healer | 7b8c157934afb9480c8ad7f456fccb235294c2a5557eb05102c736a24e2c9aaf

General

Target

x2665667.exe
Size

481KB
MD5

5159171ed6475bc06366524e8dbc68b7
SHA1

08fa75bd802d8c3872a7621ffbacd1bc4356b2ed
SHA256

6316e65ea3595400e6df1a4dd79f98f3b49ecd4fad754bcb6f79efec95c5b092
SHA512

4c5720c823412cc078e2ac75b3465adf1a897972c511cb5cb6d77925a2869be3df2ff60a718fc52603e8fbf09dc4765b7004167141357bb7836f6417fb8deca9
SSDEEP

12288:/MrLy90CjFLAyoJCQ3oQqVZ19tc8Tb1H:sypFLAeQ4QUZ19tL

Score

10^/10

healer redline petin discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

petin

C2

77.91.124.82:19071

Attributes

auth_value
f6cf7a48c0291d1ef5a3440429827d6d

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral3/memory/2968-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x0007000000023461-16.dat	family_redline
behavioral3/memory/832-18-0x0000000000560000-0x0000000000590000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
4144	x5976294.exe
4776	g9422113.exe
832	h9251280.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	x2665667.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5976294.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 2968	4776	g9422113.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2665667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x5976294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g9422113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	h9251280.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2968	AppLaunch.exe
2968	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4144	1676	x2665667.exe	84
PID 1676 wrote to memory of 4144	1676	x2665667.exe	84
PID 1676 wrote to memory of 4144	1676	x2665667.exe	84
PID 4144 wrote to memory of 4776	4144	x5976294.exe	85
PID 4144 wrote to memory of 4776	4144	x5976294.exe	85
PID 4144 wrote to memory of 4776	4144	x5976294.exe	85
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4776 wrote to memory of 2968	4776	g9422113.exe	89
PID 4144 wrote to memory of 832	4144	x5976294.exe	90
PID 4144 wrote to memory of 832	4144	x5976294.exe	90
PID 4144 wrote to memory of 832	4144	x5976294.exe	90

C:\Users\Admin\AppData\Local\Temp\x2665667.exe
"C:\Users\Admin\AppData\Local\Temp\x2665667.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5976294.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5976294.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9422113.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9422113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2968
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9251280.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9251280.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5976294.exe

Filesize
315KB

MD5
d07a8d025ad5167e0519e860780f58b0

SHA1
930163600ba309aa6f8c72844d133378bb1df911

SHA256
50f4fdfafc46731ed6f310d378ddda0a39d4b4cc10da9729a45b12f63e17aee4

SHA512
55ea0e4ca8f6202539254f10e87a608a0c8a1ad03ae0263a207664bb385cb78119641838bfc9e293c2e7799e9027b458694ae984ef5c8a8aacd62c4349e9ea25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9422113.exe

Filesize
229KB

MD5
c04574bae7475ceb34295dba472371fd

SHA1
69644e2718e135c484d62abd409e10c94a280863

SHA256
38484c394c6c62deb85ee75b30cd5ff568c5dc23ca08a3366d0f2482dfefe11c

SHA512
9ffc37140111861f4b645fa7015beed57291bd45a0e02145391fed3638f853eff9b8beb7e60709716e3dc368abbc91d0a2e8e7088e3f138287d846cd3cf87a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9251280.exe

Filesize
174KB

MD5
2ebab37f88bd95040550fddf6b98086b

SHA1
c87316aea7a90fbb0b058a5c472c294e1a711848

SHA256
81110de81c715b9b50429ca1f7a1ee9d83bc6a2ff10a79175a61e0ef344ebc1a

SHA512
42461327fdf3ef262861af2746f6a809d6c9867fae1f4bb6e1cff9b497e2a85fd2f95058be98dfae54aa35b841e3e93dd342ab0e5fd16df919ef76892baf212b

Download Submit
memory/832-18-0x0000000000560000-0x0000000000590000-memory.dmp

Filesize
192KB

Download
memory/832-19-0x0000000004D80000-0x0000000004D86000-memory.dmp

Filesize
24KB

Download
memory/832-20-0x000000000A8E0000-0x000000000AEF8000-memory.dmp

Filesize
6.1MB

Download
memory/832-21-0x000000000A3D0000-0x000000000A4DA000-memory.dmp

Filesize
1.0MB

Download
memory/832-22-0x000000000A310000-0x000000000A322000-memory.dmp

Filesize
72KB

Download
memory/832-23-0x000000000A370000-0x000000000A3AC000-memory.dmp

Filesize
240KB

Download
memory/832-24-0x0000000002740000-0x000000000278C000-memory.dmp

Filesize
304KB

Download
memory/2968-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads