healer | 4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb

General

Target

4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe
Size

479KB
MD5

d6d08f55c9b4a75dd763d6daae515294
SHA1

9a0682464b8a8b2ef904cb43173cacfb1f291388
SHA256

4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb
SHA512

f678867deea09a47f97a76c15ed715a3281d44bab1d6e40191649904def4490d616ac9933c38654ba8f1c1300d0ed0093e14eec9ab143e29da3269a6256d8c7e
SSDEEP

12288:fMrdy90CRQkg6bUzwmdcNkHba6WpOcLXw:SyhBTbmRmnpOc8

Score

10^/10

healer redline maher discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maher

C2

217.196.96.101:4132

Attributes

auth_value
c57763165f68aabcf4874e661a1ffbac

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2368-15-0x0000000002260000-0x000000000227A000-memory.dmp	healer
behavioral1/memory/2368-18-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/2368-46-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-44-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-42-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-40-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-38-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-36-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-34-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-32-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-30-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-28-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-26-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-24-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-22-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-20-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2368-19-0x0000000004980000-0x0000000004992000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a8547837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8547837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8547837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8547837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8547837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8547837.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cc0-54.dat	family_redline
behavioral1/memory/4388-56-0x0000000000460000-0x0000000000490000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4032	v9034269.exe
2368	a8547837.exe
4388	b8726172.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a8547837.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8547837.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9034269.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9034269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8547837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8726172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	a8547837.exe
2368	a8547837.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	a8547837.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4032	4672	4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe	84
PID 4672 wrote to memory of 4032	4672	4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe	84
PID 4672 wrote to memory of 4032	4672	4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe	84
PID 4032 wrote to memory of 2368	4032	v9034269.exe	85
PID 4032 wrote to memory of 2368	4032	v9034269.exe	85
PID 4032 wrote to memory of 2368	4032	v9034269.exe	85
PID 4032 wrote to memory of 4388	4032	v9034269.exe	97
PID 4032 wrote to memory of 4388	4032	v9034269.exe	97
PID 4032 wrote to memory of 4388	4032	v9034269.exe	97

C:\Users\Admin\AppData\Local\Temp\4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe
"C:\Users\Admin\AppData\Local\Temp\4ee9744eedc8be62cfb067b18df968d0eba2f42e8706cc8132e0b986b30b49eb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9034269.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9034269.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8547837.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8547837.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8726172.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8726172.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9034269.exe

Filesize
307KB

MD5
aad6d7075e312080568185eb9244be70

SHA1
2e3c5e8558535c3f3449e68085e502699b6ccf85

SHA256
1c2850d11a851dff241b10b2644e470d7aa85e66378215cbc4f243dcd47eaf91

SHA512
f46b88cac25c88a5b65c1529d715a4bc00e78ee8c33c666da12fcc90ba98b94832564fc608bca4fdedd7b3fa59474210dc42d60f9a15509de36c364f3a669386

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a8547837.exe

Filesize
179KB

MD5
44e8d7d50632d22cf63147b1d0a35702

SHA1
8e2530631af96415dbbbf65488af6dbd846e48b8

SHA256
abe1cbbc6afe5f18e5935afd8adeba1229edc339354ef987b2dfef4d7e546b96

SHA512
71d095df04f9b3718df52dcd23cca8d804310cd2865f3a9ef9f01e9ad877a18512f2e70a26757c5d30cd7f5f45e6815a8d276dc3056e2ab88e6c7591ba5d417e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8726172.exe

Filesize
168KB

MD5
34886f4c9f0ab843bc134224041f6543

SHA1
c8958e7a268a59f06d328727e8e006d5341d4b6e

SHA256
3228c4de743a9333cc06d1a442fd9db7c7454e87b9de796f192d100c2b0c7c6c

SHA512
a44b6e47e1040dba35b093d5b68d0ae6837eaf7e1a796dbf6efdd8d681418b9b8c7528658c1ad1a2f83d2964e3285c3c16139f4198ac2c63413740496f4f085a

Download Submit
memory/2368-30-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-50-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2368-17-0x0000000004B10000-0x00000000050B4000-memory.dmp

Filesize
5.6MB

Download
memory/2368-18-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/2368-46-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-44-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-26-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-40-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-38-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-36-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-34-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-32-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-47-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2368-15-0x0000000002260000-0x000000000227A000-memory.dmp

Filesize
104KB

Download
memory/2368-48-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2368-28-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-42-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-24-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-22-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-20-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-19-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2368-49-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/2368-16-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2368-52-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2368-14-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/4388-56-0x0000000000460000-0x0000000000490000-memory.dmp

Filesize
192KB

Download
memory/4388-57-0x00000000026A0000-0x00000000026A6000-memory.dmp

Filesize
24KB

Download
memory/4388-58-0x0000000005440000-0x0000000005A58000-memory.dmp

Filesize
6.1MB

Download
memory/4388-59-0x0000000004F30000-0x000000000503A000-memory.dmp

Filesize
1.0MB

Download
memory/4388-60-0x0000000004CD0000-0x0000000004CE2000-memory.dmp

Filesize
72KB

Download
memory/4388-61-0x0000000004E60000-0x0000000004E9C000-memory.dmp

Filesize
240KB

Download
memory/4388-62-0x0000000004EA0000-0x0000000004EEC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads