healer | 81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d

General

Target

81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe
Size

479KB
MD5

6f30b008421fab1ccb48033a87708f22
SHA1

5c8f526083b540c8b1658d449356192f819eb1ad
SHA256

81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d
SHA512

5348d2fb6b3a093721b53055d63333fe52a2fbd941a63d06597cff2dae0eb58aa4caac062f0c6b73f4b2f551a5ac138678cc719728d280159152c4a6ac7c537b
SSDEEP

12288:sMrGy90LbymToQVoEX2lOpiyxnw6tZlnna2B:qyYumDoUN26DNna2B

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2760-15-0x00000000048E0000-0x00000000048FA000-memory.dmp	healer
behavioral1/memory/2760-18-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/2760-47-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-45-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-43-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-41-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-39-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-37-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-35-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-33-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-31-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-29-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-27-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-25-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-23-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-21-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/2760-20-0x0000000004980000-0x0000000004992000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k1433142.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k1433142.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k1433142.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k1433142.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k1433142.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k1433142.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cb7-55.dat	family_redline
behavioral1/memory/3000-56-0x0000000000F20000-0x0000000000F50000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4148	y2892229.exe
2760	k1433142.exe
3000	l9703665.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k1433142.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k1433142.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2892229.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y2892229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1433142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l9703665.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2760	k1433142.exe
2760	k1433142.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	k1433142.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4148	1132	81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe	83
PID 1132 wrote to memory of 4148	1132	81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe	83
PID 1132 wrote to memory of 4148	1132	81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe	83
PID 4148 wrote to memory of 2760	4148	y2892229.exe	84
PID 4148 wrote to memory of 2760	4148	y2892229.exe	84
PID 4148 wrote to memory of 2760	4148	y2892229.exe	84
PID 4148 wrote to memory of 3000	4148	y2892229.exe	100
PID 4148 wrote to memory of 3000	4148	y2892229.exe	100
PID 4148 wrote to memory of 3000	4148	y2892229.exe	100

C:\Users\Admin\AppData\Local\Temp\81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe
"C:\Users\Admin\AppData\Local\Temp\81e8a0ef9f5ab53837c1aabbcba309745866286bcd3b9360e9a2206e1215fb2d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2892229.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2892229.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1433142.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1433142.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9703665.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9703665.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2892229.exe

Filesize
307KB

MD5
958215b5f3bdf367eb77c07c373ea674

SHA1
3ca1771018313d937ee140030605e16a4773b3b1

SHA256
5d86bbba6c71ba7b69d4deb2a128a6d0ba9f7424966d4d1fb9e4691f672790fa

SHA512
cd7067bd8aacf1ae1750121df9e612e57d3fa5c36ab26068b462034b0db34590431d6dd523c35d1f17e06da363d70493c46d0e4b7bd24b3ef9819caca4e4485b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k1433142.exe

Filesize
180KB

MD5
801b681f8ec14592f1fe714bf54241e6

SHA1
a85800680e6c2fcb5b1fefffeb6952f36032c36a

SHA256
4e3260104a42c87120b3bc4dcb6ada317fe478f4583f364636ff6fcd39b23dd9

SHA512
a8874b9421253beffab64b001055bc45af175d03191e747d6528a360cae98008fe647d7a2c38a3e77aafd951a649f5a28b568b9b2d20b6561a7723c8867f1e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9703665.exe

Filesize
168KB

MD5
332712d5e97134a18c2545a1769c300f

SHA1
a543be0a760df3fb95fd6267383b3e384c8b09a5

SHA256
375d2f81e6319dfbc6ca57768a51a05e6d5d8d076d6dd2317d1ab2e002531ac8

SHA512
f771f5c92310380ee21e33700010b31b98408420324a7a7b9d0193157427d9264a6901d8e3cf99397e6f6d6a80605741d8be13a47e9e15d0e2ef00fec1287880

Download Submit
memory/2760-31-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-50-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/2760-17-0x0000000004AE0000-0x0000000005084000-memory.dmp

Filesize
5.6MB

Download
memory/2760-18-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/2760-47-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-45-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-25-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-41-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-39-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-48-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/2760-37-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-35-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-33-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-15-0x00000000048E0000-0x00000000048FA000-memory.dmp

Filesize
104KB

Download
memory/2760-29-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-27-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-43-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-23-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-21-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-20-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/2760-19-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/2760-49-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

Filesize
4KB

Download
memory/2760-16-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/2760-52-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/2760-14-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

Filesize
4KB

Download
memory/3000-56-0x0000000000F20000-0x0000000000F50000-memory.dmp

Filesize
192KB

Download
memory/3000-57-0x0000000002FC0000-0x0000000002FC6000-memory.dmp

Filesize
24KB

Download
memory/3000-58-0x0000000005E50000-0x0000000006468000-memory.dmp

Filesize
6.1MB

Download
memory/3000-59-0x0000000005970000-0x0000000005A7A000-memory.dmp

Filesize
1.0MB

Download
memory/3000-60-0x00000000058A0000-0x00000000058B2000-memory.dmp

Filesize
72KB

Download
memory/3000-61-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/3000-62-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads