healer | a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b

General

Target

a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe
Size

481KB
MD5

455cf9565892f32636aac2aa375c6490
SHA1

907eb333af343c6116e6c7e9edd1f80639d4cfff
SHA256

a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b
SHA512

c47e65bcf5ebc672defb69f18c58b9c878454c1641e2cadf0c8110e53f188754f86275d823996239ae3ed47a9dd9ff3131f05d03340613f409f0f66962881ddc
SSDEEP

12288:2Mr/y9032syvzujjplajR2DZNlLMeDVF:pyH/+q4lLlF

Score

10^/10

healer redline mihan discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes

auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3156-15-0x00000000026A0000-0x00000000026BA000-memory.dmp	healer
behavioral1/memory/3156-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral1/memory/3156-45-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-47-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-43-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-41-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-39-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-37-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-35-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-33-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-31-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-29-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-27-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-25-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-23-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/3156-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6160051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6160051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6160051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6160051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6160051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6160051.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b71-53.dat	family_redline
behavioral1/memory/804-55-0x0000000000710000-0x0000000000740000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3652	v3318492.exe
3156	a6160051.exe
804	b3838268.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6160051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6160051.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v3318492.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3318492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6160051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3838268.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3156	a6160051.exe
3156	a6160051.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	a6160051.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3652	4404	a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe	84
PID 4404 wrote to memory of 3652	4404	a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe	84
PID 4404 wrote to memory of 3652	4404	a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe	84
PID 3652 wrote to memory of 3156	3652	v3318492.exe	85
PID 3652 wrote to memory of 3156	3652	v3318492.exe	85
PID 3652 wrote to memory of 3156	3652	v3318492.exe	85
PID 3652 wrote to memory of 804	3652	v3318492.exe	95
PID 3652 wrote to memory of 804	3652	v3318492.exe	95
PID 3652 wrote to memory of 804	3652	v3318492.exe	95

C:\Users\Admin\AppData\Local\Temp\a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe
"C:\Users\Admin\AppData\Local\Temp\a53587ef301becac798c694804c61691a814e0dc85d2fe5e131b152ab698c86b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3318492.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3318492.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6160051.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6160051.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3838268.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3838268.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3318492.exe

Filesize
309KB

MD5
6953d1bca5580c99bd95946ab4069582

SHA1
42794607b797b874499c6716cb068b93d2ec7304

SHA256
9e0490e64c429e7ba56d14de9ba4cffc6665ff7c57a055c91339d2b44413698b

SHA512
a364a27c598c5f6a11dd17910348b83dccb027396d4558ad163e99a33969c11f0d31ec2a4333d09d53eb32763dc856517985b6d70628f60bfc0a5efb26e5ae69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a6160051.exe

Filesize
180KB

MD5
cd038e0fa9af945b65a3e71186ce96b0

SHA1
4123c28be894d52133aa4730c63f7aaeb26cd10a

SHA256
de85db8db02b28421bfdf1aced0691568decfc68c57f7d071ec5b56eb8b4b259

SHA512
25f219af07fe773d2375918ce40aa8f953651d2f904f4c7107808d53b20b5638df12900f4ca310f36f92b69afab36645066843b2b737fa9a03ba0f6fec8401f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3838268.exe

Filesize
168KB

MD5
7d97289291e05aa2cdb4c3a7fe93f134

SHA1
2b853f8f1d8f5eda6a308347d6251586d7f4266d

SHA256
ba38a2267bf6c74c51cb2bbf0de462363e730e0888a86770eec0ccc6a444e27f

SHA512
39deca9ee61ccf8eaa123a926a8828fbf929e9c9a08abf34569c17de2bf6e6c0bd9a7048703d03d9adfd78fd6f2902d1f310a1afa48639ac88a398c69eec0135

Download Submit
memory/804-61-0x0000000002860000-0x00000000028AC000-memory.dmp

Filesize
304KB

Download
memory/804-60-0x000000000A510000-0x000000000A54C000-memory.dmp

Filesize
240KB

Download
memory/804-59-0x000000000A4B0000-0x000000000A4C2000-memory.dmp

Filesize
72KB

Download
memory/804-58-0x000000000A580000-0x000000000A68A000-memory.dmp

Filesize
1.0MB

Download
memory/804-57-0x000000000AA70000-0x000000000B088000-memory.dmp

Filesize
6.1MB

Download
memory/804-56-0x00000000029A0000-0x00000000029A6000-memory.dmp

Filesize
24KB

Download
memory/804-55-0x0000000000710000-0x0000000000740000-memory.dmp

Filesize
192KB

Download
memory/3156-31-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-39-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-37-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-35-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-33-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-43-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-29-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-27-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-25-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-23-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-41-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-48-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/3156-49-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/3156-51-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/3156-47-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-45-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/3156-19-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/3156-17-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/3156-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/3156-16-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/3156-15-0x00000000026A0000-0x00000000026BA000-memory.dmp

Filesize
104KB

Download
memory/3156-14-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads