healer | 0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb

General

Target

0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe
Size

1.5MB
MD5

fbd46982e2845ad803edb569cc9ac627
SHA1

d32896454d3eccd2d66804f00be156b997531167
SHA256

0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb
SHA512

e1b6fa081dac305e2f491d045a2baec5a18667038a201ab5021c7496122608deb02695d5258152b45590d6c7798d06fdbbca13fe0396df026ae0a790577a201f
SSDEEP

24576:vyDFcw7PyWymJjFz61IDEKYppR4620k/Qj/sZPsobXpWSYdWgsyu6agBU:6DdLhSODpErIxQg7p8dWQ

Score

10^/10

healer redline max discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

max

C2

185.161.248.73:4164

Attributes

auth_value
efb1499709a5d08ed1ddf71cff71211f

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4832-35-0x00000000020A0000-0x00000000020BA000-memory.dmp	healer
behavioral1/memory/4832-37-0x0000000002570000-0x0000000002588000-memory.dmp	healer
behavioral1/memory/4832-65-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-63-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-61-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-59-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-57-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-55-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-53-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-51-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-49-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-48-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-45-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-43-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-41-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-38-0x0000000002570000-0x0000000002583000-memory.dmp	healer
behavioral1/memory/4832-39-0x0000000002570000-0x0000000002583000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a73106153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a73106153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a73106153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a73106153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a73106153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a73106153.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c07-68.dat	family_redline
behavioral1/memory/2364-70-0x0000000000350000-0x0000000000380000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1648	i57805258.exe
1184	i01915325.exe
1564	i14906422.exe
2184	i14591860.exe
4832	a73106153.exe
2364	b87968139.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a73106153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a73106153.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	i57805258.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	i01915325.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	i14906422.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	i14591860.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i57805258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i01915325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i14906422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i14591860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a73106153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b87968139.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	a73106153.exe
4832	a73106153.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	a73106153.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1648	4544	0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe	86
PID 4544 wrote to memory of 1648	4544	0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe	86
PID 4544 wrote to memory of 1648	4544	0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe	86
PID 1648 wrote to memory of 1184	1648	i57805258.exe	87
PID 1648 wrote to memory of 1184	1648	i57805258.exe	87
PID 1648 wrote to memory of 1184	1648	i57805258.exe	87
PID 1184 wrote to memory of 1564	1184	i01915325.exe	88
PID 1184 wrote to memory of 1564	1184	i01915325.exe	88
PID 1184 wrote to memory of 1564	1184	i01915325.exe	88
PID 1564 wrote to memory of 2184	1564	i14906422.exe	89
PID 1564 wrote to memory of 2184	1564	i14906422.exe	89
PID 1564 wrote to memory of 2184	1564	i14906422.exe	89
PID 2184 wrote to memory of 4832	2184	i14591860.exe	91
PID 2184 wrote to memory of 4832	2184	i14591860.exe	91
PID 2184 wrote to memory of 4832	2184	i14591860.exe	91
PID 2184 wrote to memory of 2364	2184	i14591860.exe	95
PID 2184 wrote to memory of 2364	2184	i14591860.exe	95
PID 2184 wrote to memory of 2364	2184	i14591860.exe	95

C:\Users\Admin\AppData\Local\Temp\0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe
"C:\Users\Admin\AppData\Local\Temp\0b49c4660806e1439caf7d3e3499ece706cd9c476371ddad919283133679eaeb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i57805258.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i57805258.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i01915325.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i01915325.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i14906422.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i14906422.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i14591860.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i14591860.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73106153.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73106153.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b87968139.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b87968139.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i57805258.exe

Filesize
1.2MB

MD5
ae3120de142240133369adcd054863ae

SHA1
751c2625cdb857f7aa35e308b4d1a3414514b3e7

SHA256
fde3b9f4c67f1179771603a27f0ca8a7acb12f6b42fc2d5d0b0431d8b411f1fb

SHA512
c74bf2d5ad3dd79e154f26508aeba08baad8ea046b877af8ac6a750367bd9b09dcadd0f3fcb2674bd225ade43a78f4e55dc780b6bee1e8f890bf458119127ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i01915325.exe

Filesize
1.1MB

MD5
c3e47f6981b4403d6024b7e0f03572fa

SHA1
d1bd01524c475e81f40fa8f80698994260eb75db

SHA256
313ec4442d2bc3f8444a8d32c7a98a8cb1d53b3c9ec984970c0535549f52278f

SHA512
c5a45cbfaae3814bec15680372a8aa73507cf34b10eccdb9e5baa781cc76058b6a3550ddd36da2e3ba8d03c45dc845e870a5213ad3cbe872eded0344409f4b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i14906422.exe

Filesize
590KB

MD5
ab7975778b0884fd105b9a43a1badc85

SHA1
a519b8ee0dc5bb56c9212319fffbbe5aca80b6df

SHA256
322481e4f929eed7133bcb446cdbdbaa21168a9d4889320487c085ab9a79f955

SHA512
06bad8ae3652ae23b72c6f40e353e21514c7d1659ad9ff9697002e25c988c7ae5ac14779a803422747c5d4e20821a8633d6190f01d27eb483808468b741f1292

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i14591860.exe

Filesize
310KB

MD5
db35c62fd3611fcdf2bb0a01faf83b9d

SHA1
361fb3a2a41f3331e9132b1b72b786f732b85bc0

SHA256
0769f2a6ad821f4ccecfb59628deabdbc8fe7bcef858e2cfe84c1590c3bf420d

SHA512
1a48c1acf594d00dbf3be53fb764edf890784e1eb28599efdf29fc0d7d311e0d5d2e5533eb60131127e22a78390ac64787ad4ccf3df48fc6665580f19d1c7f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73106153.exe

Filesize
177KB

MD5
035673723873f1197ed4161cdc5d949d

SHA1
699847dd4757f20391d17cbb616da3240db5e48d

SHA256
b25eaf6dd2e8752ed2a8b7081217a01bb94ce7e116e1d7802205cf8afe62ea95

SHA512
96fa0103c259a12c87e2f0f57e21b950c908256f2e3e1ca765dd39da534aa2b8e9ae819cdf1f61edcb1fab09614cef17e7dfa842917b33fb370f935f58a56568

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b87968139.exe

Filesize
168KB

MD5
300774f7b4fd8b774aa9ccad4ef94993

SHA1
ff0b64209b0fde7eaba149a0b79598e717aea859

SHA256
e2e69ca36f0c193004383528daeb9968f97e7d31a4fd96417759702798a1b92b

SHA512
4d273ada8623571a1f1912d883e0ff78ff3ba4d5d9eb2780a3f26400a1e82580af479f27739ce752f94246476de7b0f3e08a8985c9b9ce65f76f425a4adf256d

Download Submit
memory/2364-75-0x000000000A290000-0x000000000A2CC000-memory.dmp

Filesize
240KB

Download
memory/2364-74-0x000000000A230000-0x000000000A242000-memory.dmp

Filesize
72KB

Download
memory/2364-73-0x000000000A300000-0x000000000A40A000-memory.dmp

Filesize
1.0MB

Download
memory/2364-72-0x000000000A7B0000-0x000000000ADC8000-memory.dmp

Filesize
6.1MB

Download
memory/2364-71-0x0000000000C50000-0x0000000000C56000-memory.dmp

Filesize
24KB

Download
memory/2364-70-0x0000000000350000-0x0000000000380000-memory.dmp

Filesize
192KB

Download
memory/2364-76-0x00000000024E0000-0x000000000252C000-memory.dmp

Filesize
304KB

Download
memory/4832-53-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-39-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-51-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-49-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-48-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-45-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-43-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-41-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-38-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-55-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-57-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-59-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-61-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-63-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-65-0x0000000002570000-0x0000000002583000-memory.dmp

Filesize
76KB

Download
memory/4832-37-0x0000000002570000-0x0000000002588000-memory.dmp

Filesize
96KB

Download
memory/4832-36-0x0000000004CF0000-0x0000000005294000-memory.dmp

Filesize
5.6MB

Download
memory/4832-35-0x00000000020A0000-0x00000000020BA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads