healer | cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8

General

Target

cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe
Size

1.5MB
MD5

ad39b7a2270e3b6fbf5a6dd50f48a487
SHA1

c1491b19e448b7afcada102b6e447989b3ea32ca
SHA256

cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8
SHA512

acb9dc0bd603c8fe3062fb2eacaad0321625c56c1fc23482e8f174daf7654591c2ce21fae04a4db82c317c376602ffc372c9e85615380c7af1dd0c6faf7661eb
SSDEEP

49152:IyHUdnAePtIm60ohZseZBMRH5G6V7OQniE:xHUdn3Gm60ZmBMpg6VC8iE

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral3/memory/5004-36-0x0000000004D60000-0x0000000004D7A000-memory.dmp	healer
behavioral3/memory/5004-38-0x0000000004DC0000-0x0000000004DD8000-memory.dmp	healer
behavioral3/memory/5004-39-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-44-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-66-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-64-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-63-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-60-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-59-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-57-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-54-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-52-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-50-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-48-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-46-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-42-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer
behavioral3/memory/5004-40-0x0000000004DC0000-0x0000000004DD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6858310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6858310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6858310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6858310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6858310.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x002800000004507a-71.dat	family_redline
behavioral3/memory/1064-73-0x0000000000D70000-0x0000000000D98000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
2452	v4325562.exe
1116	v5487393.exe
4616	v7306110.exe
4052	v5892967.exe
5004	a6858310.exe
1064	b3172754.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6858310.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6858310.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5487393.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v7306110.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v5892967.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4325562.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	5004	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4325562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5487393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7306110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5892967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6858310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3172754.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	a6858310.exe
5004	a6858310.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	a6858310.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 2452	272	cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe	81
PID 272 wrote to memory of 2452	272	cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe	81
PID 272 wrote to memory of 2452	272	cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe	81
PID 2452 wrote to memory of 1116	2452	v4325562.exe	82
PID 2452 wrote to memory of 1116	2452	v4325562.exe	82
PID 2452 wrote to memory of 1116	2452	v4325562.exe	82
PID 1116 wrote to memory of 4616	1116	v5487393.exe	83
PID 1116 wrote to memory of 4616	1116	v5487393.exe	83
PID 1116 wrote to memory of 4616	1116	v5487393.exe	83
PID 4616 wrote to memory of 4052	4616	v7306110.exe	84
PID 4616 wrote to memory of 4052	4616	v7306110.exe	84
PID 4616 wrote to memory of 4052	4616	v7306110.exe	84
PID 4052 wrote to memory of 5004	4052	v5892967.exe	86
PID 4052 wrote to memory of 5004	4052	v5892967.exe	86
PID 4052 wrote to memory of 5004	4052	v5892967.exe	86
PID 4052 wrote to memory of 1064	4052	v5892967.exe	90
PID 4052 wrote to memory of 1064	4052	v5892967.exe	90
PID 4052 wrote to memory of 1064	4052	v5892967.exe	90

C:\Users\Admin\AppData\Local\Temp\cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe
"C:\Users\Admin\AppData\Local\Temp\cbb377550aa4560e976bc8efd8f39309ee69594bf3823efa2d21d821fee3efe8.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:272
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4325562.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4325562.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5487393.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5487393.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7306110.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7306110.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5892967.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5892967.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6858310.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6858310.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 1208
        7⤵
        Program crash
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3172754.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3172754.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5004 -ip 5004
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4325562.exe

Filesize
1.4MB

MD5
9b2a9a5e0f9e597cac6bf4b5a68f3f9c

SHA1
fd4ccaff09ccd2a7e440c3fd55434646bd2f74a7

SHA256
8310d75e1c6689a515b291753d2fb45ab32cbad516bef61f6c37682f737390f2

SHA512
10c8cf431d4748ae5c21650b794f947fa937bae0e9966d6283cb7890f628e448a5545a79abbff8d853631eaf77152a8bed1ebd7617d537f01f2db28948a2e15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5487393.exe

Filesize
914KB

MD5
4bbd13d3ce889603424772a003ee81ef

SHA1
47d9a144d5b2ca10c071ef81cc1d056e1430edfc

SHA256
7cc9b56f44dd575fdb8f82b440e9c6541b083ea07f91bbb55351071b788c7cdd

SHA512
89af134aecdc8d6ee80dc2a54dcedae375138da9050e482819a96db4a63fba5a9edf9635de24315112d8211b6ab61c3ba2d5d1bddeb827edf8ed153c412995c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7306110.exe

Filesize
709KB

MD5
59838f92445d5f84746d7473dd679ef1

SHA1
172e58b7f6abffa7a11de1166ee6d4ffaf9ad0a7

SHA256
07fdd3b3b419e015b8b3e2cc4d0c2fcda672d7010e0156453ad04f2146177ecd

SHA512
9e8771e52cac4ad49dfbdfe209f1d04aa29ba9e07cf2611fc49a50cce0de22d516d6625fcba93b1a13e428533f4f8865212128f6ea799a02d7c050451181781f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5892967.exe

Filesize
418KB

MD5
0e00347fca26467fd8d0a547d0378c94

SHA1
eae68932673ffa58c971f953889a08c41883c5dd

SHA256
d4cee2575181205f932379f2b2a092ce76678903a30191d33f157f006ae6b45a

SHA512
6ca870c8df835304b9b6409878da84dad5d800ff4b558ffaa5d48e45018ecb1e41ef44d541bfb322a66848f951c893b101bd8e53ecdf7b1537349a429d8d5300

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6858310.exe

Filesize
361KB

MD5
2c281c3a5742433d6f6fbd07c9ce45b2

SHA1
719b1ac20c7b1d0e65b0f76bd4b9b1821f3ffbd5

SHA256
674991960e478586ea0e286dc767e1013cba5361480e296a31a33e4d4edb32c1

SHA512
d1e3029b48b1312265e5e5af5df7b7c1d07f21f2e6488189307142361c3efb22be6093c922aafdde13b5ffd89eb4db46a32a40422833c5ef8770f5d310115ba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3172754.exe

Filesize
136KB

MD5
9c7ca9b893663b04a6871d61fe63b3c4

SHA1
e7174f00df6496a5787e2c250df3a1aa46fbfbc3

SHA256
9c1930f3e31da99b54fb5fdd523e7c8b3ef19a1f8fa7ca29795b8ef8d1384c89

SHA512
c61dbfd6f2463ba7f6571eda17654524ebed952c21e1d53b8f85e2da6074ea266f828be47d473d30a08a3f7aadf9c0b3ca863eb4bf6e96f8f29f7784479ce187

Download Submit
memory/1064-78-0x0000000002EE0000-0x0000000002F2C000-memory.dmp

Filesize
304KB

Download
memory/1064-77-0x0000000007B20000-0x0000000007B5C000-memory.dmp

Filesize
240KB

Download
memory/1064-76-0x0000000007BF0000-0x0000000007CFA000-memory.dmp

Filesize
1.0MB

Download
memory/1064-75-0x0000000007AC0000-0x0000000007AD2000-memory.dmp

Filesize
72KB

Download
memory/1064-74-0x0000000008030000-0x0000000008648000-memory.dmp

Filesize
6.1MB

Download
memory/1064-73-0x0000000000D70000-0x0000000000D98000-memory.dmp

Filesize
160KB

Download
memory/5004-39-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-42-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-59-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-57-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-54-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-52-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-50-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-48-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-46-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-60-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-40-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/5004-63-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/5004-64-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-66-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-44-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/5004-38-0x0000000004DC0000-0x0000000004DD8000-memory.dmp

Filesize
96KB

Download
memory/5004-37-0x0000000004E10000-0x00000000053B6000-memory.dmp

Filesize
5.6MB

Download
memory/5004-36-0x0000000004D60000-0x0000000004D7A000-memory.dmp

Filesize
104KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads