healer | 47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d

General

Target

47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe
Size

480KB
MD5

04a1e1aa7c1b7fd6b8b20fec1dff6948
SHA1

ca13a46ed521abfd052cfada607c9f936cec6848
SHA256

47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d
SHA512

f6474efa93ce27a3f6d8d7eb53ac8e3bc657d1b437361a69c26d8e75499c9a1ec67f75a2e04a1a7e4be6401efd159247441b4d5deece729fa61f854af951d996
SSDEEP

12288:OMroy90mAuLPs5c1u31+Ttm7PoOom1gRlKOeIUNMa:ayKujMXMTaPU4g3sNMa

Score

10^/10

healer redline dariy discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dariy

C2

217.196.96.101:4132

Attributes

auth_value
2f34aa0d1cb1023a826825b68ebedcc8

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3212-15-0x0000000002340000-0x000000000235A000-memory.dmp	healer
behavioral1/memory/3212-18-0x0000000002530000-0x0000000002548000-memory.dmp	healer
behavioral1/memory/3212-48-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-46-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-44-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-42-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-40-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-38-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-36-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-34-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-32-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-30-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-28-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-26-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-24-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-22-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/3212-21-0x0000000002530000-0x0000000002542000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6816500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6816500.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6816500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6816500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6816500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6816500.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023ba4-54.dat	family_redline
behavioral1/memory/3608-56-0x0000000000A80000-0x0000000000AAE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2384	y8256361.exe
3212	k6816500.exe
3608	l8758830.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6816500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6816500.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8256361.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k6816500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l8758830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8256361.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3212	k6816500.exe
3212	k6816500.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	k6816500.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 2384	4204	47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe	84
PID 4204 wrote to memory of 2384	4204	47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe	84
PID 4204 wrote to memory of 2384	4204	47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe	84
PID 2384 wrote to memory of 3212	2384	y8256361.exe	85
PID 2384 wrote to memory of 3212	2384	y8256361.exe	85
PID 2384 wrote to memory of 3212	2384	y8256361.exe	85
PID 2384 wrote to memory of 3608	2384	y8256361.exe	95
PID 2384 wrote to memory of 3608	2384	y8256361.exe	95
PID 2384 wrote to memory of 3608	2384	y8256361.exe	95

C:\Users\Admin\AppData\Local\Temp\47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe
"C:\Users\Admin\AppData\Local\Temp\47b7d5633a472e507d3ab148dc5c24c306800a24c16b6d30046290453738b72d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8256361.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8256361.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6816500.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6816500.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8758830.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8758830.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8256361.exe

Filesize
309KB

MD5
1a9c9c0483341b4f77ffdf4512538126

SHA1
d17ba6d13aab6f35ace1feec40abbd919fc9adc3

SHA256
ce2bb38ff778ce2ac7d65c7e43d21d7f135594d5b70cf16927a7b92ab159b98d

SHA512
11523af83baac14d2114acaeb6a10a8375bf55d123c0ab5396846cf49aec026556d2788be292f0a00cde2eb69da3780c8c2954a2b3d447528d2522d40e56b693

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6816500.exe

Filesize
176KB

MD5
3978cfc3650fc6213935451e9ced65ea

SHA1
ad6a221b954df638bfa79027001f5a392ff04df0

SHA256
8d7ba0066eb6f5bcc607a6bc01f974d70c0f84128003b0cb4296005222a618e8

SHA512
2294f6a07315ee6e08c75d1a3445073960bccc7ffc620f6dd30b506c19b431fb27fc87a041d06f8e6d41e7b941ddce948998121991ff543388e5408bd405ed61

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8758830.exe

Filesize
168KB

MD5
9cb614dc93db6f66db190ecd7667218c

SHA1
023b85ecaadb58adbc066621118a3603fa0f33e4

SHA256
5e034295f9d4f222453fa803ffb515d69f9b89ca479b53489d6ef4fc0a30d653

SHA512
52ab4974618d9156ff2023176ae88172118dd7f9f7528f2ee32949f70e25064e11047d13145b736a944ac859815d56a9d1fff857287f5f44576c01ca43f8b5dc

Download Submit
memory/3212-34-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-50-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/3212-17-0x0000000004AF0000-0x0000000005094000-memory.dmp

Filesize
5.6MB

Download
memory/3212-18-0x0000000002530000-0x0000000002548000-memory.dmp

Filesize
96KB

Download
memory/3212-19-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/3212-20-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/3212-28-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-46-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-44-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-42-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-40-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-38-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-36-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-15-0x0000000002340000-0x000000000235A000-memory.dmp

Filesize
104KB

Download
memory/3212-32-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-30-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-48-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-26-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-24-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-22-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-21-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/3212-49-0x000000007452E000-0x000000007452F000-memory.dmp

Filesize
4KB

Download
memory/3212-16-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/3212-52-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/3212-14-0x000000007452E000-0x000000007452F000-memory.dmp

Filesize
4KB

Download
memory/3608-56-0x0000000000A80000-0x0000000000AAE000-memory.dmp

Filesize
184KB

Download
memory/3608-57-0x0000000002C30000-0x0000000002C36000-memory.dmp

Filesize
24KB

Download
memory/3608-58-0x0000000005AF0000-0x0000000006108000-memory.dmp

Filesize
6.1MB

Download
memory/3608-59-0x0000000005610000-0x000000000571A000-memory.dmp

Filesize
1.0MB

Download
memory/3608-60-0x0000000005540000-0x0000000005552000-memory.dmp

Filesize
72KB

Download
memory/3608-61-0x00000000055A0000-0x00000000055DC000-memory.dmp

Filesize
240KB

Download
memory/3608-62-0x0000000005720000-0x000000000576C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads