healer | 34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7

General

Target

34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe
Size

479KB
MD5

b67f1ec1c0b7a314ecaa929cf3b4f0a2
SHA1

47a86b0926fb133126eb18d196d4514a47124f47
SHA256

34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7
SHA512

1469c6390222e55d4c78d3ac90ebdb1143841c6618ebda3c7e781a0ccc1bc65c33c2db17673a56695c1d72620929f36c7345b6c226d25d2984773e7831d59d56
SSDEEP

12288:aMriy90LaQfVZF549SqutG8UryiGrkFY:EyW3FlGJrdFY

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4348-15-0x00000000007A0000-0x00000000007BA000-memory.dmp	healer
behavioral1/memory/4348-18-0x0000000002400000-0x0000000002418000-memory.dmp	healer
behavioral1/memory/4348-24-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-48-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-46-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-45-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-42-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-40-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-38-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-36-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-35-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-32-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-30-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-28-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-26-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-22-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/4348-21-0x0000000002400000-0x0000000002412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3071172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3071172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3071172.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k3071172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3071172.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3071172.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b7f-54.dat	family_redline
behavioral1/memory/4072-56-0x0000000000B80000-0x0000000000BB0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2396	y8217066.exe
4348	k3071172.exe
4072	l4204883.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3071172.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k3071172.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8217066.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4900	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8217066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3071172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l4204883.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	k3071172.exe
4348	k3071172.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	k3071172.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2396	4376	34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe	83
PID 4376 wrote to memory of 2396	4376	34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe	83
PID 4376 wrote to memory of 2396	4376	34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe	83
PID 2396 wrote to memory of 4348	2396	y8217066.exe	84
PID 2396 wrote to memory of 4348	2396	y8217066.exe	84
PID 2396 wrote to memory of 4348	2396	y8217066.exe	84
PID 2396 wrote to memory of 4072	2396	y8217066.exe	95
PID 2396 wrote to memory of 4072	2396	y8217066.exe	95
PID 2396 wrote to memory of 4072	2396	y8217066.exe	95

C:\Users\Admin\AppData\Local\Temp\34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe
"C:\Users\Admin\AppData\Local\Temp\34793038edf4653953d81b304aa92da360d25f9bfc3ae86f6d8508fbafc330a7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8217066.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8217066.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3071172.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3071172.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4204883.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4204883.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4072

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8217066.exe

Filesize
307KB

MD5
b6f6c0a25fa863bb5f841db949d82213

SHA1
7b3ad8d0b88a44a27c947c2af6d0178817b905ba

SHA256
9c6e9a9de1864c9ecba3b51078f6805d6b6327a09d5a1c868b13ea23cee9b391

SHA512
c17dd0027cf0a0a5b845b5135d47de4666d790c540439caff815fefaf317664c5a1b43760e888b9bd12d095153683acdd96973917f78c5f86953463ad61886b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3071172.exe

Filesize
180KB

MD5
394a8de77b85e5ba91f779f040b120d2

SHA1
11ddb045c415c9e36835a844ade85680084db937

SHA256
26302a6d875b3d0221a3af37b9f952c565e68e7f362065efb3567996cd785fe2

SHA512
ccd1b6fa9fa540bc7f59fb31af5858a861b9d4e3e0445bcfa879f86b79a3cf0876a415caab6608b8593bbc128f2d775666a8ac893a951382b784c6b6bc74990b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4204883.exe

Filesize
168KB

MD5
21bdab5b360b9ef266f054e39aca997d

SHA1
ccd992c85ec2d7f54c0f232d8eed60d506de70ca

SHA256
5d167d0af1818223f4f80209979d38cac433fdfc2ba68403ad79128dae466090

SHA512
e4ba06b34acdd6b44cfc6843271e203ced4be866c0127c87f999ce5a52600cf90904e93f6218441632f11184b09c2d2f564da833e947c4ad4922760485555c59

Download Submit
memory/4072-62-0x00000000056F0000-0x000000000573C000-memory.dmp

Filesize
304KB

Download
memory/4072-61-0x00000000056B0000-0x00000000056EC000-memory.dmp

Filesize
240KB

Download
memory/4072-60-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/4072-59-0x0000000005780000-0x000000000588A000-memory.dmp

Filesize
1.0MB

Download
memory/4072-58-0x0000000005C90000-0x00000000062A8000-memory.dmp

Filesize
6.1MB

Download
memory/4072-57-0x0000000002E50000-0x0000000002E56000-memory.dmp

Filesize
24KB

Download
memory/4072-56-0x0000000000B80000-0x0000000000BB0000-memory.dmp

Filesize
192KB

Download
memory/4348-36-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-21-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-45-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-42-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-40-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-38-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-48-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-35-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-32-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-30-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-28-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-26-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-22-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-46-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-49-0x000000007446E000-0x000000007446F000-memory.dmp

Filesize
4KB

Download
memory/4348-50-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4348-52-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4348-24-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/4348-20-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4348-19-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4348-17-0x0000000004AC0000-0x0000000005064000-memory.dmp

Filesize
5.6MB

Download
memory/4348-18-0x0000000002400000-0x0000000002418000-memory.dmp

Filesize
96KB

Download
memory/4348-16-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4348-15-0x00000000007A0000-0x00000000007BA000-memory.dmp

Filesize
104KB

Download
memory/4348-14-0x000000007446E000-0x000000007446F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads