healer | 304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25

General

Target

304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe
Size

1.4MB
MD5

bbf24d5445fad8476bd1bae77f1bd449
SHA1

edc5eb3a5cbafa3ea45d6cfcb00ed770ad212193
SHA256

304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25
SHA512

e4dffd2dc4a6b1d60f579297846f9470c09608c6cc451ba66131394c317b9ed4f65b5c9ca9364bcfd88ce39368a93755179ec31bba42cc68853874b700d72e3c
SSDEEP

24576:rywAUnOpItG/wN31z+PVueJdJjAysjfTPaMNd6twMiuAN6P4OCtBbNXH0HAESHNE:eOOv/a31zUdJc6vavbxoStEl

Score

10^/10

healer redline maxbi discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxbi

C2

185.161.248.73:4164

Attributes

auth_value
6aa7dba884fe45693dfa04c91440daef

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4952-36-0x0000000002380000-0x000000000239A000-memory.dmp	healer
behavioral1/memory/4952-38-0x0000000004DB0000-0x0000000004DC8000-memory.dmp	healer
behavioral1/memory/4952-62-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-64-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-60-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-59-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-56-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-54-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-52-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-51-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-48-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-46-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-44-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-42-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-66-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-40-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer
behavioral1/memory/4952-39-0x0000000004DB0000-0x0000000004DC2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a29347295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a29347295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a29347295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a29347295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a29347295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a29347295.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cd1-71.dat	family_redline
behavioral1/memory/2672-73-0x0000000000FC0000-0x0000000000FF0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
212	i03814919.exe
4828	i88432761.exe
2380	i31511900.exe
3320	i05295996.exe
4952	a29347295.exe
2672	b94018008.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a29347295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a29347295.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	i03814919.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	i88432761.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	i31511900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	i05295996.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	4952	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b94018008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i03814919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i88432761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i31511900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i05295996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a29347295.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4952	a29347295.exe
4952	a29347295.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	a29347295.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 212	4552	304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe	84
PID 4552 wrote to memory of 212	4552	304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe	84
PID 4552 wrote to memory of 212	4552	304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe	84
PID 212 wrote to memory of 4828	212	i03814919.exe	85
PID 212 wrote to memory of 4828	212	i03814919.exe	85
PID 212 wrote to memory of 4828	212	i03814919.exe	85
PID 4828 wrote to memory of 2380	4828	i88432761.exe	86
PID 4828 wrote to memory of 2380	4828	i88432761.exe	86
PID 4828 wrote to memory of 2380	4828	i88432761.exe	86
PID 2380 wrote to memory of 3320	2380	i31511900.exe	88
PID 2380 wrote to memory of 3320	2380	i31511900.exe	88
PID 2380 wrote to memory of 3320	2380	i31511900.exe	88
PID 3320 wrote to memory of 4952	3320	i05295996.exe	90
PID 3320 wrote to memory of 4952	3320	i05295996.exe	90
PID 3320 wrote to memory of 4952	3320	i05295996.exe	90
PID 3320 wrote to memory of 2672	3320	i05295996.exe	99
PID 3320 wrote to memory of 2672	3320	i05295996.exe	99
PID 3320 wrote to memory of 2672	3320	i05295996.exe	99

C:\Users\Admin\AppData\Local\Temp\304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe
"C:\Users\Admin\AppData\Local\Temp\304803e5d6df565e029d25e604b007721d002348a6702067648718d0e5484d25.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i03814919.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i03814919.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i88432761.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i88432761.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i31511900.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i31511900.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i05295996.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i05295996.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a29347295.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a29347295.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 1084
        7⤵
        Program crash
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b94018008.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b94018008.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4952 -ip 4952
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i03814919.exe

Filesize
1.3MB

MD5
925ff33187898d082fa24cfc00203a1b

SHA1
6ecefff833ef445dbb15430d8b95de493e1ef41b

SHA256
b1366804e93065ee1e1ad3ca8d6dbc19c9c2b3cd1bf450dbbc7f0f45eda461be

SHA512
20ca383be2b57f858d3ad8966a240d51f271f48e15e74388eb65932bda3e4c37f086cc7d0bd88c5299ec88b288891254ee4cf60a07a13c2ed48e2abd787202bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i88432761.exe

Filesize
1.1MB

MD5
0a33d99ed45a0879ca85fab5d51bf81c

SHA1
0bf339db9426e61e8568a2941243d17f28a9f8d6

SHA256
5f7d164afbf995c5ebe6262450daf2d57e5e98b54fa1701a1aa883c619b828b8

SHA512
ee8967ae524521ffed72d508b010616e5519aa25715b1a5a26e3a964fca0a97ec160332e37a932c362e294d647c8ae98eef5549c0d6753762e9ba50793018152

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i31511900.exe

Filesize
645KB

MD5
367a9208462621a5f007b05e4d537186

SHA1
d73e59a599b41c79491c733d4884ceb51b8067c3

SHA256
46e43a1824200a2fa85fd85eaefb84849b6d8972201c00733acf9968dde837d0

SHA512
48d8ac3583c5f8a3d87b9a52a5ef26304da6d02eed78f356e758cda618bff50b142037272051c3bdc8b30b065ed93a6d52eaa79c773424ffe0fc23689177603d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i05295996.exe

Filesize
385KB

MD5
747cb61d39c10607680d92a84a5c25e6

SHA1
e8d8bd2ae8acdc38823558a35ba321c51175ff0c

SHA256
f8240ebd2b76e7930dcebe95a17302c6fa2db7d53bfdf92087ebaa6123f291e5

SHA512
c9bf6b0b91b3c74e7418a97dd5c3034058e9546e7e07b79c5417a6f51b3768de065b52f66ff64713fef787a4638d1e8288964c60c2088f3e85ec5be18d80b01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a29347295.exe

Filesize
294KB

MD5
f844987e75167b54d9192090b1fd901a

SHA1
42dbea33a863a8e13511ac93278f89339d52af00

SHA256
1169b30278dd044c5a58a995497da74085162c8e896383f29c3b0350efccca98

SHA512
bc79f7ce46dca4ccff43c7227c63f1a8c7e9f3eb61b38f514558575c36e929634e18d17a0dbaf2c50c594828b9188116d9daf3d4ee3f851b714dd1f6108d1712

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b94018008.exe

Filesize
168KB

MD5
3d6eebbdabba5a1136d9c35b08c5c09a

SHA1
dedb5f6799bde7202a605a6178ca4db227515a78

SHA256
a1431a7a68c771988cd97bb559db704bb3bf457f2a6e41c5c25882ce15052fe8

SHA512
472338739903a5aae66000179fb806af5b3ec479610d36d306617a9bb425ce6552b3b95257e93be1c9ba0498aa905191b37b2039e1eb41991286223c6ad2f0a1

Download Submit
memory/2672-78-0x0000000005AE0000-0x0000000005B1C000-memory.dmp

Filesize
240KB

Download
memory/2672-77-0x0000000005A80000-0x0000000005A92000-memory.dmp

Filesize
72KB

Download
memory/2672-79-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Filesize
304KB

Download
memory/2672-76-0x0000000005B70000-0x0000000005C7A000-memory.dmp

Filesize
1.0MB

Download
memory/2672-75-0x0000000006040000-0x0000000006658000-memory.dmp

Filesize
6.1MB

Download
memory/2672-74-0x0000000003080000-0x0000000003086000-memory.dmp

Filesize
24KB

Download
memory/2672-73-0x0000000000FC0000-0x0000000000FF0000-memory.dmp

Filesize
192KB

Download
memory/4952-62-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-39-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-51-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-48-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-46-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-44-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-42-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-66-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-40-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-52-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-67-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download
memory/4952-54-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-69-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download
memory/4952-56-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-59-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-60-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-64-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

Filesize
72KB

Download
memory/4952-38-0x0000000004DB0000-0x0000000004DC8000-memory.dmp

Filesize
96KB

Download
memory/4952-37-0x0000000004E50000-0x00000000053F4000-memory.dmp

Filesize
5.6MB

Download
memory/4952-36-0x0000000002380000-0x000000000239A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads