healer | 1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25

General

Target

1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe
Size

873KB
MD5

4300f8bc621a3afcb9442a5c866fbc75
SHA1

3921a76e6971773c38145c1454847c7fd8cf20f0
SHA256

1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25
SHA512

a93fed1b66cd0e903fd9d0363dcd8ef9b84af4cf9c79c17dd260574077306697b86271c975e1d66c6e4bc12c5b6423bd2b92f3cc6b11276c4ec5707a4ae722a2
SSDEEP

24576:TycPs6HJm3H6iA7IpSoY/29knp9lY58UZlKQxNmp73g:mZMEJB9Up9lclKQxQp7

Score

10^/10

healer redline diza discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.122:19062

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4140-22-0x0000000000390000-0x000000000039A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9370770.exe	family_redline
behavioral1/memory/4884-30-0x0000000000B20000-0x0000000000B4A000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 4 IoCs

Processes:

y1481756.exey5938721.exek5132050.exel9370770.exe

pid process

4676 y1481756.exe
4852 y5938721.exe
3704 k5132050.exe
4884 l9370770.exe

pid	process
4676	y1481756.exe
4852	y5938721.exe
3704	k5132050.exe
4884	l9370770.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exey1481756.exey5938721.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1481756.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5938721.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

k5132050.exe

description pid process target process

PID 3704 set thread context of 4140 3704 k5132050.exe AppLaunch.exe

description	pid	process	target process
PID 3704 set thread context of 4140	3704	k5132050.exe	AppLaunch.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AppLaunch.exel9370770.exe1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exey1481756.exey5938721.exek5132050.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l9370770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1481756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y5938721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k5132050.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

4140 AppLaunch.exe
4140 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4140 AppLaunch.exe

pid	process
4140	AppLaunch.exe
4140	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4140	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exey1481756.exey5938721.exek5132050.exe

description	pid	process	target process
PID 4660 wrote to memory of 4676	4660	1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe	y1481756.exe
PID 4660 wrote to memory of 4676	4660	1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe	y1481756.exe
PID 4660 wrote to memory of 4676	4660	1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe	y1481756.exe
PID 4676 wrote to memory of 4852	4676	y1481756.exe	y5938721.exe
PID 4676 wrote to memory of 4852	4676	y1481756.exe	y5938721.exe
PID 4676 wrote to memory of 4852	4676	y1481756.exe	y5938721.exe
PID 4852 wrote to memory of 3704	4852	y5938721.exe	k5132050.exe
PID 4852 wrote to memory of 3704	4852	y5938721.exe	k5132050.exe
PID 4852 wrote to memory of 3704	4852	y5938721.exe	k5132050.exe
PID 3704 wrote to memory of 4140	3704	k5132050.exe	AppLaunch.exe
PID 3704 wrote to memory of 4140	3704	k5132050.exe	AppLaunch.exe
PID 3704 wrote to memory of 4140	3704	k5132050.exe	AppLaunch.exe
PID 3704 wrote to memory of 4140	3704	k5132050.exe	AppLaunch.exe
PID 3704 wrote to memory of 4140	3704	k5132050.exe	AppLaunch.exe
PID 4852 wrote to memory of 4884	4852	y5938721.exe	l9370770.exe
PID 4852 wrote to memory of 4884	4852	y5938721.exe	l9370770.exe
PID 4852 wrote to memory of 4884	4852	y5938721.exe	l9370770.exe

C:\Users\Admin\AppData\Local\Temp\1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe
"C:\Users\Admin\AppData\Local\Temp\1d94542113f46242881a6bd5a56490747173eb0830468d496b5f4e0c16812a25.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1481756.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1481756.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5938721.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5938721.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5132050.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5132050.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
5⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9370770.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9370770.exe
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1481756.exe

Filesize
601KB

MD5
b76021b826789a1078f1a169d7ba3bf1

SHA1
1b5a0882b6f60ae0c9e08f42251da5c206486054

SHA256
583599948674ae3c331e0fa326eca17649f6985db9fe9dc33a1e13ee8c89006b

SHA512
8bd996b0cce24d8734962378bdc59b04b066a9ccad6ed8dc78a4e55f9c794c5fb05ddd78102936843c610fa76e4383ab76acc981d9cb0d4a25c42242184731b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5938721.exe

Filesize
276KB

MD5
fe978fb73ba3f7aaa88213d0be900562

SHA1
b7db5cb3f74bc967f7a3d18d6f17947442a68aec

SHA256
4188590754416459652388a4ce2dae03bc9b5d919520d6937829fb9dbf41aa5f

SHA512
372572214147f9a98fa7c9aadfd15395814fa9b358ccfbe01c0beef61173fe9adee84f4feae1fca4776bd0ad47b744a9649b213eefbff9c010fb447a5a4be1f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5132050.exe

Filesize
194KB

MD5
fa8319afaec78b0db6d80523cdeedad7

SHA1
8d957dde2ee592150fc23850e74d8d33abc126b0

SHA256
76df42bffba49df2910516f442f6f5328bf614f608813b4c9e059306f755e23f

SHA512
461a7eb7312b63d73eed1a556cd725d7ee55c40f096bfe80072c8a909c26e3d93ee96c7c68ae21d0c76936157c570a8dd6d6d9ea9729d380e344e91ddbd1e485

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9370770.exe

Filesize
146KB

MD5
16b024c0f5354d90ab50c89318b8e995

SHA1
3b0ec005128e278541a43bd8b4184e87967da8a4

SHA256
370dcb48a26bc438bc6aa5c00c94dece4c44881b434061af75d7ae4cb9a68f88

SHA512
a594e8a445b59842cecc9eb4e3fe006bc199a838906acaa78306992df8c01bdef7318f1205ce119f246b7d57bd6f1264c1bb8996173508ea5240c0eca3e7f1d4

Download Submit
memory/4140-22-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/4884-30-0x0000000000B20000-0x0000000000B4A000-memory.dmp

Filesize
168KB

Download
memory/4884-31-0x0000000005AB0000-0x00000000060C8000-memory.dmp

Filesize
6.1MB

Download
memory/4884-32-0x00000000055F0000-0x00000000056FA000-memory.dmp

Filesize
1.0MB

Download
memory/4884-33-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/4884-34-0x0000000005590000-0x00000000055CC000-memory.dmp

Filesize
240KB

Download
memory/4884-35-0x0000000005700000-0x000000000574C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads