healer | 9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083

General

Target

9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe
Size

481KB
MD5

0070587ca41767ceb2953a3b0bfdc943
SHA1

854a15180aa67a01873f6788cf860c8c853b651a
SHA256

9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083
SHA512

7c264d3b57babc68795e26b11618c1e1ef959e5c03d3b08857b3e29fc83a8c3881c95800821d9409fd1855d0a12c00e8c374c65ba65110fccd790ab77834faf1
SSDEEP

12288:eMr9y90DCA4EhbLTdbBecJWFt4uaXL2Z:byq4YBecEv4zL2Z

Score

10^/10

healer redline mihan discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes

auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2500-15-0x0000000002170000-0x000000000218A000-memory.dmp	healer
behavioral1/memory/2500-18-0x00000000021C0000-0x00000000021D8000-memory.dmp	healer
behavioral1/memory/2500-23-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-21-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-20-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-43-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-33-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-27-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-25-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-31-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-29-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-47-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-45-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-41-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-39-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-37-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer
behavioral1/memory/2500-35-0x00000000021C0000-0x00000000021D2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1705411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1705411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1705411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1705411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1705411.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1705411.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c61-54.dat	family_redline
behavioral1/memory/4548-56-0x0000000000B20000-0x0000000000B50000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1884	v0603528.exe
2500	a1705411.exe
4548	b0983963.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1705411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1705411.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0603528.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0603528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1705411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0983963.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	a1705411.exe
2500	a1705411.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	a1705411.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1884	1088	9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe	84
PID 1088 wrote to memory of 1884	1088	9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe	84
PID 1088 wrote to memory of 1884	1088	9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe	84
PID 1884 wrote to memory of 2500	1884	v0603528.exe	85
PID 1884 wrote to memory of 2500	1884	v0603528.exe	85
PID 1884 wrote to memory of 2500	1884	v0603528.exe	85
PID 1884 wrote to memory of 4548	1884	v0603528.exe	93
PID 1884 wrote to memory of 4548	1884	v0603528.exe	93
PID 1884 wrote to memory of 4548	1884	v0603528.exe	93

C:\Users\Admin\AppData\Local\Temp\9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe
"C:\Users\Admin\AppData\Local\Temp\9189cd659bafdd97babbc1275fb9f06a23a79280429582b02e3cd322d2993083.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0603528.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0603528.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1705411.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1705411.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0983963.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0983963.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0603528.exe

Filesize
309KB

MD5
abb78158ef47966e11d7fa74de2f7a31

SHA1
947cd5e3417c33c57a9d9f9a2c28c646c2c4569c

SHA256
d47f93e4025075a05a16fe66ee9f794d7a4cab398def7dde7de971e1a5f036a7

SHA512
6f3262b635d1b3f7a8de10cd7f3de3dc6fdceeba83ebf32597adda7c6b88538343135b3d91e8bad71fcfae70c2f0571bbdc5ee07be13d9d787991e2417cf44e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1705411.exe

Filesize
180KB

MD5
8d467f675d7b38a04ad1171970c8c7af

SHA1
2b417ee96c0f4bd5aa2e3d7af08872c1a6e3e02e

SHA256
71b8e90520d6efc4b4bbcb2677c5cc8572d9b39d142893eaa7f9dc0986119bfe

SHA512
5d9e6f1705cb57866026c9f3033fc475b18e6325cd7e2dc41ee1ad8a7105869076b3a9958b1cdcaf87422dfc21132f1e4fdb9123cd1d5f1883214bcc4ab05ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0983963.exe

Filesize
168KB

MD5
1ab6722f436f91e5a9755713921e50c5

SHA1
c4a12146f62ec7210898b4dd881da94a4bed50eb

SHA256
9161415932861954a3b274f01b080a62f50d7a64694290c54df2c7258ae8ddca

SHA512
15e851bef3c379dc8fe6e6ab0ec5e34cc5962a3e1de977c5534067a6dff7b81ef9747d03f39a2088e3bd081c76ba25f9b265708e476d31562903b4da863ad121

Download Submit
memory/2500-29-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-41-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-18-0x00000000021C0000-0x00000000021D8000-memory.dmp

Filesize
96KB

Download
memory/2500-19-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/2500-16-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/2500-23-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-21-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-20-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-45-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-33-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-27-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-25-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-31-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-15-0x0000000002170000-0x000000000218A000-memory.dmp

Filesize
104KB

Download
memory/2500-17-0x0000000004B70000-0x0000000005114000-memory.dmp

Filesize
5.6MB

Download
memory/2500-47-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-43-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-48-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/2500-39-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-37-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-35-0x00000000021C0000-0x00000000021D2000-memory.dmp

Filesize
72KB

Download
memory/2500-49-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2500-50-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/2500-52-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/2500-14-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/4548-56-0x0000000000B20000-0x0000000000B50000-memory.dmp

Filesize
192KB

Download
memory/4548-57-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/4548-58-0x0000000005A90000-0x00000000060A8000-memory.dmp

Filesize
6.1MB

Download
memory/4548-59-0x0000000005580000-0x000000000568A000-memory.dmp

Filesize
1.0MB

Download
memory/4548-60-0x00000000054A0000-0x00000000054B2000-memory.dmp

Filesize
72KB

Download
memory/4548-61-0x0000000005500000-0x000000000553C000-memory.dmp

Filesize
240KB

Download
memory/4548-62-0x0000000005690000-0x00000000056DC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads