healer | c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e

General

Target

c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe
Size

479KB
MD5

45295f77f300c5768ab60898ce152eac
SHA1

968587f2660b67caa4694ca0183ea83810b77a16
SHA256

c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e
SHA512

52e2794caca5750d775eb6a675dc446750f078b2ce98ab49bec315613568a430feb28389f430e9776650e8d114d233926eb4f4d6421c0a4c8217aae887426b56
SSDEEP

12288:mMrfy90zlXpqaZ9LWWiwvwub49Jr5IOw0d5UygNzc8hln:py0BE0WWeuE9Jvwqv25hR

Score

10^/10

healer redline maher discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maher

C2

217.196.96.101:4132

Attributes

auth_value
c57763165f68aabcf4874e661a1ffbac

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2248-15-0x0000000002370000-0x000000000238A000-memory.dmp	healer
behavioral1/memory/2248-18-0x0000000004940000-0x0000000004958000-memory.dmp	healer
behavioral1/memory/2248-21-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-47-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-45-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-43-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-42-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-39-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-37-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-35-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-33-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-32-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-29-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-27-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-25-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-23-0x0000000004940000-0x0000000004952000-memory.dmp	healer
behavioral1/memory/2248-20-0x0000000004940000-0x0000000004952000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1067743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1067743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1067743.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1067743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1067743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1067743.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cc1-54.dat	family_redline
behavioral1/memory/1152-55-0x0000000000E40000-0x0000000000E70000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3508	v4476406.exe
2248	a1067743.exe
1152	b2815359.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1067743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1067743.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4476406.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4476406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1067743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2815359.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	a1067743.exe
2248	a1067743.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	a1067743.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3508	4196	c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe	83
PID 4196 wrote to memory of 3508	4196	c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe	83
PID 4196 wrote to memory of 3508	4196	c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe	83
PID 3508 wrote to memory of 2248	3508	v4476406.exe	84
PID 3508 wrote to memory of 2248	3508	v4476406.exe	84
PID 3508 wrote to memory of 2248	3508	v4476406.exe	84
PID 3508 wrote to memory of 1152	3508	v4476406.exe	94
PID 3508 wrote to memory of 1152	3508	v4476406.exe	94
PID 3508 wrote to memory of 1152	3508	v4476406.exe	94

C:\Users\Admin\AppData\Local\Temp\c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe
"C:\Users\Admin\AppData\Local\Temp\c44b5f07ce8980c674186a1212bbe9f96143cbf3b5ded9206cdebc8a6760c71e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4476406.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4476406.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1067743.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1067743.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2815359.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2815359.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4476406.exe

Filesize
307KB

MD5
eaf7833f0eb2e71b6fc26a31ec1cb738

SHA1
7d143f95c7b0c8d6cfaeb51ae36f47a2ad45760c

SHA256
3bca7be44aac27727facc2b7eb76386312d51d7ac6d61551237fa55a7e2f88b7

SHA512
db6d7e18c066509e311b0277d5be9a79c7ef6a7c7f6ba2df15e93b0eb55455e927ba55663807df9e63437e195e3277ed93237e92e9acf151bd2174cf83a69432

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1067743.exe

Filesize
179KB

MD5
2d7f2654d60549d15a1b6b4ecdd03487

SHA1
e06a9253dc4c777b738f2287a5a3c65b5752aaf6

SHA256
7258870b9e71727605e365d56b576754a80c75decb1308380f493398c28bbb1b

SHA512
2566bf01f93632cd3277a47632fd357afd568d71d31ab234d516803eb6311d752454f5ae952c6018f739480bad06a2fa3100435b7e706d3c266efd43226cfd19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2815359.exe

Filesize
168KB

MD5
dc43a2d0b8dc8f88c14d07203b50aaac

SHA1
551c76f7f1c03b5392a521f45c19c933f4f018a3

SHA256
f0b6d1a161eb9917d0fef4cc4a71dfaa4eafcc02693e51825eea97ec4e9268ef

SHA512
ed29823c2411b46c4246b2291c4d23b63914429c887f8829e2712161de36a5f217ade791be64c238c23063359923825931947edf1392ad4191909537f0a78121

Download Submit
memory/1152-61-0x00000000059A0000-0x00000000059EC000-memory.dmp

Filesize
304KB

Download
memory/1152-60-0x0000000005820000-0x000000000585C000-memory.dmp

Filesize
240KB

Download
memory/1152-59-0x00000000057C0000-0x00000000057D2000-memory.dmp

Filesize
72KB

Download
memory/1152-58-0x0000000005890000-0x000000000599A000-memory.dmp

Filesize
1.0MB

Download
memory/1152-57-0x0000000005DA0000-0x00000000063B8000-memory.dmp

Filesize
6.1MB

Download
memory/1152-56-0x0000000002FA0000-0x0000000002FA6000-memory.dmp

Filesize
24KB

Download
memory/1152-55-0x0000000000E40000-0x0000000000E70000-memory.dmp

Filesize
192KB

Download
memory/2248-33-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-23-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-42-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-39-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-37-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-35-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-45-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-32-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-29-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-27-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-25-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-43-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-20-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-48-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/2248-49-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-51-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-47-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-21-0x0000000004940000-0x0000000004952000-memory.dmp

Filesize
72KB

Download
memory/2248-19-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-18-0x0000000004940000-0x0000000004958000-memory.dmp

Filesize
96KB

Download
memory/2248-17-0x0000000004980000-0x0000000004F24000-memory.dmp

Filesize
5.6MB

Download
memory/2248-16-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/2248-15-0x0000000002370000-0x000000000238A000-memory.dmp

Filesize
104KB

Download
memory/2248-14-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads