healer | 1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45

General

Target

1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe
Size

479KB
MD5

12c5e069cc467cc7ee9c3a3b98eb7abf
SHA1

b242086826de530736bb23fff3694e8e4d59934e
SHA256

1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45
SHA512

f297dbf0e8f4ed4ecdf3f464639be50547a11698e72b13f4c507b0c931979f8e64af569aaf6b08de7250744dd0b9bc4986019df1ec94786e2cf52db0bc8249c4
SSDEEP

12288:uMrBy90AHAlkWJ9ZLKeaBkdcfWtMs8Ue8j56pE:Xy9HAGOZL4B4cfWts8jQe

Score

10^/10

healer redline maxud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxud

C2

217.196.96.101:4132

Attributes

auth_value
f1403d964c52b6641ba1ef14803e6e74

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1692-15-0x0000000002190000-0x00000000021AA000-memory.dmp	healer
behavioral1/memory/1692-18-0x0000000002430000-0x0000000002448000-memory.dmp	healer
behavioral1/memory/1692-40-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-46-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-44-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-42-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-22-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-20-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-19-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-38-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-36-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-34-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-32-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-30-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-28-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-26-0x0000000002430000-0x0000000002442000-memory.dmp	healer
behavioral1/memory/1692-24-0x0000000002430000-0x0000000002442000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6520499.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6520499.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6520499.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6520499.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6520499.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6520499.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cc3-54.dat	family_redline
behavioral1/memory/2220-56-0x0000000000670000-0x000000000069E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1112	v2915872.exe
1692	a6520499.exe
2220	b4268696.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6520499.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6520499.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2915872.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2915872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6520499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4268696.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	a6520499.exe
1692	a6520499.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	a6520499.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1112	1604	1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe	84
PID 1604 wrote to memory of 1112	1604	1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe	84
PID 1604 wrote to memory of 1112	1604	1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe	84
PID 1112 wrote to memory of 1692	1112	v2915872.exe	85
PID 1112 wrote to memory of 1692	1112	v2915872.exe	85
PID 1112 wrote to memory of 1692	1112	v2915872.exe	85
PID 1112 wrote to memory of 2220	1112	v2915872.exe	100
PID 1112 wrote to memory of 2220	1112	v2915872.exe	100
PID 1112 wrote to memory of 2220	1112	v2915872.exe	100

C:\Users\Admin\AppData\Local\Temp\1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe
"C:\Users\Admin\AppData\Local\Temp\1821a818f3d471d19b38a5c04a8c79f4f4cae2fb00d7fec9f8f3742effe6fa45.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2915872.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2915872.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6520499.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6520499.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4268696.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4268696.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2915872.exe

Filesize
307KB

MD5
a5e3e885119d1c7cc55f85602cbc95e4

SHA1
d4847c33c0c57f41022e7c7b599b7e232ef26f65

SHA256
ac7e376c1508ca070c8e91286d79b737010b2646115dd1ed351da96e0063778b

SHA512
6d85291ca93022f94731ff4f6019022a42a1e101fd41b44f6f04872c327110f930a94e30d1ad5183eb2a51caeab0ba66f49b11d47dd6cab5aade9bb22058d48e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6520499.exe

Filesize
176KB

MD5
78a1345e5069694b053bd7340766fa68

SHA1
7382e9115efffbed363811a9ef44e1eb68e94e53

SHA256
71c743b2c1351378ed880dbfa4b7c0d59f43ae7036c5f1761d27b1edf8caf985

SHA512
622ecfc3fa9b701649a7fefd6a1c3df8ad8ae5bec2147205aea6f6caf3dde67bb8bcd8343b5c6503e042c3e77845fad4456eeab2d50d03cb693295d8e5cc4504

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4268696.exe

Filesize
168KB

MD5
6194c54c972d6217d95241704a681419

SHA1
9e5ffa6f067383ae548b0c807475edc7e58c0f1e

SHA256
e0e744ab5cca0b0fa926ee0db2eb522c1ada0f1cc0752b42be7c967b56492d59

SHA512
4302f62aa48619e8d8a19eeeec73a3407281667cba4f47042db0926b2cfe8548eda2b74d76bef72b8b0552d2d7c1a51fe464131bba6d5f2192df933af6e76e89

Download Submit
memory/1692-48-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1692-50-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1692-18-0x0000000002430000-0x0000000002448000-memory.dmp

Filesize
96KB

Download
memory/1692-17-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1692-40-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-46-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-32-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-44-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-42-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-22-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-20-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-19-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-38-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-15-0x0000000002190000-0x00000000021AA000-memory.dmp

Filesize
104KB

Download
memory/1692-36-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-34-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-47-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1692-30-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-28-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-26-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-24-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/1692-49-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/1692-16-0x0000000004A00000-0x0000000004FA4000-memory.dmp

Filesize
5.6MB

Download
memory/1692-52-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1692-14-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/2220-56-0x0000000000670000-0x000000000069E000-memory.dmp

Filesize
184KB

Download
memory/2220-57-0x0000000000E80000-0x0000000000E86000-memory.dmp

Filesize
24KB

Download
memory/2220-58-0x0000000005710000-0x0000000005D28000-memory.dmp

Filesize
6.1MB

Download
memory/2220-59-0x0000000005200000-0x000000000530A000-memory.dmp

Filesize
1.0MB

Download
memory/2220-60-0x0000000002A90000-0x0000000002AA2000-memory.dmp

Filesize
72KB

Download
memory/2220-61-0x0000000004F40000-0x0000000004F7C000-memory.dmp

Filesize
240KB

Download
memory/2220-62-0x0000000004F90000-0x0000000004FDC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads