healer | 9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a

General

Target

9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe
Size

479KB
MD5

584113384daf3f0a6862d5a4b1c075a4
SHA1

c212a819481eb7b33e7c28a6a8e1f912dcb4da09
SHA256

9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a
SHA512

308f3db34e91d30cc7872bea705fa4af55f85cb85c1e97d337621fd56dc949f41539044fe020469a4a481e38218b6462c877c338447aa2922511abcdd54b793a
SSDEEP

12288:9Mray905L0WpvZdTXz+V8rPc94WjN54M3nduHo:3yfWzdTjJP+Xjb4MXdd

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3648-15-0x00000000022B0000-0x00000000022CA000-memory.dmp	healer
behavioral1/memory/3648-19-0x0000000002420000-0x0000000002438000-memory.dmp	healer
behavioral1/memory/3648-48-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-46-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-44-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-42-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-40-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-38-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-36-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-34-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-32-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-30-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-28-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-26-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-24-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-22-0x0000000002420000-0x0000000002432000-memory.dmp	healer
behavioral1/memory/3648-21-0x0000000002420000-0x0000000002432000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0365116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0365116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0365116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0365116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0365116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0365116.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b5f-54.dat	family_redline
behavioral1/memory/1512-56-0x0000000000160000-0x0000000000190000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4340	y0958193.exe
3648	k0365116.exe
1512	l7388381.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0365116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0365116.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0958193.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y0958193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k0365116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7388381.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3648	k0365116.exe
3648	k0365116.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	k0365116.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 4340	756	9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe	84
PID 756 wrote to memory of 4340	756	9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe	84
PID 756 wrote to memory of 4340	756	9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe	84
PID 4340 wrote to memory of 3648	4340	y0958193.exe	85
PID 4340 wrote to memory of 3648	4340	y0958193.exe	85
PID 4340 wrote to memory of 3648	4340	y0958193.exe	85
PID 4340 wrote to memory of 1512	4340	y0958193.exe	95
PID 4340 wrote to memory of 1512	4340	y0958193.exe	95
PID 4340 wrote to memory of 1512	4340	y0958193.exe	95

C:\Users\Admin\AppData\Local\Temp\9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe
"C:\Users\Admin\AppData\Local\Temp\9b81695f650f1dab40e6a44a483a82efedff06ee515d1c46babd933b27e7739a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0958193.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0958193.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0365116.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0365116.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7388381.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7388381.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0958193.exe

Filesize
307KB

MD5
d9c392e70ed91449d747c2764473ad03

SHA1
6839615c34cc01e97813691a629665ec0d0908d6

SHA256
87cc0944b83f471c7f3d0cf530a048fc6ccae953ead325e669d26333dede3cea

SHA512
4d40e3c9d64d0a972ef0a580e25bfeb4cf391d18041961452a632694dbbe1de983af4372fb0b62ce1f76fc430c4aeecef5ef1d17be0f86c64987383ceaa61929

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0365116.exe

Filesize
180KB

MD5
2b7831afcdcb32451c7c98c260a413c5

SHA1
7946ee6adafcb1c324c97653852b1a663af5d9b4

SHA256
083ec15b9a65b1f92ea19e64006bd41146cccc5926d8666491cec086b01b5010

SHA512
05bdb7b92084cc141018d7520993a3fdf134a7c770122d6b2c1412c6848df87a9248a6b020452baa8c06522623e1a81441bf5391c3ce16892538b5cb41ae6d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7388381.exe

Filesize
168KB

MD5
d3b2552b1f044fff48a0a7feb53208a1

SHA1
9703d9a5452318579704297b60556387a6bc3f81

SHA256
25b7c135144cb77b61856cecc0a81400b9dac44dffc92d0db0a4fbb4726455f2

SHA512
9197cf108c62859e959106d85007db651b9453b6d783c594e9c1537ac56b01a58ec9f785aa84ed52849be64ad65504c8721e76e5b04b6f843e4b6090822867f9

Download Submit
memory/1512-62-0x0000000004B90000-0x0000000004BDC000-memory.dmp

Filesize
304KB

Download
memory/1512-61-0x0000000004B50000-0x0000000004B8C000-memory.dmp

Filesize
240KB

Download
memory/1512-60-0x0000000004AF0000-0x0000000004B02000-memory.dmp

Filesize
72KB

Download
memory/1512-59-0x0000000004BE0000-0x0000000004CEA000-memory.dmp

Filesize
1.0MB

Download
memory/1512-58-0x00000000050F0000-0x0000000005708000-memory.dmp

Filesize
6.1MB

Download
memory/1512-57-0x0000000000A60000-0x0000000000A66000-memory.dmp

Filesize
24KB

Download
memory/1512-56-0x0000000000160000-0x0000000000190000-memory.dmp

Filesize
192KB

Download
memory/3648-34-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-21-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-42-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-40-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-38-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-36-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-46-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-32-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-30-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-28-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-26-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-24-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-22-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-44-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-49-0x00000000742EE000-0x00000000742EF000-memory.dmp

Filesize
4KB

Download
memory/3648-50-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/3648-52-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/3648-48-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3648-18-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/3648-20-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/3648-19-0x0000000002420000-0x0000000002438000-memory.dmp

Filesize
96KB

Download
memory/3648-17-0x0000000004A30000-0x0000000004FD4000-memory.dmp

Filesize
5.6MB

Download
memory/3648-16-0x00000000742E0000-0x0000000074A90000-memory.dmp

Filesize
7.7MB

Download
memory/3648-15-0x00000000022B0000-0x00000000022CA000-memory.dmp

Filesize
104KB

Download
memory/3648-14-0x00000000742EE000-0x00000000742EF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads