healer | 7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45

General

Target

7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe
Size

481KB
MD5

a43340ee16566b82a02b386a990303c3
SHA1

8c3b595315c3ede1a6af09d8093f7c036d155a6c
SHA256

7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45
SHA512

4b975efc425b47df5a843d77a0fc15d4227714fe013701859b0391579624be7644e9fb0602ca67fb4a968c9d1ee51e264ea9480066439dff8a195239616f006a
SSDEEP

12288:OMrby900pp67Odct74P48cguqmhC+OZ2xAc1:NyJiYc1SjRuqmsV4X

Score

10^/10

healer redline mihan discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes

auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3548-15-0x00000000022B0000-0x00000000022CA000-memory.dmp	healer
behavioral1/memory/3548-18-0x0000000002490000-0x00000000024A8000-memory.dmp	healer
behavioral1/memory/3548-42-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-46-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-44-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-40-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-38-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-32-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-30-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-19-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-36-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-34-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-28-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-26-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-24-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-22-0x0000000002490000-0x00000000024A2000-memory.dmp	healer
behavioral1/memory/3548-20-0x0000000002490000-0x00000000024A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2869051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2869051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2869051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2869051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2869051.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a2869051.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c8a-53.dat	family_redline
behavioral1/memory/656-55-0x0000000000740000-0x0000000000770000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3184	v0500868.exe
3548	a2869051.exe
656	b2510737.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a2869051.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2869051.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0500868.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0500868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2869051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2510737.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3548	a2869051.exe
3548	a2869051.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	a2869051.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3184	2460	7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe	83
PID 2460 wrote to memory of 3184	2460	7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe	83
PID 2460 wrote to memory of 3184	2460	7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe	83
PID 3184 wrote to memory of 3548	3184	v0500868.exe	84
PID 3184 wrote to memory of 3548	3184	v0500868.exe	84
PID 3184 wrote to memory of 3548	3184	v0500868.exe	84
PID 3184 wrote to memory of 656	3184	v0500868.exe	92
PID 3184 wrote to memory of 656	3184	v0500868.exe	92
PID 3184 wrote to memory of 656	3184	v0500868.exe	92

C:\Users\Admin\AppData\Local\Temp\7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe
"C:\Users\Admin\AppData\Local\Temp\7755f0d3338c6a3f0541e9f44b7d9a9119f4f56c7ecc4ab759f08b342b757a45.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0500868.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0500868.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2869051.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2869051.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2510737.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2510737.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0500868.exe

Filesize
309KB

MD5
48beeb93792358a312a5f5d1e6760fae

SHA1
0a958810501cb1578170f9cb7c1fdaf8bec480b7

SHA256
af3c18baa1e3c521970f64e159182b0ec4f72131d365f2cd2658fa9cb549875f

SHA512
4c49d281891b181ed51d5ed886a89ad34128a14073a9c6f971f9851c481f077affea580112f07def29e49c924000e23cbd93b6c995952d18a0ecc8b62a5a7a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2869051.exe

Filesize
179KB

MD5
da48c000a9b937cf2f4b2f65bef59a28

SHA1
5150e3045e288637881878a0a305e02c33b8e7b9

SHA256
eebcbdcde5a5d5d69442e7061e7604a83cc0f29b19a33446e0a7089bc8a4a16c

SHA512
4ecc4c3f74d0dad740e6cd382d76379920a919276843db288269f98b7b58720286047b0e4febc1868c2192cb9dc7bd69607ce6c0b413f2dc0ebcf0f825c7b2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2510737.exe

Filesize
168KB

MD5
5544af5f8fc01bd9cdc7d3bdb81460ec

SHA1
3afbd581ee1c7edb6d92a9ff9afebc5bc2ea83b7

SHA256
471e6a9c73ace63179967e12bfbcda404802b40bcd4e5767d324467e7fce3a50

SHA512
92312229932750d6e71e080c3f31b0eba3a480851bf61827136723b6c81a1c24562bdc189bba50dd6ece2ce3564318321b8a0cfb3af3845a56b77963183fc3c1

Download Submit
memory/656-61-0x00000000053E0000-0x000000000542C000-memory.dmp

Filesize
304KB

Download
memory/656-60-0x0000000005260000-0x000000000529C000-memory.dmp

Filesize
240KB

Download
memory/656-59-0x0000000005200000-0x0000000005212000-memory.dmp

Filesize
72KB

Download
memory/656-58-0x00000000052D0000-0x00000000053DA000-memory.dmp

Filesize
1.0MB

Download
memory/656-57-0x0000000005790000-0x0000000005DA8000-memory.dmp

Filesize
6.1MB

Download
memory/656-56-0x0000000005020000-0x0000000005026000-memory.dmp

Filesize
24KB

Download
memory/656-55-0x0000000000740000-0x0000000000770000-memory.dmp

Filesize
192KB

Download
memory/3548-34-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-20-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-32-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-30-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-19-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-36-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-40-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-28-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-26-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-24-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-22-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-38-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-47-0x0000000074370000-0x0000000074B20000-memory.dmp

Filesize
7.7MB

Download
memory/3548-48-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/3548-49-0x0000000074370000-0x0000000074B20000-memory.dmp

Filesize
7.7MB

Download
memory/3548-51-0x0000000074370000-0x0000000074B20000-memory.dmp

Filesize
7.7MB

Download
memory/3548-44-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-46-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-42-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/3548-16-0x0000000074370000-0x0000000074B20000-memory.dmp

Filesize
7.7MB

Download
memory/3548-18-0x0000000002490000-0x00000000024A8000-memory.dmp

Filesize
96KB

Download
memory/3548-17-0x0000000004A80000-0x0000000005024000-memory.dmp

Filesize
5.6MB

Download
memory/3548-15-0x00000000022B0000-0x00000000022CA000-memory.dmp

Filesize
104KB

Download
memory/3548-14-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads