healer | a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89

General

Target

a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe
Size

478KB
MD5

7f90b63f8b54e68ccba7dc9131412a63
SHA1

47431dd8d400987a42826b558c1cea2d06d70ca8
SHA256

a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89
SHA512

ad4cc9d54459b7c0a476aa5caf304be329ad74ab2fe9f2fa77f5cf5d747ada0c36e4d2ad6e2920478d2910518ee1b4deaf0ce49600d819c71a53e4aa26233959
SSDEEP

12288:oMrTy90FfwwSLlqgkLxTj3rbe0row8VwH8Y+M1f:7ysf2KxTj3PeIsVwHLf

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3916-15-0x0000000002570000-0x000000000258A000-memory.dmp	healer
behavioral1/memory/3916-18-0x0000000004F50000-0x0000000004F68000-memory.dmp	healer
behavioral1/memory/3916-25-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-23-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-41-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-47-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-45-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-43-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-39-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-38-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-36-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-33-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-32-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-29-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-27-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-21-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer
behavioral1/memory/3916-20-0x0000000004F50000-0x0000000004F62000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k3948435.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k3948435.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k3948435.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k3948435.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k3948435.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k3948435.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023bfb-55.dat	family_redline
behavioral1/memory/1584-56-0x0000000000B10000-0x0000000000B40000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2168	y4116050.exe
3916	k3948435.exe
1584	l9891705.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k3948435.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k3948435.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4116050.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y4116050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3948435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l9891705.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3916	k3948435.exe
3916	k3948435.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	k3948435.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2168	5016	a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe	83
PID 5016 wrote to memory of 2168	5016	a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe	83
PID 5016 wrote to memory of 2168	5016	a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe	83
PID 2168 wrote to memory of 3916	2168	y4116050.exe	84
PID 2168 wrote to memory of 3916	2168	y4116050.exe	84
PID 2168 wrote to memory of 3916	2168	y4116050.exe	84
PID 2168 wrote to memory of 1584	2168	y4116050.exe	94
PID 2168 wrote to memory of 1584	2168	y4116050.exe	94
PID 2168 wrote to memory of 1584	2168	y4116050.exe	94

C:\Users\Admin\AppData\Local\Temp\a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe
"C:\Users\Admin\AppData\Local\Temp\a0bfe7cf1c38719a6440de4f51a1ddd77010c24703cbad5fcabd4ca83780ac89.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4116050.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4116050.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3948435.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3948435.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9891705.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9891705.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4116050.exe

Filesize
307KB

MD5
8cf192195deef098007820e972ca07b7

SHA1
f8911b50bbc6c3ee1a9a3a6c2840ef1e60754f3b

SHA256
ba6ebb7b18952a4b49bd2609942fdaf6ee275863c21eb425fc170484eac6e9f3

SHA512
6a888e9fd9b2c0d927a09f4d4c8bcf3da5662bbafe388b3843196c284e490f77471166a89a9f134c95f44f32b7bb97a03106037a87b483d62dcf1a33b30add83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3948435.exe

Filesize
180KB

MD5
b82c9916693a423811c1e7ba4f65dacf

SHA1
cab4a4f695d47e198f54828d06d7e2d56a281a76

SHA256
62fd2cfc0e05cca33b16a3486c4e09632d6c3c1a6a26b5f05a072c569ed2024a

SHA512
ee5a5776a57d47dfb115c45b12a42e11e64ddead02134967e295b7140bf6a1d4d1449f874aee663151696ab712710a372eb6c2354c5e5514522e1d753b9acdb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l9891705.exe

Filesize
168KB

MD5
485796a3239cfe50b186f0d947aa943a

SHA1
c9235b03d0b356beaad8992b92c1b430fc6f8fd6

SHA256
e0129b7aeac45e3375e7e4ec2bc5cfa4f27243bb5b19363ebba6d12b0fc26a0d

SHA512
e0abfac12f7404ab1b05848e6f0f5b05a6d4ea12d70fc7bb7ced069726ba675e9ee131bb5be6f9c6b7ed8505e35d9bf1149f1d0b36647e24dac43b60b6b7b281

Download Submit
memory/1584-62-0x0000000004DD0000-0x0000000004E1C000-memory.dmp

Filesize
304KB

Download
memory/1584-61-0x000000000A910000-0x000000000A94C000-memory.dmp

Filesize
240KB

Download
memory/1584-60-0x000000000A8B0000-0x000000000A8C2000-memory.dmp

Filesize
72KB

Download
memory/1584-59-0x000000000A980000-0x000000000AA8A000-memory.dmp

Filesize
1.0MB

Download
memory/1584-58-0x000000000AE20000-0x000000000B438000-memory.dmp

Filesize
6.1MB

Download
memory/1584-56-0x0000000000B10000-0x0000000000B40000-memory.dmp

Filesize
192KB

Download
memory/1584-57-0x0000000005330000-0x0000000005336000-memory.dmp

Filesize
24KB

Download
memory/3916-38-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-20-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-47-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-45-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-43-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-39-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-41-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-36-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-33-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-32-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-29-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-27-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-21-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-48-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-49-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

Filesize
4KB

Download
memory/3916-50-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-52-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-23-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-25-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/3916-19-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-18-0x0000000004F50000-0x0000000004F68000-memory.dmp

Filesize
96KB

Download
memory/3916-17-0x00000000049A0000-0x0000000004F44000-memory.dmp

Filesize
5.6MB

Download
memory/3916-16-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-15-0x0000000002570000-0x000000000258A000-memory.dmp

Filesize
104KB

Download
memory/3916-14-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads