058986d6d15eb8958f878637b0b378a1b5e664029519ac1e2e09728b532

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c1374699.exe

Filesize
269KB

MD5
30659c4ba6dd86a9ddc8a8eb7e2e4283

SHA1
426dac94a58851b765b39637e72ddc495fbdbbd6

SHA256
de5e2e48c677e58c3b965a2298cfda97d4b345797e637a6fa61c13f885571917

SHA512
598802182669dede3e24c475db5d59682a844b571b380bd238d45d6cebb831e997097eef29f3cb7e4e4af522386842e3135e905cca4f2db25bc79bff04ae1fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5458650.exe

Filesize
227KB

MD5
a95c0174fe6e95b7a1a6c7419f9d4087

SHA1
440577735b3d5566c466f7b3986b7d1600ed1813

SHA256
732e4b95e9ed183429eafa84ef2db63f90e9b0cfad54a5e1890811cf5f9ac947

SHA512
e4172efe17fe5d8523ea84ef08e6b58bfed22c17404cb405ec9e03cdb83e282fd932781d395d5dd14b568d2085eb1b47b15742b145766a278c72d8c94f62add9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1653901.exe

Filesize
176KB

MD5
211a06e9ae68ced1234252a48696431b

SHA1
69950e2ee2fafd177d1a295836713bfd8d18df9c

SHA256
0bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d

SHA512
b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1800591.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1004-31-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/1004-33-0x00007FFDD3150000-0x00007FFDD3172000-memory.dmp

Filesize
136KB

Download
memory/1004-34-0x00007FFDD3C10000-0x00007FFDD3C3B000-memory.dmp

Filesize
172KB

Download
memory/4508-22-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/4508-21-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4596-39-0x0000000000530000-0x0000000000560000-memory.dmp

Filesize
192KB

Download
memory/4596-44-0x0000000002320000-0x0000000002326000-memory.dmp

Filesize
24KB

Download
memory/4596-45-0x0000000004BC0000-0x00000000051D8000-memory.dmp

Filesize
6.1MB

Download
memory/4596-46-0x0000000005230000-0x000000000533A000-memory.dmp

Filesize
1.0MB

Download
memory/4596-47-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4596-48-0x0000000005390000-0x00000000053CC000-memory.dmp

Filesize
240KB

Download
memory/4596-49-0x0000000005430000-0x000000000547C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads