healer | 14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0

General

Target

14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe
Size

479KB
MD5

ddb2fa5da1b2b6554636d6c6ebf24ed2
SHA1

79cc8c380fd0cdccc7bce7712410079fd89de95f
SHA256

14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0
SHA512

916371cc78a9bcd127b14fb6992d216f2a3d9409ee31492d466e6d855015abd1ab18290db940286f5baa37a04eb59858d0113f6e5a158a06d2dc6b0cefa2df63
SSDEEP

12288:ZMrMy90FRTJp+vGlbqfpuynr+7I1tti4i:Ryu8KaHnT1t0/

Score

10^/10

healer redline dona discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes

auth_value
9fbb198992bbc83a84ab1f21384813e3

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral2/memory/2248-15-0x0000000002170000-0x000000000218A000-memory.dmp	healer
behavioral2/memory/2248-18-0x00000000049A0000-0x00000000049B8000-memory.dmp	healer
behavioral2/memory/2248-41-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-48-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-46-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-44-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-42-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-38-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-36-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-34-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-32-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-30-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-28-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-26-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-24-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-22-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer
behavioral2/memory/2248-21-0x00000000049A0000-0x00000000049B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3753639.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3753639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k3753639.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3753639.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3753639.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3753639.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cb9-54.dat	family_redline
behavioral2/memory/1496-56-0x0000000000FA0000-0x0000000000FD0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4560	y3526722.exe
2248	k3753639.exe
1496	l7355329.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3753639.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k3753639.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3526722.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y3526722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3753639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7355329.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	k3753639.exe
2248	k3753639.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	k3753639.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4560	4868	14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe	84
PID 4868 wrote to memory of 4560	4868	14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe	84
PID 4868 wrote to memory of 4560	4868	14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe	84
PID 4560 wrote to memory of 2248	4560	y3526722.exe	85
PID 4560 wrote to memory of 2248	4560	y3526722.exe	85
PID 4560 wrote to memory of 2248	4560	y3526722.exe	85
PID 4560 wrote to memory of 1496	4560	y3526722.exe	94
PID 4560 wrote to memory of 1496	4560	y3526722.exe	94
PID 4560 wrote to memory of 1496	4560	y3526722.exe	94

C:\Users\Admin\AppData\Local\Temp\14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe
"C:\Users\Admin\AppData\Local\Temp\14047d176f59ac37cb5b17949f11c84940f32bcf41ad2c95b22e8821bfb6fde0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3526722.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3526722.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3753639.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3753639.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7355329.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7355329.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3526722.exe

Filesize
307KB

MD5
9fa1f2e6500db2a097ea6c40f99b3a78

SHA1
59ac9f1f4b2f46586545841676a5c4e6eeb6655e

SHA256
6c83e9427c0887200d24a080f309afdbeb2c0c906ca02b4f66b74e40c031ff34

SHA512
b7a7bcf4e889d29f2150714e09116fdc3c65fa2afc422b27ad3d7d6e0b1ad6b460515709d24e101c62867c0cbad02139b5136fe5e2c684941baba60ca5cf4939

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3753639.exe

Filesize
179KB

MD5
139f989158eb46f0f92ee57947d49088

SHA1
b7086e945ada7a800dc43c215587417cdbf261cf

SHA256
0a16042ba0e3402c35f18887b454b86eb1642d9d48c97cfcdc8e48d30bb6acc6

SHA512
f1ce854f2270548c22346348496fbefd4f2099ea9bee20455555d25d87eb835091e1d1882273d9c6d5c66f7b76018733175598531309994aef3244f39fe3b98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7355329.exe

Filesize
168KB

MD5
8458e72613c2fbf08d17166dcc461825

SHA1
c040009c44e6875772d1c72ccffd029151f387e2

SHA256
db47967095b1ecf43845798be6c223564a4d1b31ed15152c3e601fb4ad1be792

SHA512
db371c9a5c3728e54306874b001f49c5ab6ecf5618054a265a37916607c5fa330e7568475ce4bfe81caae8cd36625bfce927e434459877af3d10eb4015bdf996

Download Submit
memory/1496-62-0x00000000059D0000-0x0000000005A1C000-memory.dmp

Filesize
304KB

Download
memory/1496-61-0x0000000005990000-0x00000000059CC000-memory.dmp

Filesize
240KB

Download
memory/1496-60-0x0000000005910000-0x0000000005922000-memory.dmp

Filesize
72KB

Download
memory/1496-59-0x0000000005AA0000-0x0000000005BAA000-memory.dmp

Filesize
1.0MB

Download
memory/1496-58-0x0000000005FB0000-0x00000000065C8000-memory.dmp

Filesize
6.1MB

Download
memory/1496-57-0x0000000003230000-0x0000000003236000-memory.dmp

Filesize
24KB

Download
memory/1496-56-0x0000000000FA0000-0x0000000000FD0000-memory.dmp

Filesize
192KB

Download
memory/2248-34-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-21-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-44-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-42-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-38-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-36-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-48-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-32-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-30-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-28-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-26-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-24-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-22-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-46-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-49-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/2248-50-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-52-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-41-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/2248-20-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-18-0x00000000049A0000-0x00000000049B8000-memory.dmp

Filesize
96KB

Download
memory/2248-19-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-17-0x00000000049F0000-0x0000000004F94000-memory.dmp

Filesize
5.6MB

Download
memory/2248-16-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-15-0x0000000002170000-0x000000000218A000-memory.dmp

Filesize
104KB

Download
memory/2248-14-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads