healer | 858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d

General

Target

858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe
Size

479KB
MD5

b65ba213bf6968648ed76413db04d3aa
SHA1

6c79bdf80f64c47373285f8e5e5bb3bb0b2dae1d
SHA256

858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d
SHA512

ff565ea3f1e0aa9297619f7b8645d15cd4c8bfea2844d15c651fcbd256393d37e536f7406a3dd7e327d8e8ce1a2f405be7a04510356363fb6f279521d898ef82
SSDEEP

12288:cMrGy90PSWAxRPqKTz/Gd1G215k2pGxAwH42cwLdUk:qyQKRyyzed1Z5kqgAwH1XdUk

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1048-15-0x0000000002500000-0x000000000251A000-memory.dmp	healer
behavioral1/memory/1048-19-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral1/memory/1048-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-48-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/1048-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k1187902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1187902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1187902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1187902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1187902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1187902.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023bbd-54.dat	family_redline
behavioral1/memory/1824-56-0x0000000000B60000-0x0000000000B90000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
5020	y0659954.exe
1048	k1187902.exe
1824	l0394628.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k1187902.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1187902.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0659954.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y0659954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1187902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l0394628.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1048	k1187902.exe
1048	k1187902.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	k1187902.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 5020	4524	858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe	84
PID 4524 wrote to memory of 5020	4524	858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe	84
PID 4524 wrote to memory of 5020	4524	858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe	84
PID 5020 wrote to memory of 1048	5020	y0659954.exe	85
PID 5020 wrote to memory of 1048	5020	y0659954.exe	85
PID 5020 wrote to memory of 1048	5020	y0659954.exe	85
PID 5020 wrote to memory of 1824	5020	y0659954.exe	93
PID 5020 wrote to memory of 1824	5020	y0659954.exe	93
PID 5020 wrote to memory of 1824	5020	y0659954.exe	93

C:\Users\Admin\AppData\Local\Temp\858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe
"C:\Users\Admin\AppData\Local\Temp\858cf9d644850d120f8401fa1537e755ff91651d443844ae86d20a89c3ecf30d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0659954.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0659954.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1187902.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1187902.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0394628.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0394628.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0659954.exe

Filesize
307KB

MD5
7a7182c03f3f1b0a955695e3a84e6251

SHA1
2657ff8c1d163e6ac99737b11e1f7a3053343b83

SHA256
c672aaadc4be34ad3fc0c8108b0b7e32704442f1cf519c8ee1a640ff84abf00f

SHA512
e51f7330ee6abab1dd41b4bf038b76669ff386a7e9a4ff14856e47d6a0c6514b2c15a8e7bccc8361ea139aed5be69c8afa0a7b72c8a6e84b1b2cf38747b9d3cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1187902.exe

Filesize
179KB

MD5
4e9b8d7fadfd6ea203db9e6c079bb2fc

SHA1
d9309e9c3e362f3336aefc6a195776965a8350e2

SHA256
0fe2f972319c98e4b7023232b7cb061f5210371f213cfb83d98df943ccf22dfb

SHA512
cec32314c245369d5fda470b9f3db80c88856ac8901c62917b450964a5920d10e245292e27da1fc7bfb41b3c1d6af54fded3ceef8463d85ec3cc062f20e716a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0394628.exe

Filesize
168KB

MD5
965a28e49f0056c18645e6cefc5cd4e4

SHA1
76eb475df9e058d72891cdede4bf3a6c6042cad1

SHA256
42b9226e51b3de481b5014e8cfd517b1a4858af60e6c977fcd064d3c994b57f8

SHA512
f213455906ee1b8108c57b8b03948858ab8d12d900f41af417e0748bf860450d74f2e4513d89f11d43cd0f6579fc31ca54c014783b1dd66fa449e7b689f46f50

Download Submit
memory/1048-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-50-0x0000000074210000-0x00000000749C0000-memory.dmp

Filesize
7.7MB

Download
memory/1048-17-0x0000000004C40000-0x00000000051E4000-memory.dmp

Filesize
5.6MB

Download
memory/1048-19-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/1048-20-0x0000000074210000-0x00000000749C0000-memory.dmp

Filesize
7.7MB

Download
memory/1048-18-0x0000000074210000-0x00000000749C0000-memory.dmp

Filesize
7.7MB

Download
memory/1048-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-48-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-15-0x0000000002500000-0x000000000251A000-memory.dmp

Filesize
104KB

Download
memory/1048-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/1048-49-0x000000007421E000-0x000000007421F000-memory.dmp

Filesize
4KB

Download
memory/1048-16-0x0000000074210000-0x00000000749C0000-memory.dmp

Filesize
7.7MB

Download
memory/1048-52-0x0000000074210000-0x00000000749C0000-memory.dmp

Filesize
7.7MB

Download
memory/1048-14-0x000000007421E000-0x000000007421F000-memory.dmp

Filesize
4KB

Download
memory/1824-56-0x0000000000B60000-0x0000000000B90000-memory.dmp

Filesize
192KB

Download
memory/1824-57-0x0000000005340000-0x0000000005346000-memory.dmp

Filesize
24KB

Download
memory/1824-58-0x000000000AE80000-0x000000000B498000-memory.dmp

Filesize
6.1MB

Download
memory/1824-59-0x000000000A9D0000-0x000000000AADA000-memory.dmp

Filesize
1.0MB

Download
memory/1824-60-0x000000000A900000-0x000000000A912000-memory.dmp

Filesize
72KB

Download
memory/1824-61-0x000000000A960000-0x000000000A99C000-memory.dmp

Filesize
240KB

Download
memory/1824-62-0x0000000002E10000-0x0000000002E5C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads