healer | bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc

General

Target

bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe
Size

479KB
MD5

607ca93d67eae0147b0334139b093842
SHA1

99dd32025b27fd647ea5ff6c5183952aaadeadbc
SHA256

bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc
SHA512

f911069fcafaa86bdb09ef5321d256a2790650a90b6d3bc5572a1f87fe263c3fadf83b798d72bde1bba877e6ec42151adeff0baf42055c97a9cb6ced9d0594bb
SSDEEP

12288:bMrMy908le0CmP0isE+pIHXmro7fTYzvX8z1c2Ve:by60DPApIHXEobqviHs

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3928-15-0x0000000000950000-0x000000000096A000-memory.dmp	healer
behavioral1/memory/3928-19-0x0000000004990000-0x00000000049A8000-memory.dmp	healer
behavioral1/memory/3928-43-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-47-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-45-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-41-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-39-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-37-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-35-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-33-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-32-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-29-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-27-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-25-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-23-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-21-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3928-20-0x0000000004990000-0x00000000049A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5277360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5277360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5277360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5277360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5277360.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k5277360.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cc1-54.dat	family_redline
behavioral1/memory/4944-56-0x0000000000E20000-0x0000000000E50000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3352	y7858593.exe
3928	k5277360.exe
4944	l3572353.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k5277360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5277360.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7858593.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3008	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y7858593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k5277360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l3572353.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	k5277360.exe
3928	k5277360.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	k5277360.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3352	4576	bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe	85
PID 4576 wrote to memory of 3352	4576	bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe	85
PID 4576 wrote to memory of 3352	4576	bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe	85
PID 3352 wrote to memory of 3928	3352	y7858593.exe	86
PID 3352 wrote to memory of 3928	3352	y7858593.exe	86
PID 3352 wrote to memory of 3928	3352	y7858593.exe	86
PID 3352 wrote to memory of 4944	3352	y7858593.exe	93
PID 3352 wrote to memory of 4944	3352	y7858593.exe	93
PID 3352 wrote to memory of 4944	3352	y7858593.exe	93

C:\Users\Admin\AppData\Local\Temp\bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe
"C:\Users\Admin\AppData\Local\Temp\bafb8cd15341059a2250604b8332fe19c613cf89400d435308440086fd00b4bc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7858593.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7858593.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5277360.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5277360.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3572353.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3572353.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4944

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7858593.exe

Filesize
307KB

MD5
dbf4d5c757d26161039d7d5ea3b1bf3b

SHA1
be7e5837f3f9a5a9dc917040eac3b2249c7c6687

SHA256
03a465e56e52b244ad13e66b553eebc9bc197a7b9f5d3bd687b6e04b46d874b2

SHA512
89548f1f7f756ae640abd0736ba1175ecfec7f038c4c6491ffa4cf264cb54a4cf3e7cc5f3dbc25e8925f932577007bcbd4da9eca14eaec203252bbfd1ff84196

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5277360.exe

Filesize
179KB

MD5
8eb2db565cbe9ce5eb16ab6e1ca40d42

SHA1
0bf8cba74f9a13f84ce48202d695c6c4cc0ad9b9

SHA256
575a23e2508bf2c158be24960c8d16b82f6f77649626d8c4af965aeed85f6a50

SHA512
032c4f3a310c0e3da736b11644baf8613836a58c64dd9881572a263d6233c7c3152af021aba6e31f6785cf03f6b09b54088c2ad723b8eb9e5e3fe2d6ce13ac40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3572353.exe

Filesize
168KB

MD5
0cb038de6b6948542bbd7d3b291eb0a8

SHA1
9219174b0d988deccffbd3c91b42702de1b61b93

SHA256
c0b69dba6df822963f03340ec1de47ffbae75a94f06564cfe505963d3f05f3e5

SHA512
fb34b84dbce5d9d2b7c159c6becfec0b2166cba8f52f98255b77dc19c748e9c18ee04fd4e225708af1838ba3b77860dbe4be1dd16320fa787bda91ba2ac9ce32

Download Submit
memory/3928-33-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-50-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3928-17-0x0000000004B80000-0x0000000005124000-memory.dmp

Filesize
5.6MB

Download
memory/3928-18-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3928-19-0x0000000004990000-0x00000000049A8000-memory.dmp

Filesize
96KB

Download
memory/3928-43-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-27-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-45-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-48-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3928-41-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-39-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-37-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-35-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-15-0x0000000000950000-0x000000000096A000-memory.dmp

Filesize
104KB

Download
memory/3928-32-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-29-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-47-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-25-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-23-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-21-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-20-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3928-49-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/3928-16-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3928-52-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3928-14-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/4944-56-0x0000000000E20000-0x0000000000E50000-memory.dmp

Filesize
192KB

Download
memory/4944-57-0x0000000001670000-0x0000000001676000-memory.dmp

Filesize
24KB

Download
memory/4944-58-0x0000000005F50000-0x0000000006568000-memory.dmp

Filesize
6.1MB

Download
memory/4944-59-0x0000000005A40000-0x0000000005B4A000-memory.dmp

Filesize
1.0MB

Download
memory/4944-60-0x0000000003190000-0x00000000031A2000-memory.dmp

Filesize
72KB

Download
memory/4944-61-0x0000000005970000-0x00000000059AC000-memory.dmp

Filesize
240KB

Download
memory/4944-62-0x00000000059B0000-0x00000000059FC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads