healer | a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f

General

Target

a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe
Size

1.5MB
MD5

fcfa0c88f2c3abb1d84c4623131f5eaa
SHA1

6b2031cc39fca2c15eac93fe65db39f6d9531cf8
SHA256

a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f
SHA512

b52afa564ca4a8bb0d3ef998d16feee70a6e9b6bc9e882f5e82cd52e711b1c52eeb5a895e57988d72b09e7166d6c5f33e4d9e91d95597e7e5160e2d9cdd4f212
SSDEEP

24576:dy468ZXBZQpV3TfAbnmrQGljLEw/slTSuOfpWDaRBCssjKG:4/8ZwpdEi1lsMiTIBWORss

Score

10^/10

healer redline max discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

max

C2

185.161.248.73:4164

Attributes

auth_value
efb1499709a5d08ed1ddf71cff71211f

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4912-35-0x00000000024A0000-0x00000000024BA000-memory.dmp	healer
behavioral1/memory/4912-37-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral1/memory/4912-47-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-65-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-63-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-62-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-59-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-57-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-53-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-51-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-49-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-45-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-43-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-41-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-39-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer
behavioral1/memory/4912-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a15985012.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a15985012.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a15985012.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a15985012.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a15985012.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a15985012.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b6c-68.dat	family_redline
behavioral1/memory/2752-70-0x0000000000160000-0x0000000000190000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
3216	i18336389.exe
4248	i80901322.exe
2588	i20701553.exe
2772	i06539550.exe
4912	a15985012.exe
2752	b55705710.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a15985012.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a15985012.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	i18336389.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	i80901322.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	i20701553.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	i06539550.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2380	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i18336389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i80901322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i20701553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i06539550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a15985012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b55705710.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4912	a15985012.exe
4912	a15985012.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	a15985012.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3216	4708	a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe	84
PID 4708 wrote to memory of 3216	4708	a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe	84
PID 4708 wrote to memory of 3216	4708	a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe	84
PID 3216 wrote to memory of 4248	3216	i18336389.exe	85
PID 3216 wrote to memory of 4248	3216	i18336389.exe	85
PID 3216 wrote to memory of 4248	3216	i18336389.exe	85
PID 4248 wrote to memory of 2588	4248	i80901322.exe	86
PID 4248 wrote to memory of 2588	4248	i80901322.exe	86
PID 4248 wrote to memory of 2588	4248	i80901322.exe	86
PID 2588 wrote to memory of 2772	2588	i20701553.exe	87
PID 2588 wrote to memory of 2772	2588	i20701553.exe	87
PID 2588 wrote to memory of 2772	2588	i20701553.exe	87
PID 2772 wrote to memory of 4912	2772	i06539550.exe	88
PID 2772 wrote to memory of 4912	2772	i06539550.exe	88
PID 2772 wrote to memory of 4912	2772	i06539550.exe	88
PID 2772 wrote to memory of 2752	2772	i06539550.exe	97
PID 2772 wrote to memory of 2752	2772	i06539550.exe	97
PID 2772 wrote to memory of 2752	2772	i06539550.exe	97

C:\Users\Admin\AppData\Local\Temp\a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe
"C:\Users\Admin\AppData\Local\Temp\a502ecbf0bffc729ffa0af1bcdb09b72042f889b94f0818415cadc655d347e5f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i18336389.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i18336389.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i80901322.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i80901322.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i20701553.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i20701553.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i06539550.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i06539550.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a15985012.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a15985012.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b55705710.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b55705710.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2752

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i18336389.exe

Filesize
1.2MB

MD5
a144689211dcc205e23011ce9a3b8579

SHA1
3a716bf2b44d8467a79f395fd66286a545d0c15c

SHA256
ea0516dafbcc19c61bd59944d88e6472e72bf4399b089dd75faa88b35d88bb7d

SHA512
95cf3c6d0ede997021661e3828ce1dc4a85556a0d9e94ff5f94a6fe62da9fd74898ceccd33fec208785629d62ff417efa501477b8d50e839b4e130256efc7e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i80901322.exe

Filesize
1.0MB

MD5
1542b80b526071c9e856191e75c5cf91

SHA1
f9b486600bc9b8a881ad5aba35fd0ec900fce13a

SHA256
5ea9ec1dda13c7a4c8c3d3b535b750e4768dc4e89c8e14727b85da14d7e4b376

SHA512
9f675eab2dc832d2ddffcf765d5acfb482273aa28c5deaf3a2fed39c01202ade07d78b8a303e221bff7b25d22d66304a6b5c62390c71a8cd02724c0e1ed15b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i20701553.exe

Filesize
570KB

MD5
492d235f928e71a04846d614ca6afd1b

SHA1
ec9539c917232beccd34bd3b39f2e6796af60bb0

SHA256
2f22af24697b54f964a25ec1b6c266ff9ca43a34e79bf358d6b5bc56722cbb75

SHA512
4e9f299c48134d78c80d0580b6bcd0684c5e0860fee27c4908d5437b7ff5d15104cd46fd3a7f21ddfb26b9bfc0071b3f1b92310e764eef06fe760a5ff7d0fefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i06539550.exe

Filesize
310KB

MD5
685cc4749cf11159d7b5538f5bb60b77

SHA1
3a65aebc99caf46e777474579d9e272564f31bb0

SHA256
0dc8b2427a9c864aa4d4400201df8bc53cfb9cfc3d839c220d4c13c48124f699

SHA512
416c97b78d5eecd508c4587007550da404ed2d4ca4293c47e95d7e595e0a4cebd4d640fa13484a29a9b9d5c82dbf59b1df606fa6eab9133e779be8b65070aef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a15985012.exe

Filesize
176KB

MD5
f4e12fdcf1cb8ef289ae065eb0520158

SHA1
abd0199683b22a18ffa4c2f3c1b57e36e9af82d6

SHA256
8ffdfb58ed0d69b7d22a88062b18601c2720bf36969fd31699d6b7bd3bfad728

SHA512
404021d3bd60d818a4d5e1c96a2a72997590db24a8f7fab7ca0c434ab19c583eb29c2539fb5beb19db9b9150f98dc0a7729e90c9f732d34dcf43c5c91c5212c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b55705710.exe

Filesize
168KB

MD5
a95fe9ed613ae8aab977c2f66ad8c0bd

SHA1
766a6834b66100a7695bb83152291376c1558513

SHA256
daab558accd31301793176c48e22c9badedbd77583c161285b03c9546cb2c863

SHA512
9f51913d8e68b855d6e4c6903778d6312f6662363cf86c86c67d8b03e8d2770962cad06dd33345e535d1c8c08326397c384c7a0356537325b6c8273af364e7fc

Download Submit
memory/2752-75-0x000000000A0A0000-0x000000000A0DC000-memory.dmp

Filesize
240KB

Download
memory/2752-74-0x000000000A040000-0x000000000A052000-memory.dmp

Filesize
72KB

Download
memory/2752-73-0x000000000A110000-0x000000000A21A000-memory.dmp

Filesize
1.0MB

Download
memory/2752-72-0x000000000A5B0000-0x000000000ABC8000-memory.dmp

Filesize
6.1MB

Download
memory/2752-71-0x00000000024F0000-0x00000000024F6000-memory.dmp

Filesize
24KB

Download
memory/2752-70-0x0000000000160000-0x0000000000190000-memory.dmp

Filesize
192KB

Download
memory/2752-76-0x00000000023D0000-0x000000000241C000-memory.dmp

Filesize
304KB

Download
memory/4912-56-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-53-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-51-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-49-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-45-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-43-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-41-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-39-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-57-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-59-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-62-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-63-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-65-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-47-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

Filesize
76KB

Download
memory/4912-37-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/4912-36-0x0000000004B40000-0x00000000050E4000-memory.dmp

Filesize
5.6MB

Download
memory/4912-35-0x00000000024A0000-0x00000000024BA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads