healer | 602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18

General

Target

602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe
Size

479KB
MD5

afcad893788b15a2355d0af32bcf6326
SHA1

fb6d908de8585513d4784f2a96aaf886d638a1d4
SHA256

602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18
SHA512

7f9ab5bf9f196f3c50e1eee8936434c244dee3d8782928f1804539bde8c4c0e6dcb8dfff650b7edaec3e888317def859588eb45fcfbe71f73d0e9f7a1286b4eb
SSDEEP

12288:hMrLy90Gqos3MSrSogyLWZ9gpwCMQQTsmYB:Ky0os3oo7GG

Score

10^/10

healer redline murka discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

murka

C2

217.196.96.101:4132

Attributes

auth_value
878a0681ac6ad0e4eb10ef9db07abdd9

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3620-15-0x0000000000970000-0x000000000098A000-memory.dmp	healer
behavioral1/memory/3620-18-0x0000000002560000-0x0000000002578000-memory.dmp	healer
behavioral1/memory/3620-19-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-46-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-44-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-42-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-40-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-38-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-36-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-34-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-32-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-30-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-28-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-26-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-24-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-22-0x0000000002560000-0x0000000002572000-memory.dmp	healer
behavioral1/memory/3620-20-0x0000000002560000-0x0000000002572000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6655238.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6655238.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6655238.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6655238.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6655238.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6655238.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/memory/3388-55-0x00000000009A0000-0x00000000009D0000-memory.dmp	family_redline
behavioral1/files/0x0007000000023cb8-54.dat	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1148	v5713863.exe
3620	a6655238.exe
3388	b9287928.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6655238.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6655238.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5713863.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9287928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5713863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6655238.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3620	a6655238.exe
3620	a6655238.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	a6655238.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1148	2216	602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe	84
PID 2216 wrote to memory of 1148	2216	602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe	84
PID 2216 wrote to memory of 1148	2216	602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe	84
PID 1148 wrote to memory of 3620	1148	v5713863.exe	85
PID 1148 wrote to memory of 3620	1148	v5713863.exe	85
PID 1148 wrote to memory of 3620	1148	v5713863.exe	85
PID 1148 wrote to memory of 3388	1148	v5713863.exe	98
PID 1148 wrote to memory of 3388	1148	v5713863.exe	98
PID 1148 wrote to memory of 3388	1148	v5713863.exe	98

C:\Users\Admin\AppData\Local\Temp\602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe
"C:\Users\Admin\AppData\Local\Temp\602b88acc037a78a6d28e4c020773b844410695c6e3c4abd5c80babd87e27b18.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5713863.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5713863.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6655238.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6655238.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9287928.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9287928.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5713863.exe

Filesize
307KB

MD5
7ddb2f0f867e5478cecf2243e63a41d2

SHA1
c53f3922f76822982dfc12caf27a1afbc6b20857

SHA256
0ad55a3d765b97237841ba009ab7fdc4dbd558cc66fa71822c514ae97033b923

SHA512
1f270e9473d9b6ea3789564c42ce546d0c5e7ae0afdaf166a99014d31a42b4a3e95e3776a08ca9babd8d22bf5bb23a8f36702210d1205d9a9fc933f4b55ffa37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6655238.exe

Filesize
181KB

MD5
cec2835572fad45aa6303a551b440485

SHA1
a94709cfe3e2e5a895abbe6578651bf64b81f8c8

SHA256
c7fda5957257b8fbe1a28904aaecb39549bd51aa78debc06f115799db50db999

SHA512
fee4ab2deaf23714ee3a1e173ac7d20badc2684b831a3b31c4d367ca429669782a77fd1d06299ccfec09d84d07077d99669dffe612880f12a417fdb82d33876b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9287928.exe

Filesize
168KB

MD5
35c1842d6f1272a5977590d8434cea11

SHA1
fcdc912cd1ab19c3c0cb43da0fca83b1b1ba709e

SHA256
424d3fea2a0fdc21eb73b72d3390d395da962d30745c90322a706c2aef330813

SHA512
93021bf6d4754d72390afc392179b154417384460d98bcbf6c42b02a6c5ef48cee5f345f7e4de70cfabcc60ca08db76193269d14dc783d5ad968baa03ee84b17

Download Submit
memory/3388-61-0x00000000053E0000-0x000000000542C000-memory.dmp

Filesize
304KB

Download
memory/3388-60-0x00000000053A0000-0x00000000053DC000-memory.dmp

Filesize
240KB

Download
memory/3388-59-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/3388-58-0x0000000005470000-0x000000000557A000-memory.dmp

Filesize
1.0MB

Download
memory/3388-57-0x0000000005980000-0x0000000005F98000-memory.dmp

Filesize
6.1MB

Download
memory/3388-56-0x0000000001290000-0x0000000001296000-memory.dmp

Filesize
24KB

Download
memory/3388-55-0x00000000009A0000-0x00000000009D0000-memory.dmp

Filesize
192KB

Download
memory/3620-30-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-20-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-38-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-36-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-34-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-32-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-42-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-28-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-26-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-24-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-22-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-40-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-47-0x0000000073C50000-0x0000000074400000-memory.dmp

Filesize
7.7MB

Download
memory/3620-48-0x0000000073C5E000-0x0000000073C5F000-memory.dmp

Filesize
4KB

Download
memory/3620-49-0x0000000073C50000-0x0000000074400000-memory.dmp

Filesize
7.7MB

Download
memory/3620-51-0x0000000073C50000-0x0000000074400000-memory.dmp

Filesize
7.7MB

Download
memory/3620-44-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-46-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-19-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/3620-18-0x0000000002560000-0x0000000002578000-memory.dmp

Filesize
96KB

Download
memory/3620-17-0x0000000004C90000-0x0000000005234000-memory.dmp

Filesize
5.6MB

Download
memory/3620-16-0x0000000073C50000-0x0000000074400000-memory.dmp

Filesize
7.7MB

Download
memory/3620-15-0x0000000000970000-0x000000000098A000-memory.dmp

Filesize
104KB

Download
memory/3620-14-0x0000000073C5E000-0x0000000073C5F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads