healer | d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467

General

Target

d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe
Size

1.4MB
MD5

15e027424ec735a4b05b71d29014800b
SHA1

891c0a3e0a49fa890fae4e810879c46d1725f1b9
SHA256

d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467
SHA512

291ff0e3499a31efde07e00c1e223ad9d2b833b8f53789cd48fea7dc3940159ec795186c8f2aec68fad24319c6a40effbbda73f11680c73df1dc69289cc7ed00
SSDEEP

24576:Wy8IxxE3l94vZDycI8u5oKXpkfCkGKAl2mP8xmMsOVC2hPv99Q3NTJtb:l7vE1Sv9ycxokfCkGKwqmGk2i9T7

Score

10^/10

healer redline maxbi discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxbi

C2

185.161.248.73:4164

Attributes

auth_value
6aa7dba884fe45693dfa04c91440daef

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4608-36-0x0000000002350000-0x000000000236A000-memory.dmp	healer
behavioral1/memory/4608-38-0x0000000002500000-0x0000000002518000-memory.dmp	healer
behavioral1/memory/4608-42-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-66-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-64-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-62-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-60-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-56-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-54-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-52-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-50-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-48-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-46-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-44-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-40-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-39-0x0000000002500000-0x0000000002512000-memory.dmp	healer
behavioral1/memory/4608-58-0x0000000002500000-0x0000000002512000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a15314648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a15314648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a15314648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a15314648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a15314648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a15314648.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b79-71.dat	family_redline
behavioral1/memory/3296-73-0x0000000000470000-0x00000000004A0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1072	i82467679.exe
3468	i14138326.exe
3648	i41418310.exe
3368	i79750025.exe
4608	a15314648.exe
3296	b91815198.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a15314648.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a15314648.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	i79750025.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	i82467679.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	i14138326.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	i41418310.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3320	4608	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a15314648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b91815198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i82467679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i14138326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i41418310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i79750025.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4608	a15314648.exe
4608	a15314648.exe
4608	a15314648.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	a15314648.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1072	3564	d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe	84
PID 3564 wrote to memory of 1072	3564	d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe	84
PID 3564 wrote to memory of 1072	3564	d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe	84
PID 1072 wrote to memory of 3468	1072	i82467679.exe	85
PID 1072 wrote to memory of 3468	1072	i82467679.exe	85
PID 1072 wrote to memory of 3468	1072	i82467679.exe	85
PID 3468 wrote to memory of 3648	3468	i14138326.exe	86
PID 3468 wrote to memory of 3648	3468	i14138326.exe	86
PID 3468 wrote to memory of 3648	3468	i14138326.exe	86
PID 3648 wrote to memory of 3368	3648	i41418310.exe	88
PID 3648 wrote to memory of 3368	3648	i41418310.exe	88
PID 3648 wrote to memory of 3368	3648	i41418310.exe	88
PID 3368 wrote to memory of 4608	3368	i79750025.exe	89
PID 3368 wrote to memory of 4608	3368	i79750025.exe	89
PID 3368 wrote to memory of 4608	3368	i79750025.exe	89
PID 3368 wrote to memory of 3296	3368	i79750025.exe	100
PID 3368 wrote to memory of 3296	3368	i79750025.exe	100
PID 3368 wrote to memory of 3296	3368	i79750025.exe	100

C:\Users\Admin\AppData\Local\Temp\d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe
"C:\Users\Admin\AppData\Local\Temp\d5931f94a58dc446d4941217aa02b3b5ff5ac9d055662b2e4187d60779c45467.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i82467679.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i82467679.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i14138326.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i14138326.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i41418310.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i41418310.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i79750025.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i79750025.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a15314648.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a15314648.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 1080
        7⤵
        Program crash
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b91815198.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b91815198.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4608 -ip 4608
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i82467679.exe

Filesize
1.3MB

MD5
d5e89f57c79af9419b89afb47cc83780

SHA1
6702857f3ad124f50f68d380826502c21e0e4089

SHA256
d39e8441a2737963f500de19eb963165921e0cb8cab07187b67817b5648b87a7

SHA512
09aa465c75b031f41cd4c449161b8f2336b546a62ca41e327c290c5674fd4c6f53dd8f36b1c17cf4337a3f2da5b5ab3d3a69b88ad37d1b14b77613cdfe45f914

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i14138326.exe

Filesize
1.1MB

MD5
6b07f8d5ddf95a125ed2b8d3024c7536

SHA1
966c078da6fb4bb96eb3d30d9be3312d46211fcd

SHA256
026aded86d91bf0884e9cab17529e7218a6d051dd6fe04013a18883ade587db9

SHA512
29eec2bc2ffbffed11f3131f945cb0d6330e654ddcaea282343ddb98a85af229d8471ee2efeee82b9eaca1d479cde0a61458a50870aad1856a2417c10832ad9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i41418310.exe

Filesize
644KB

MD5
14dc2c60db619c573ed45b37c421adcf

SHA1
6f824110fabdb4f2fd65dad4650a114c2e1a2a5b

SHA256
1afd2aaaab8ec7afb4202e3cb86e9a05fc13889679803bd787c746437607d4ba

SHA512
ade79a7296a2498e3b0ec210942f52c7d5d5faeb96a3fa0ec002aa385c202035d9f13ea1694ce3fe69d7dd234a02a944d9161175f398206679538848aa162327

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i79750025.exe

Filesize
386KB

MD5
a9f17f5130a5c499c1b15df80e733372

SHA1
893e523523ad0d9087c087f17bfaf7317d3b2665

SHA256
bbea93e79eb37e0d45159c88dad8ea1041d3f760052871426ed8a67ac54e2683

SHA512
06ae09a65b83cd175f23b5cd205d33e1e2ca7692ce0a7ea0345d658c239ddd91d45aecd98d111ba649d1992326dfa196c42aa75e1b814b5790b25aed725d14a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a15314648.exe

Filesize
294KB

MD5
cd12d8e193b5fab2922801f8724df09b

SHA1
76afdcd11bc3fb5a59c5381a9d08dac811b0ac44

SHA256
b33a2f3587f633674c846089c73b80003f17110ef8f4729b64373597bb367a99

SHA512
cf8c0a9e45e76f76bfc4478ece7e60d93d816c61ac1fff0fa02d8297863654cccce2659b321d1d49d1b2598201840f42f4e87907c0d98c318219fde175755bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b91815198.exe

Filesize
168KB

MD5
1706326846060dbcac297cb23026f352

SHA1
2d4cbedd4a82bd144a9ba9aa97e7084ba5ff8784

SHA256
4f5bfa0da606184c2e69e1e4a6f5d466fd23f06f31450651a743fafaa2213214

SHA512
9a46fd92a4f100602763bf2eca0ce8ffe3d5d531ead80a4538fcdf7d34fc4cb384176abbcbafa858f056fb8e5cec0402f28e710d67fe6773a2a9f150b7e44158

Download Submit
memory/3296-78-0x000000000A3A0000-0x000000000A3DC000-memory.dmp

Filesize
240KB

Download
memory/3296-77-0x000000000A340000-0x000000000A352000-memory.dmp

Filesize
72KB

Download
memory/3296-79-0x00000000026F0000-0x000000000273C000-memory.dmp

Filesize
304KB

Download
memory/3296-76-0x000000000A410000-0x000000000A51A000-memory.dmp

Filesize
1.0MB

Download
memory/3296-75-0x000000000A8A0000-0x000000000AEB8000-memory.dmp

Filesize
6.1MB

Download
memory/3296-74-0x0000000002770000-0x0000000002776000-memory.dmp

Filesize
24KB

Download
memory/3296-73-0x0000000000470000-0x00000000004A0000-memory.dmp

Filesize
192KB

Download
memory/4608-42-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-58-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-52-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-50-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-48-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-46-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-44-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-40-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-39-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-54-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-67-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download
memory/4608-56-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-69-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download
memory/4608-60-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-62-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-64-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-66-0x0000000002500000-0x0000000002512000-memory.dmp

Filesize
72KB

Download
memory/4608-38-0x0000000002500000-0x0000000002518000-memory.dmp

Filesize
96KB

Download
memory/4608-37-0x0000000004E10000-0x00000000053B4000-memory.dmp

Filesize
5.6MB

Download
memory/4608-36-0x0000000002350000-0x000000000236A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads