healer | b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9

General

Target

b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe
Size

1.5MB
MD5

07c179e06979e84e5ce421dcaca17b22
SHA1

a55b98d4418b9fc37bef2108c44894a4daf2db26
SHA256

b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9
SHA512

9d8d8da61bb80d291f1e8cd6d303366a79f3cdea25305242266634b7a6e351242bec82c4db69542ede87475c854b871e6977519560325c3fc9e52dd891a64e07
SSDEEP

24576:WyoHvJtLV95K4OcECEoHU4il9AOCcusowdEopdV5ZqaP4s93Y8Fq3LtLNI:l+K4OcECHU4iXAnEtVzBPN9IiMB

Score

10^/10

healer redline mask discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mask

C2

217.196.96.56:4138

Attributes

auth_value
31aef25be0febb8e491794ef7f502c50

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1940-36-0x0000000002130000-0x000000000214A000-memory.dmp	healer
behavioral1/memory/1940-38-0x0000000004A30000-0x0000000004A48000-memory.dmp	healer
behavioral1/memory/1940-66-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-64-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-62-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-60-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-59-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-56-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-54-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-52-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-50-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-49-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-46-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-44-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-42-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-40-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer
behavioral1/memory/1940-39-0x0000000004A30000-0x0000000004A42000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8115325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8115325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8115325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a8115325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8115325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8115325.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ca8-71.dat	family_redline
behavioral1/memory/1092-73-0x0000000000750000-0x0000000000780000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
2224	v1834926.exe
1056	v9888858.exe
932	v8493290.exe
1796	v5537862.exe
1940	a8115325.exe
1092	b3379433.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8115325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a8115325.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1834926.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9888858.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8493290.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v5537862.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
460	1940	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v1834926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9888858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v8493290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5537862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8115325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3379433.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1940	a8115325.exe
1940	a8115325.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	a8115325.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2224	1960	b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe	83
PID 1960 wrote to memory of 2224	1960	b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe	83
PID 1960 wrote to memory of 2224	1960	b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe	83
PID 2224 wrote to memory of 1056	2224	v1834926.exe	84
PID 2224 wrote to memory of 1056	2224	v1834926.exe	84
PID 2224 wrote to memory of 1056	2224	v1834926.exe	84
PID 1056 wrote to memory of 932	1056	v9888858.exe	85
PID 1056 wrote to memory of 932	1056	v9888858.exe	85
PID 1056 wrote to memory of 932	1056	v9888858.exe	85
PID 932 wrote to memory of 1796	932	v8493290.exe	86
PID 932 wrote to memory of 1796	932	v8493290.exe	86
PID 932 wrote to memory of 1796	932	v8493290.exe	86
PID 1796 wrote to memory of 1940	1796	v5537862.exe	88
PID 1796 wrote to memory of 1940	1796	v5537862.exe	88
PID 1796 wrote to memory of 1940	1796	v5537862.exe	88
PID 1796 wrote to memory of 1092	1796	v5537862.exe	104
PID 1796 wrote to memory of 1092	1796	v5537862.exe	104
PID 1796 wrote to memory of 1092	1796	v5537862.exe	104

C:\Users\Admin\AppData\Local\Temp\b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe
"C:\Users\Admin\AppData\Local\Temp\b3aee4ad6b9ba9b3c36fa7248bfe9d62f45478b44756ae3ba3bc47db18fe5bb9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1834926.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1834926.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9888858.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9888858.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8493290.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8493290.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5537862.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5537862.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8115325.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8115325.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1020
        7⤵
        Program crash
        
        PID:460
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3379433.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3379433.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1940 -ip 1940
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1834926.exe

Filesize
1.3MB

MD5
c248dbf3fd9c5b45809e7c6072436fb9

SHA1
21acd13b41f7d3ac5603bb1c7aa2f58613ddc630

SHA256
1f6f463a9ee5dc76c76c23dbc1bdcf24b64f751efa9282b94912006ff0ad9e4c

SHA512
38e18eede4dd4d6b2fb44e65e105497a06479705821078ca13ac94c46745345b1d7b999560385334f640ce57866861ad0434b040954430354cae364563f2d819

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9888858.exe

Filesize
849KB

MD5
0f2b43f3773ca6f5ec7bf8072a539b21

SHA1
e0870e6204cf04641a013af7e1fa39e693aac080

SHA256
f0d9588b3ecc81d80cd4ac95f7af9924d8ebe159b9ba67493d0bfa24e5a76f38

SHA512
7bca954746287b13a804e00c81d84c42a89f26e78814a374900993bf326fe1c597f3cb499f4ba8f12c15fffb5ca64428ecb366a0ac842657ac5ef8ea55ad705c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8493290.exe

Filesize
645KB

MD5
9faf8aa2ab7d733f15ec07190fd4d672

SHA1
55e6c29156945a8db7a6fabc6fbde9335d2758d2

SHA256
1cfe2698d660784457c65750a2245b1ed537126ddec90d7e4e61893b128c1199

SHA512
a44b34af0ca24ad22a9da9867cbae765b22726986d22187677f77c35401bb15a7d32142321e52473e87842c346de70f089deab6c3f96418f28174cdf7bc1c972

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5537862.exe

Filesize
385KB

MD5
5d8c4f7ddd96b3891a15d07e5bcf0c6b

SHA1
288da854e749fe883e2ce28eb2ff65f30fa93f39

SHA256
66b40da26fd893ebf54e8406bb1657b84b240d9622d3a3466dfe0b58c477f1cb

SHA512
76dedcc1b3eac8133bfc05be62ca79d8c6872c1992dbc8069049b71c6d2c7f28b89adcbe5eb9c5af91332859d8059d1c9e3912a697fa12f32d6a05fdb8ae511b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a8115325.exe

Filesize
292KB

MD5
5b8547be1bf1eb20c4b06353d595205b

SHA1
36d39d88d0045da2e1c988ce8a19c6a8654ae5a1

SHA256
ce5be22eab8cf04b53e23e5b012520f73363c4a3893c6a2ac1096059fd11192c

SHA512
49455d59d189d73d83d8a647c33e7b76e6d5e1f58ba1de88c41a774261c23392adf163a6079d964f84be4008299a46e70578cc856a04c6774efa295cd0ddf904

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3379433.exe

Filesize
168KB

MD5
29393523494e258c26c9fa070a3017e2

SHA1
c2d93259d12cef83d2545f6f60f21a6cbaea266d

SHA256
47c10bcd923b8a79b0b361eb1a0fd6cf696f5320cdd2e0a6ff64a3150ca9d915

SHA512
ef9ef385a099b19e96505bd189a13486f76aa6dd23fe80b1d6034823df42d6a9d43a71dc90b68efbee791aa5f3d145112837995e63c95fd384d8927fb2273d68

Download Submit
memory/1092-78-0x0000000005140000-0x000000000517C000-memory.dmp

Filesize
240KB

Download
memory/1092-77-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/1092-76-0x0000000005250000-0x000000000535A000-memory.dmp

Filesize
1.0MB

Download
memory/1092-75-0x0000000005760000-0x0000000005D78000-memory.dmp

Filesize
6.1MB

Download
memory/1092-74-0x0000000004F70000-0x0000000004F76000-memory.dmp

Filesize
24KB

Download
memory/1092-73-0x0000000000750000-0x0000000000780000-memory.dmp

Filesize
192KB

Download
memory/1092-79-0x0000000005180000-0x00000000051CC000-memory.dmp

Filesize
304KB

Download
memory/1940-50-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-39-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-52-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-56-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-49-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-46-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-44-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-42-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-40-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-54-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1940-69-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1940-59-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-60-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-62-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-64-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-66-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/1940-38-0x0000000004A30000-0x0000000004A48000-memory.dmp

Filesize
96KB

Download
memory/1940-37-0x0000000004B40000-0x00000000050E4000-memory.dmp

Filesize
5.6MB

Download
memory/1940-36-0x0000000002130000-0x000000000214A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads