healer | cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802

General

Target

cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe
Size

428KB
MD5

30ac662890bb415c9c50265dc9948487
SHA1

8db12a314ba9f7b903f0c8b9c6092bb6aa50a969
SHA256

cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802
SHA512

2c172b2890f4eb835657a7d0d1445c78027d4656979a5ce99043c84253e976531b0631add61780bed525b1685625ddab8c13a43103d8f16b9e8f79e5e02bb8d0
SSDEEP

12288:qMr7y90ZYy6MWEMC4ycO7woKGES3HqS45Ej:1yQWEbn2oZ6STj

Score

10^/10

healer redline mucha dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mucha

C2

83.97.73.131:19071

Attributes

auth_value
5d76e123341992ecf110010eb89456f0

Signatures

Detects Healer an antivirus disabler dropper 4 IoCs

resource	yara_rule
behavioral1/memory/1928-15-0x0000000000590000-0x000000000059A000-memory.dmp	healer
behavioral1/memory/1928-20-0x0000000000400000-0x000000000042B000-memory.dmp	healer
behavioral1/files/0x000700000002342c-25.dat	healer
behavioral1/memory/4928-26-0x0000000000250000-0x000000000025A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5676150.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5676150.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b8803570.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a5676150.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5676150.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b8803570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b8803570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b8803570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b8803570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b8803570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5676150.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5676150.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4224-32-0x0000000000520000-0x0000000000550000-memory.dmp	family_redline

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 4 IoCs

resource	yara_rule
behavioral1/memory/1928-15-0x0000000000590000-0x000000000059A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/1928-20-0x0000000000400000-0x000000000042B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x000700000002342c-25.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/4928-26-0x0000000000250000-0x000000000025A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral1/memory/4224-32-0x0000000000520000-0x0000000000550000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Executes dropped EXE 4 IoCs

pid	Process
1716	v9565707.exe
1928	a5676150.exe
4928	b8803570.exe
4224	c0627942.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a5676150.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5676150.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b8803570.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9565707.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1928	a5676150.exe
1928	a5676150.exe
4928	b8803570.exe
4928	b8803570.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	a5676150.exe
Token: SeDebugPrivilege	4928	b8803570.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1716	1824	cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe	83
PID 1824 wrote to memory of 1716	1824	cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe	83
PID 1824 wrote to memory of 1716	1824	cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe	83
PID 1716 wrote to memory of 1928	1716	v9565707.exe	84
PID 1716 wrote to memory of 1928	1716	v9565707.exe	84
PID 1716 wrote to memory of 1928	1716	v9565707.exe	84
PID 1716 wrote to memory of 4928	1716	v9565707.exe	99
PID 1716 wrote to memory of 4928	1716	v9565707.exe	99
PID 1824 wrote to memory of 4224	1824	cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe	101
PID 1824 wrote to memory of 4224	1824	cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe	101
PID 1824 wrote to memory of 4224	1824	cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe	101

C:\Users\Admin\AppData\Local\Temp\cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe
"C:\Users\Admin\AppData\Local\Temp\cb679b107080f114f53042c8cdf9a3230582c84ddafe233cb7b53c2038d1d802.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9565707.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9565707.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5676150.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5676150.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8803570.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8803570.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0627942.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0627942.exe
  2⤵
  - Executes dropped EXE
  PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0627942.exe

Filesize
269KB

MD5
55966a10faa6e36cb8a2d68f55b18d57

SHA1
3af6d772846a959014b4b691ac4cc432b4b4705f

SHA256
cfc872c8eb57d781791c0b30366e76a5760289a5e57447b302fb2cdcbdb199aa

SHA512
8456c3cf40aa9428bf4e0962a548957ed2412781422f973be7c7dde44487d8227ebfb564d6d13ed74c81409db3dc66e9f0e60ee1401affa2f9a7a57740258b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9565707.exe

Filesize
227KB

MD5
8488d8cdffec88932160da156cf58aa2

SHA1
b6d8d5d15485f8da66ac0ddc48deaf04c2a66044

SHA256
6f44108568d0ec0f240c4f3b9d3b941fba9a5170686636c1eb5e879d85b99783

SHA512
add9da1681aee1f485043ce7711f610a4ab6c72a39e9cde644d30956bd8e7f37d474c38c4fd3cf2d5b934fc0fe41093e87c643df10c7b59bda84b9d8f8030ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5676150.exe

Filesize
176KB

MD5
211a06e9ae68ced1234252a48696431b

SHA1
69950e2ee2fafd177d1a295836713bfd8d18df9c

SHA256
0bdca9c84103454e329cfde4e69dc41a0ec0196c078c8fc195b0fa739d2f905d

SHA512
b1643ba376075619335b4bdf0d7610aece13b7c9db60eecb508465f97ef3e6a9d5297f9ac8529886efa052cdd8814ac7d4eeab44812f797a1b2dc5fa967ee7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8803570.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1928-19-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1928-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1928-15-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/1928-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4224-32-0x0000000000520000-0x0000000000550000-memory.dmp

Filesize
192KB

Download
memory/4224-36-0x00000000023D0000-0x00000000023D6000-memory.dmp

Filesize
24KB

Download
memory/4224-37-0x000000000A510000-0x000000000AB28000-memory.dmp

Filesize
6.1MB

Download
memory/4224-38-0x0000000009EF0000-0x0000000009FFA000-memory.dmp

Filesize
1.0MB

Download
memory/4224-39-0x000000000A030000-0x000000000A042000-memory.dmp

Filesize
72KB

Download
memory/4224-40-0x000000000A050000-0x000000000A08C000-memory.dmp

Filesize
240KB

Download
memory/4224-41-0x0000000002340000-0x000000000238C000-memory.dmp

Filesize
304KB

Download
memory/4928-26-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads