healer | 145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596

General

Target

145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe
Size

480KB
MD5

c76a91e79acd3aafe356cd158cdfd732
SHA1

a1f38f01a288477ec2a0145543859db85f04ada7
SHA256

145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596
SHA512

cee2750c95404925c366c4fc7766a2175cdd989a6dc5b0e8a7ce7f554c15b73bc19392affe966d5e0aa705b9107f294ac6e0d5412c399503324e6ed417af81e3
SSDEEP

12288:qMr0y90EcGV78L5erurlPcpDIfz1EUEKOoj9Xvt:KyulS8tcpKZmov

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4184-15-0x00000000021E0000-0x00000000021FA000-memory.dmp	healer
behavioral1/memory/4184-18-0x0000000002680000-0x0000000002698000-memory.dmp	healer
behavioral1/memory/4184-38-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-48-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-47-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-44-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-42-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-40-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-36-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-34-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-32-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-30-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-28-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-26-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-24-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-22-0x0000000002680000-0x0000000002692000-memory.dmp	healer
behavioral1/memory/4184-21-0x0000000002680000-0x0000000002692000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1103862.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k1103862.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1103862.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1103862.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1103862.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1103862.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b5a-55.dat	family_redline
behavioral1/memory/3900-56-0x0000000000DC0000-0x0000000000DE8000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3176	y9704423.exe
4184	k1103862.exe
3900	l1567543.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1103862.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k1103862.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9704423.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9704423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1103862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l1567543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	k1103862.exe
4184	k1103862.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	k1103862.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 3176	460	145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe	84
PID 460 wrote to memory of 3176	460	145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe	84
PID 460 wrote to memory of 3176	460	145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe	84
PID 3176 wrote to memory of 4184	3176	y9704423.exe	85
PID 3176 wrote to memory of 4184	3176	y9704423.exe	85
PID 3176 wrote to memory of 4184	3176	y9704423.exe	85
PID 3176 wrote to memory of 3900	3176	y9704423.exe	94
PID 3176 wrote to memory of 3900	3176	y9704423.exe	94
PID 3176 wrote to memory of 3900	3176	y9704423.exe	94

C:\Users\Admin\AppData\Local\Temp\145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe
"C:\Users\Admin\AppData\Local\Temp\145bd12ad3b52f23a22287b5fd174166cd7f131dbefd77dd5898453e0d78a596.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9704423.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9704423.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1103862.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1103862.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1567543.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1567543.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9704423.exe

Filesize
308KB

MD5
6e815204144e7a77166e526f72ffd3e8

SHA1
18e6489c1b3944ea62e8eb90f386478e28dd6f66

SHA256
bf6c702ad37e2b5c6d12436cf750ec28f19822dce5db15f29f9b364cffa2b79a

SHA512
d1c56e61361cb9f845b65a129317790bdb7b5bd0d77998d48f85a4e907720146a753cb1790cfca2db027392e918493349c8da97083daf516c977bb53372ebd19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1103862.exe

Filesize
175KB

MD5
ba2488c111ce1145f853d10995d23ae9

SHA1
270ce4c64618dddb03e5b90b9263dad258dc80c6

SHA256
c4fa6a6ef1ed766fddbbff191134c2ac10e3eea125136f63da0c88cf5d972cc5

SHA512
a3d0a5dde3888d9c2041a07993c15ba4372f5afaf400505318703026c6a368f55fe983b324ddbe344c67075c8a516e03fc6ca20578256494208968981758214e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1567543.exe

Filesize
136KB

MD5
92eff5338692eea95c2648a6075a0585

SHA1
215ba7a1e3249289321909b460472a4733b6ce38

SHA256
335e69b6fcbf7be858d5df80bd130b64e5b740f4487ed77f53b2a44d0d41739c

SHA512
dc85a44bb8b4d6a6852db6fb6db23ac5414c63d60844bbee5e56584bf54ea7ff5b2f6b824b8a2db95dfb245637bc78f5ae6beee68f065de3764fbcf8da4a0bf2

Download Submit
memory/3900-61-0x0000000007D60000-0x0000000007DAC000-memory.dmp

Filesize
304KB

Download
memory/3900-60-0x0000000007B80000-0x0000000007BBC000-memory.dmp

Filesize
240KB

Download
memory/3900-59-0x0000000007C50000-0x0000000007D5A000-memory.dmp

Filesize
1.0MB

Download
memory/3900-58-0x0000000007B20000-0x0000000007B32000-memory.dmp

Filesize
72KB

Download
memory/3900-57-0x0000000008080000-0x0000000008698000-memory.dmp

Filesize
6.1MB

Download
memory/3900-56-0x0000000000DC0000-0x0000000000DE8000-memory.dmp

Filesize
160KB

Download
memory/4184-34-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-22-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-47-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-44-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-42-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-40-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-36-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-38-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-32-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-30-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-28-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-26-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-24-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-48-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-21-0x0000000002680000-0x0000000002692000-memory.dmp

Filesize
72KB

Download
memory/4184-49-0x0000000073BAE000-0x0000000073BAF000-memory.dmp

Filesize
4KB

Download
memory/4184-50-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/4184-52-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/4184-20-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/4184-19-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/4184-18-0x0000000002680000-0x0000000002698000-memory.dmp

Filesize
96KB

Download
memory/4184-16-0x0000000073BA0000-0x0000000074350000-memory.dmp

Filesize
7.7MB

Download
memory/4184-17-0x0000000004CA0000-0x0000000005244000-memory.dmp

Filesize
5.6MB

Download
memory/4184-15-0x00000000021E0000-0x00000000021FA000-memory.dmp

Filesize
104KB

Download
memory/4184-14-0x0000000073BAE000-0x0000000073BAF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads