healer | 354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251

General

Target

354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe
Size

755KB
MD5

c497422905c24c186099ba80e6c2cde8
SHA1

af5c416e4140c05b2f59d3dd51420667ae36d917
SHA256

354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251
SHA512

e72d09fe9f0b27cf3aff56962b60d441e1c033f872520b9d0adaf92c1a01a5feb0acb891afa3f88a6e41e9b5eb6e4883f366bee2d66863949e12c51b50cb9695
SSDEEP

12288:pMrby90ef2+7cLtwD/7y+dy/BK0kHY7sopLJdmtjA0oPJ7Sa/4dVmVhQCwaVkY:2y7XIOrnGrkHibZWt806J7SaAdYVyCwI

Score

10^/10

healer redline diza discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.127:19045

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2396-22-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7790247.exe	family_redline
behavioral1/memory/2924-30-0x00000000004D0000-0x00000000004FE000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 4 IoCs

Processes:

y7450488.exey3143397.exek7152804.exel7790247.exe

pid process

5116 y7450488.exe
3472 y3143397.exe
4804 k7152804.exe
2924 l7790247.exe

pid	process
5116	y7450488.exe
3472	y3143397.exe
4804	k7152804.exe
2924	l7790247.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exey7450488.exey3143397.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7450488.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y3143397.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

k7152804.exe

description pid process target process

PID 4804 set thread context of 2396 4804 k7152804.exe AppLaunch.exe

description	pid	process	target process
PID 4804 set thread context of 2396	4804	k7152804.exe	AppLaunch.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

k7152804.exeAppLaunch.exel7790247.exe354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exey7450488.exey3143397.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k7152804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7790247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y7450488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y3143397.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2396 AppLaunch.exe
2396 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2396 AppLaunch.exe

pid	process
2396	AppLaunch.exe
2396	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2396	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exey7450488.exey3143397.exek7152804.exe

description	pid	process	target process
PID 1188 wrote to memory of 5116	1188	354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe	y7450488.exe
PID 1188 wrote to memory of 5116	1188	354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe	y7450488.exe
PID 1188 wrote to memory of 5116	1188	354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe	y7450488.exe
PID 5116 wrote to memory of 3472	5116	y7450488.exe	y3143397.exe
PID 5116 wrote to memory of 3472	5116	y7450488.exe	y3143397.exe
PID 5116 wrote to memory of 3472	5116	y7450488.exe	y3143397.exe
PID 3472 wrote to memory of 4804	3472	y3143397.exe	k7152804.exe
PID 3472 wrote to memory of 4804	3472	y3143397.exe	k7152804.exe
PID 3472 wrote to memory of 4804	3472	y3143397.exe	k7152804.exe
PID 4804 wrote to memory of 2396	4804	k7152804.exe	AppLaunch.exe
PID 4804 wrote to memory of 2396	4804	k7152804.exe	AppLaunch.exe
PID 4804 wrote to memory of 2396	4804	k7152804.exe	AppLaunch.exe
PID 4804 wrote to memory of 2396	4804	k7152804.exe	AppLaunch.exe
PID 4804 wrote to memory of 2396	4804	k7152804.exe	AppLaunch.exe
PID 3472 wrote to memory of 2924	3472	y3143397.exe	l7790247.exe
PID 3472 wrote to memory of 2924	3472	y3143397.exe	l7790247.exe
PID 3472 wrote to memory of 2924	3472	y3143397.exe	l7790247.exe

C:\Users\Admin\AppData\Local\Temp\354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe
"C:\Users\Admin\AppData\Local\Temp\354cbe1c5ee8b735928549c23900ce810c8b9055e79d007d1af94ce65f246251.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7450488.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7450488.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3143397.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3143397.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7152804.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7152804.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
5⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7790247.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7790247.exe
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7450488.exe

Filesize
445KB

MD5
e8b0dfc3e842e15abf83ade6ffb8d125

SHA1
401737cf34918eec008ef418cb37df1100d552f2

SHA256
f0da1524f0dbb98a8caf459f215dfa4544c6de925ef6170a0175d478d6534d59

SHA512
ed68b1e9ddc71b3bf025268c449ca90e43497a1e2c1550ac22f227aafada9f11981b8a246ab11b073bf6109cf39cc3660fac7b466121543393fa9922e48d2bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y3143397.exe

Filesize
274KB

MD5
e57352e416565ede37eafdb3b5ebf6c2

SHA1
9a5cfdf6584a91e48cfae5d12f81aab365525e4a

SHA256
82b89a5586f854e286b53249d126cc4c1ff62537a9d745ddf78ffcc82049eb05

SHA512
f7e6c1a02518de3393514060bb897f5e6d58269399d388aedd113eb56027e2b560ff94775388c0dfc49ce692837a7df1d395a14055745ef99e76970ba2009f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k7152804.exe

Filesize
145KB

MD5
4ab257884e61216bcb128affac95569e

SHA1
723748782e2cc900eaf676ee65edd704a309d469

SHA256
5fef47f8ab934eb192ffe1b6ea3721673522180dd08bee1b812c05e88ff91903

SHA512
927e6a1f6817397efa8906dce39f7290b9d3237b1843a99e409bfe59901cb0de17d73092564f884b5ebfbb819a6d728e6377b74407d0106a32244f9b8f55abd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7790247.exe

Filesize
168KB

MD5
36f144cfe29475ca3eddd15888297e24

SHA1
4b89c06daa09cfed47c5cb2baf92412d57d4d23f

SHA256
da2b1b7c16423315d01d5a1440935780cc7a72f13f2d6f2d3675d7de10dfc301

SHA512
6b0923238ad8a7b636793a58414db611a398f23809a3f4770ae51f0ed82db6b47e90fbcea4e73915aaef2ff31d72166e7c061f2555ee37656b3c4c87cf2aa79d

Download Submit
memory/2396-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2924-33-0x0000000005050000-0x000000000515A000-memory.dmp

Filesize
1.0MB

Download
memory/2924-30-0x00000000004D0000-0x00000000004FE000-memory.dmp

Filesize
184KB

Download
memory/2924-31-0x0000000004EE0000-0x0000000004EE6000-memory.dmp

Filesize
24KB

Download
memory/2924-32-0x0000000005560000-0x0000000005B78000-memory.dmp

Filesize
6.1MB

Download
memory/2924-34-0x0000000004F80000-0x0000000004F92000-memory.dmp

Filesize
72KB

Download
memory/2924-35-0x0000000004FE0000-0x000000000501C000-memory.dmp

Filesize
240KB

Download
memory/2924-36-0x0000000005160000-0x00000000051AC000-memory.dmp

Filesize
304KB

Download
memory/4804-21-0x0000000000421000-0x0000000000423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads