healer | dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370

General

Target

dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe
Size

656KB
MD5

6cf1ce0bb3113c4b0d979d94979701a6
SHA1

d025a0d56ee19414c63a26c129e61b6d79acdf7d
SHA256

dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370
SHA512

ef14ca2a36e431dff8444654f593a1dd60e822f7dcd028f9ac04a7be5d0ea66a5e1f8fe948ac2ab32def6f4bc6a8955de14a8ddae338648ebf239cccb82863a5
SSDEEP

12288:oMr4y90+DBrVqK5xUF5iZt/xbVrGcazqsbAOKLtogjoyoaah:gyFDBrVqK70ivKccAOKLra7

Score

10^/10

healer redline lint discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes

auth_value
0e95262fb78243c67430f3148303e5b7

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023c41-19.dat	healer
behavioral1/memory/1208-22-0x00000000009E0000-0x00000000009EA000-memory.dmp	healer
behavioral1/memory/4180-29-0x0000000002360000-0x000000000237A000-memory.dmp	healer
behavioral1/memory/4180-31-0x0000000002560000-0x0000000002578000-memory.dmp	healer
behavioral1/memory/4180-32-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-59-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-57-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-55-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-54-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-51-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-49-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-47-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-45-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-44-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-41-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-39-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-37-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-35-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/4180-33-0x0000000002560000-0x0000000002572000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ns8993kj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ns8993kj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ns8993kj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ns8993kj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	py22UB77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	py22UB77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ns8993kj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ns8993kj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	py22UB77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	py22UB77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	py22UB77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	py22UB77.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c31-64.dat	family_redline
behavioral1/memory/3908-66-0x0000000000900000-0x0000000000932000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
1344	will1244.exe
4584	will8969.exe
1208	ns8993kj.exe
4180	py22UB77.exe
3908	qs6670uV.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	ns8993kj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	py22UB77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	py22UB77.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	will1244.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	will8969.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3148	4180	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	will8969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py22UB77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qs6670uV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	will1244.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1208	ns8993kj.exe
1208	ns8993kj.exe
4180	py22UB77.exe
4180	py22UB77.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	ns8993kj.exe
Token: SeDebugPrivilege	4180	py22UB77.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1344	552	dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe	84
PID 552 wrote to memory of 1344	552	dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe	84
PID 552 wrote to memory of 1344	552	dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe	84
PID 1344 wrote to memory of 4584	1344	will1244.exe	85
PID 1344 wrote to memory of 4584	1344	will1244.exe	85
PID 1344 wrote to memory of 4584	1344	will1244.exe	85
PID 4584 wrote to memory of 1208	4584	will8969.exe	86
PID 4584 wrote to memory of 1208	4584	will8969.exe	86
PID 4584 wrote to memory of 4180	4584	will8969.exe	100
PID 4584 wrote to memory of 4180	4584	will8969.exe	100
PID 4584 wrote to memory of 4180	4584	will8969.exe	100
PID 1344 wrote to memory of 3908	1344	will1244.exe	108
PID 1344 wrote to memory of 3908	1344	will1244.exe	108
PID 1344 wrote to memory of 3908	1344	will1244.exe	108

C:\Users\Admin\AppData\Local\Temp\dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe
"C:\Users\Admin\AppData\Local\Temp\dc06ddacfa063c5a1e320168dfac770b50d2e51b9e9a100ba3b2bb50bf8bb370.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will1244.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will1244.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8969.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8969.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns8993kj.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns8993kj.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py22UB77.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py22UB77.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 1084
        5⤵
        Program crash
        
        PID:3148
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs6670uV.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs6670uV.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4180 -ip 4180
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will1244.exe

Filesize
469KB

MD5
399aee839adacd397c01440a26955015

SHA1
8fdbad9cf4abb9e0706d0d072696f5aa313e0a32

SHA256
04464a72e01097b2e6e8d3a2ea4faa02e8fc3eda453a828573affac856f2462f

SHA512
9fa34821d3418831f4dc3c476aeb48496d19e4ec2b13a93f03349084f03ff938e77bcacb7098f1ff77500dd4a26812b67fac174a9cd8160d8a7d6706d129d4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs6670uV.exe

Filesize
175KB

MD5
0ecc8ab62b7278cc6650517251f1543c

SHA1
b4273cda193a20d48e83241275ffc34ddad412f2

SHA256
b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

SHA512
c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8969.exe

Filesize
324KB

MD5
67569aabcbf2968b764af89e6361f243

SHA1
ad55af8596505278905019a64e8bdca2b21ce298

SHA256
5f7ee6465df80c8420b7cf9110124b94fb81a263fefa52e44f82d48226072580

SHA512
28845dfab888e70e410a92a276c70a0718ee6e339f3a511d8e6bdde32301143ea670d85eeb9ee87eb66dc04f71a1d75d39579366429985b269028ee9cc2e6b28

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns8993kj.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py22UB77.exe

Filesize
226KB

MD5
403b9d0aa3714164bc0b36a99cae999d

SHA1
9cc0fba52432d1a4121bb57420852f0add3e8169

SHA256
edf060e2f7c1a7150afc3c378ae00a31c95dc10415ac68e8ee0c00123940bdd2

SHA512
42e03ea1e5ad620caa649cbbaf3c167f1634bae08bf5b72fe72debb653640e6eed4574fa834781aa9c1fe208eadd9f0d28b3a0055e8b86da31dd8b6c6d8345b9

Download Submit
memory/1208-22-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download
memory/1208-23-0x00007FFF303D3000-0x00007FFF303D5000-memory.dmp

Filesize
8KB

Download
memory/1208-21-0x00007FFF303D3000-0x00007FFF303D5000-memory.dmp

Filesize
8KB

Download
memory/3908-71-0x00000000053B0000-0x00000000053FC000-memory.dmp

Filesize
304KB

Download
memory/3908-70-0x0000000005240000-0x000000000527C000-memory.dmp

Filesize
240KB

Download
memory/3908-69-0x00000000051E0000-0x00000000051F2000-memory.dmp

Filesize
72KB

Download
memory/3908-68-0x00000000052A0000-0x00000000053AA000-memory.dmp

Filesize
1.0MB

Download
memory/3908-67-0x0000000005720000-0x0000000005D38000-memory.dmp

Filesize
6.1MB

Download
memory/3908-66-0x0000000000900000-0x0000000000932000-memory.dmp

Filesize
200KB

Download
memory/4180-49-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-35-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-54-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-47-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-45-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-44-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-41-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-39-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-37-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-51-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-33-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-60-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4180-62-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4180-55-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-57-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-59-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-32-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/4180-31-0x0000000002560000-0x0000000002578000-memory.dmp

Filesize
96KB

Download
memory/4180-30-0x0000000004B30000-0x00000000050D4000-memory.dmp

Filesize
5.6MB

Download
memory/4180-29-0x0000000002360000-0x000000000237A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads