healer | e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726

General

Target

e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe
Size

478KB
MD5

cbb91fc2ef5d36b8fbd0b239cfed976a
SHA1

dee146fb5c7a46e81562074b7bfa796a6c770fcc
SHA256

e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726
SHA512

6543e1edae4d1d2d025f94b91ece53e8d3c08acc766f4a8ee17a875385123ec33515d8776418ad3d65dfbb1ffb88d38df1d5ab980b8dd10c22116f1cd093c31f
SSDEEP

12288:uMrOy90KnaBu299Uz5c1u31LTqvAwNWLHwXXFCVE:kyRnGYXlTMCQX4VE

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4848-15-0x00000000021E0000-0x00000000021FA000-memory.dmp	healer
behavioral1/memory/4848-18-0x0000000002640000-0x0000000002658000-memory.dmp	healer
behavioral1/memory/4848-45-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-47-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-43-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-41-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-39-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-37-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-21-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-20-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-35-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-33-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-31-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-29-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-27-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-25-0x0000000002640000-0x0000000002652000-memory.dmp	healer
behavioral1/memory/4848-23-0x0000000002640000-0x0000000002652000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k6376315.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k6376315.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k6376315.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k6376315.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k6376315.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k6376315.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b66-54.dat	family_redline
behavioral1/memory/4208-56-0x0000000000B10000-0x0000000000B40000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
724	y9715036.exe
4848	k6376315.exe
4208	l5996121.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k6376315.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k6376315.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9715036.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9715036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k6376315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l5996121.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	k6376315.exe
4848	k6376315.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	k6376315.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 724	2844	e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe	83
PID 2844 wrote to memory of 724	2844	e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe	83
PID 2844 wrote to memory of 724	2844	e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe	83
PID 724 wrote to memory of 4848	724	y9715036.exe	85
PID 724 wrote to memory of 4848	724	y9715036.exe	85
PID 724 wrote to memory of 4848	724	y9715036.exe	85
PID 724 wrote to memory of 4208	724	y9715036.exe	93
PID 724 wrote to memory of 4208	724	y9715036.exe	93
PID 724 wrote to memory of 4208	724	y9715036.exe	93

C:\Users\Admin\AppData\Local\Temp\e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe
"C:\Users\Admin\AppData\Local\Temp\e2a7812bef3da03646f9d1b4335cad14f6fce4368dd248905e9b121015fb6726.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9715036.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9715036.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6376315.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6376315.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5996121.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5996121.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9715036.exe

Filesize
307KB

MD5
a8ec1442d69abe4d25a16577abd8c11b

SHA1
e71d5ba7f842364a167a0810bb697ca629a8c9f2

SHA256
3a463a48fa8685bf5514ee02225af27ca641d71d8bdd5080801c3886f8e017f6

SHA512
86d5983266ffa78f2e8afec858eaec59d0507b5aeeaf2cf1a359f19d4d2150cfe70d963bae43a6067c872cc3315f3450758a0b8e15fe88ad6e7e2e0df3330f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6376315.exe

Filesize
180KB

MD5
3f1f6af075b862ad43d96ed3bad0d139

SHA1
e82513093863591d91006bb02418c81f0e2fcea3

SHA256
eff6fdf16778f64e4e4096073afa0da7ee34de827af1c49b3489122fdccd3df5

SHA512
8dd0456a2ebbe1197fa7edfc147b26ee02f74bc772f2a0db352d640b808561027da37875beedd4785025baa62f99d9e94f7a3c3bba40deb7a2133b67db8e82a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5996121.exe

Filesize
168KB

MD5
4f6df888f17c1aaa98589e897e863dc1

SHA1
a1cad8300bca455c467643991270a34f83b0b592

SHA256
12139cf718689f74654bc9c8594534b9171301589a876f35f5a1f096216b39d8

SHA512
4c09f6a247fabf3c0b1422d54cb19c8326b2a2eb25d27d1b984d45090a028034ff570675dd4437e66a27fc59722b6e977a2e0949955e15ec010707c172d9f183

Download Submit
memory/4208-62-0x0000000005540000-0x000000000558C000-memory.dmp

Filesize
304KB

Download
memory/4208-61-0x00000000054F0000-0x000000000552C000-memory.dmp

Filesize
240KB

Download
memory/4208-60-0x0000000005480000-0x0000000005492000-memory.dmp

Filesize
72KB

Download
memory/4208-59-0x0000000005600000-0x000000000570A000-memory.dmp

Filesize
1.0MB

Download
memory/4208-58-0x0000000005B10000-0x0000000006128000-memory.dmp

Filesize
6.1MB

Download
memory/4208-57-0x0000000002C30000-0x0000000002C36000-memory.dmp

Filesize
24KB

Download
memory/4208-56-0x0000000000B10000-0x0000000000B40000-memory.dmp

Filesize
192KB

Download
memory/4848-20-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-23-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-41-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-39-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-37-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-21-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-48-0x00000000741B0000-0x0000000074960000-memory.dmp

Filesize
7.7MB

Download
memory/4848-35-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-33-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-31-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-29-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-27-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-25-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-43-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-49-0x00000000741BE000-0x00000000741BF000-memory.dmp

Filesize
4KB

Download
memory/4848-50-0x00000000741B0000-0x0000000074960000-memory.dmp

Filesize
7.7MB

Download
memory/4848-52-0x00000000741B0000-0x0000000074960000-memory.dmp

Filesize
7.7MB

Download
memory/4848-47-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-45-0x0000000002640000-0x0000000002652000-memory.dmp

Filesize
72KB

Download
memory/4848-19-0x00000000741B0000-0x0000000074960000-memory.dmp

Filesize
7.7MB

Download
memory/4848-18-0x0000000002640000-0x0000000002658000-memory.dmp

Filesize
96KB

Download
memory/4848-16-0x00000000741B0000-0x0000000074960000-memory.dmp

Filesize
7.7MB

Download
memory/4848-17-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download
memory/4848-15-0x00000000021E0000-0x00000000021FA000-memory.dmp

Filesize
104KB

Download
memory/4848-14-0x00000000741BE000-0x00000000741BF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads