healer | 00be67d21d44f49d4125db1a807933338549ac8f8073e86431e55548939f88af

General

Target

24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe
Size

738KB
MD5

ec7fcaaed32badde93aeec8063479448
SHA1

9ee7c1b819f6641c2c096f5f1b79cf93d377a606
SHA256

24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58
SHA512

59674b5b169f0b323a9db630e007662526ae1271ac085c4eb61d09cf00c98c1315d535077480b8bb03a22de755b74f75ed1f9e32a4cb7d17b15df755c7b29ad3
SSDEEP

12288:DMrLy90xCiqfVY/zfy6gbBmcgIMmP8OtjyscNPmEX0GvOYWDAW:IyGk+OMDmWsqd0kW

Score

10^/10

healer redline diza discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4804-29-0x0000000000400000-0x000000000040A000-memory.dmp	healer
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5097748.exe	healer
behavioral1/memory/5092-37-0x0000000000FF0000-0x0000000000FFA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

k5097748.exeAppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5097748.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5097748.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5097748.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5097748.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5097748.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5097748.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7424890.exe	family_redline
behavioral1/memory/3300-43-0x0000000000130000-0x0000000000160000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 6 IoCs

Processes:

y1438751.exey2454165.exey1180438.exej2786280.exek5097748.exel7424890.exe

pid process

3536 y1438751.exe
2892 y2454165.exe
4904 y1180438.exe
2808 j2786280.exe
5092 k5097748.exe
3300 l7424890.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

k5097748.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k5097748.exe

pid	process
3536	y1438751.exe
2892	y2454165.exe
4904	y1180438.exe
2808	j2786280.exe
5092	k5097748.exe
3300	l7424890.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5097748.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exey1438751.exey2454165.exey1180438.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1438751.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y2454165.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	y1180438.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

j2786280.exe

description pid process target process

PID 2808 set thread context of 4804 2808 j2786280.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4560 2808 WerFault.exe j2786280.exe

description	pid	process	target process
PID 2808 set thread context of 4804	2808	j2786280.exe	AppLaunch.exe

pid	pid_target	process	target process
4560	2808	WerFault.exe	j2786280.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exey1438751.exey2454165.exey1180438.exej2786280.exeAppLaunch.exel7424890.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1438751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y2454165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1180438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j2786280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7424890.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

AppLaunch.exek5097748.exe

pid process

4804 AppLaunch.exe
4804 AppLaunch.exe
5092 k5097748.exe
5092 k5097748.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AppLaunch.exek5097748.exe

description pid process

Token: SeDebugPrivilege 4804 AppLaunch.exe
Token: SeDebugPrivilege 5092 k5097748.exe

pid	process
4804	AppLaunch.exe
4804	AppLaunch.exe
5092	k5097748.exe
5092	k5097748.exe

description	pid	process
Token: SeDebugPrivilege	4804	AppLaunch.exe
Token: SeDebugPrivilege	5092	k5097748.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exey1438751.exey2454165.exey1180438.exej2786280.exe

description	pid	process	target process
PID 3928 wrote to memory of 3536	3928	24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe	y1438751.exe
PID 3928 wrote to memory of 3536	3928	24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe	y1438751.exe
PID 3928 wrote to memory of 3536	3928	24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe	y1438751.exe
PID 3536 wrote to memory of 2892	3536	y1438751.exe	y2454165.exe
PID 3536 wrote to memory of 2892	3536	y1438751.exe	y2454165.exe
PID 3536 wrote to memory of 2892	3536	y1438751.exe	y2454165.exe
PID 2892 wrote to memory of 4904	2892	y2454165.exe	y1180438.exe
PID 2892 wrote to memory of 4904	2892	y2454165.exe	y1180438.exe
PID 2892 wrote to memory of 4904	2892	y2454165.exe	y1180438.exe
PID 4904 wrote to memory of 2808	4904	y1180438.exe	j2786280.exe
PID 4904 wrote to memory of 2808	4904	y1180438.exe	j2786280.exe
PID 4904 wrote to memory of 2808	4904	y1180438.exe	j2786280.exe
PID 2808 wrote to memory of 4804	2808	j2786280.exe	AppLaunch.exe
PID 2808 wrote to memory of 4804	2808	j2786280.exe	AppLaunch.exe
PID 2808 wrote to memory of 4804	2808	j2786280.exe	AppLaunch.exe
PID 2808 wrote to memory of 4804	2808	j2786280.exe	AppLaunch.exe
PID 2808 wrote to memory of 4804	2808	j2786280.exe	AppLaunch.exe
PID 4904 wrote to memory of 5092	4904	y1180438.exe	k5097748.exe
PID 4904 wrote to memory of 5092	4904	y1180438.exe	k5097748.exe
PID 2892 wrote to memory of 3300	2892	y2454165.exe	l7424890.exe
PID 2892 wrote to memory of 3300	2892	y2454165.exe	l7424890.exe
PID 2892 wrote to memory of 3300	2892	y2454165.exe	l7424890.exe

C:\Users\Admin\AppData\Local\Temp\24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe
"C:\Users\Admin\AppData\Local\Temp\24eb6393c2efe3f2e9526f6d344af6fc709ae52125c0da80b2951a0412855b58.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1438751.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1438751.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2454165.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2454165.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1180438.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1180438.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j2786280.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j2786280.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 148
6⤵
- Program crash
PID:4560

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5097748.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5097748.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7424890.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7424890.exe
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2808 -ip 2808
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1438751.exe

Filesize
531KB

MD5
c1b5eb6fe3c3a6293a76b68b36dc5f66

SHA1
5a098a64d95d6bfd7a559351292cf50926be04ec

SHA256
b3d15c54cbd62e59e98a2aedc9dd33f4d0a1bec4e41ea1e8f30adcb1f7f1d8d6

SHA512
7ad1608e5d1a8e7d88dff01a4aec69ceb7ebadcb545af096755e69212a66d95aa64a476c556d2854e7e00da72cbcf12b8a8135f0f834450ec0581180e9af714d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2454165.exe

Filesize
359KB

MD5
3869d058e666f265621804f6f1f55250

SHA1
055b335402a7f8a12bbeb37d771fb741a925e4e8

SHA256
09a5b8c3360f0a7bc2c548607528ee1ebaf9279b7a3194cfde75f230d533be6a

SHA512
8e791e8bfc6d00ca3cb49a1f9291f6992a2e5e033a60cbf4198b7b3433b00a40231e97a02340681d6522a6dbd419f01090f27df3f2783c85788eb8582a2f6a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7424890.exe

Filesize
172KB

MD5
d9d12a3fe7646b55bf1dc90dcd2fc7ca

SHA1
4329deb806b1cb413dc3da9643c8f464d3eb5e1a

SHA256
f85238bb11fd95dc9a70423a9d4dbc0c6b977d0361901532cbdd4ffd48da5af2

SHA512
1e37abcfe90f43ed81b72985240c2769a0fe3a9148d74ab478ff8af6ccef1b1120c36965f48c8bdd47b83ec254d387d199a2dbedb8371990f1ecf8c34af49135

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1180438.exe

Filesize
203KB

MD5
34cb546c1659d66b158fe9dfd01b9898

SHA1
8af9a1cf609a423e7292c6d57551926eab23b768

SHA256
e9fb77aedbb389bf644c681d61de08802de05c43c8e0b1a5fbca8b3269916d7b

SHA512
546edabd551421d08a617c19cd1ddf0d453a7a4f36e99de325a43e6a895a3a1778be8103d9b408fddfb6ace3783e8c4fe2cfa5763e7179b0ec1b5c4f67be82ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j2786280.exe

Filesize
120KB

MD5
2c48df9fbdb8a4065871f42eb941e526

SHA1
92089e669cdeeb6e6e600efc0eb6cb7b424b8db0

SHA256
11e977f6d52866ae85226375bd0c42a71237a0071a644bc1dc97a85cff4f1932

SHA512
d41b2d5752ebf7b6eb121325e9f5a9f6fa40c85ddbc8a5d9f5c5c654ae8b73fea604d593cabe61a05ade8b71acfe39f4b1b6676d024433d537d6fef32c7c23a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k5097748.exe

Filesize
14KB

MD5
ddd4728533edcead5e6b148eef6bdeae

SHA1
a150121332b69b8f05f0acab8237a4c13f98ab2d

SHA256
60f186f18ebf1ef1476334f747a19e5c210aeeee04f653f1464044c489b9714e

SHA512
936efaceec24d3ee543a738b84dc87812d9ba4d1825a2cab892af6d2f9399c4deacc1994adb0e4e6c705fbc2bda7b19ba6aa8e305e61e10abf7cc2c3575e1aec

Download Submit
memory/3300-44-0x00000000024C0000-0x00000000024C6000-memory.dmp

Filesize
24KB

Download
memory/3300-43-0x0000000000130000-0x0000000000160000-memory.dmp

Filesize
192KB

Download
memory/3300-45-0x000000000A5B0000-0x000000000ABC8000-memory.dmp

Filesize
6.1MB

Download
memory/3300-46-0x000000000A0E0000-0x000000000A1EA000-memory.dmp

Filesize
1.0MB

Download
memory/3300-47-0x000000000A020000-0x000000000A032000-memory.dmp

Filesize
72KB

Download
memory/3300-48-0x000000000A080000-0x000000000A0BC000-memory.dmp

Filesize
240KB

Download
memory/3300-49-0x00000000022C0000-0x000000000230C000-memory.dmp

Filesize
304KB

Download
memory/4804-29-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5092-37-0x0000000000FF0000-0x0000000000FFA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads