healer | 360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb

General

Target

360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe
Size

479KB
MD5

928b7ad5feff927fcfda280c9c60da68
SHA1

3f2fd5d4fc82564bc8cd239d465afc69ab57ac3f
SHA256

360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb
SHA512

46a2bf3b521fc37c4be110cc66b4e04ad8e6403df4a70239287b5f9debbd024e4d23d6c97fc095b34d0598be4241f187a76c311bcc2f977446806e5768f78064
SSDEEP

12288:aMrEy90ZFJJnRHrWSGSvaGRuxeJ2TJsI:iycn3nGSvXQJFN

Score

10^/10

healer redline dona discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes

auth_value
9fbb198992bbc83a84ab1f21384813e3

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4444-15-0x00000000022B0000-0x00000000022CA000-memory.dmp	healer
behavioral1/memory/4444-18-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/4444-24-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-40-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-48-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-46-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-44-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-42-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-38-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-36-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-34-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-32-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-30-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-28-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-26-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-22-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4444-21-0x0000000004980000-0x0000000004992000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k9780195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k9780195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k9780195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k9780195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k9780195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k9780195.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c96-54.dat	family_redline
behavioral1/memory/2704-56-0x0000000000480000-0x00000000004B0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
212	y8586061.exe
4444	k9780195.exe
2704	l1429047.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k9780195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k9780195.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8586061.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8586061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k9780195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l1429047.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4444	k9780195.exe
4444	k9780195.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	k9780195.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 212	2800	360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe	84
PID 2800 wrote to memory of 212	2800	360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe	84
PID 2800 wrote to memory of 212	2800	360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe	84
PID 212 wrote to memory of 4444	212	y8586061.exe	85
PID 212 wrote to memory of 4444	212	y8586061.exe	85
PID 212 wrote to memory of 4444	212	y8586061.exe	85
PID 212 wrote to memory of 2704	212	y8586061.exe	93
PID 212 wrote to memory of 2704	212	y8586061.exe	93
PID 212 wrote to memory of 2704	212	y8586061.exe	93

C:\Users\Admin\AppData\Local\Temp\360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe
"C:\Users\Admin\AppData\Local\Temp\360cc045ba3b9a30a736a8d335ef59db0e3973be5a97cb5df5f696f1d57dbbeb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8586061.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8586061.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9780195.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9780195.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1429047.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1429047.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8586061.exe

Filesize
307KB

MD5
611c5c3591d7e78021b08cba1251b96f

SHA1
ca5727461472a5366bdc088ed54174dad990d274

SHA256
1a5333d6338a9f4fcc271e98920a00c8d6161472b26fcae8c9f1b83d8ec511c0

SHA512
cabf71eb8a08683306da0199f54366fb22497b615dc55ab56a24f56f0ea70f3da0a2620cd7a4b8c7e41b77598783d5d40ae276b3545b540fe45c71ecfb54461b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9780195.exe

Filesize
179KB

MD5
06e9c4403598503fcb19d5b2f00ba25b

SHA1
6304a2c1596fe3268d698b5d64d6576be34114ff

SHA256
1dedb2e1536919f47c68931b58e20bfab176dc2f8e5414f9687523a9bf1a988d

SHA512
724279cbdef6a7b754ab9e7e2f0d21e533dc8ed75cb4c75a4391f0fa599f80450d2fe4a1e6ec3395c97ca58d12649e84b2a4f61734c2bbe70cd2eba7bf6569ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1429047.exe

Filesize
168KB

MD5
879ecf874fc18382de4b682bd1aa55fd

SHA1
ca6e33269ca2e5409d9799248931401ee0cccf4d

SHA256
fb6bd728d28d5482c422966413efe41b65071bd8a6f85b6f8c5dc7c51f8f6bf9

SHA512
da081306e817cec2d603e28cb97c1a3c665949bd5df932eb8c3323a8c7b3111a8aa144396bdae69de9bb2d4bf0ba4920add53ced4a7195106f9aa6cd9cae79fe

Download Submit
memory/2704-62-0x0000000002550000-0x000000000259C000-memory.dmp

Filesize
304KB

Download
memory/2704-61-0x000000000A280000-0x000000000A2BC000-memory.dmp

Filesize
240KB

Download
memory/2704-60-0x0000000004D90000-0x0000000004DA2000-memory.dmp

Filesize
72KB

Download
memory/2704-59-0x000000000A390000-0x000000000A49A000-memory.dmp

Filesize
1.0MB

Download
memory/2704-58-0x000000000A8A0000-0x000000000AEB8000-memory.dmp

Filesize
6.1MB

Download
memory/2704-57-0x0000000000D70000-0x0000000000D76000-memory.dmp

Filesize
24KB

Download
memory/2704-56-0x0000000000480000-0x00000000004B0000-memory.dmp

Filesize
192KB

Download
memory/4444-36-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-21-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-46-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-44-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-42-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-38-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-40-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-34-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-32-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-30-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-28-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-26-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-22-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-48-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-49-0x0000000073CCE000-0x0000000073CCF000-memory.dmp

Filesize
4KB

Download
memory/4444-50-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/4444-52-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/4444-24-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4444-20-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/4444-18-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/4444-19-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/4444-17-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/4444-16-0x0000000004A40000-0x0000000004FE4000-memory.dmp

Filesize
5.6MB

Download
memory/4444-15-0x00000000022B0000-0x00000000022CA000-memory.dmp

Filesize
104KB

Download
memory/4444-14-0x0000000073CCE000-0x0000000073CCF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads