healer | 0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c

General

Target

0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe
Size

478KB
MD5

8c1ee1696c5f6b9d18295a5f8f4e533c
SHA1

1eb4ac48e91f4604eba4ad2094382d8628fb72ef
SHA256

0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c
SHA512

cd2f29fbb115c687237ca5bce5bdbbae1af38438066a4114827f9d591f0625163b7a9c193075a0db8cc5f20a815929e8b5942bb0942137302f4ce454861de860
SSDEEP

12288:KMrIy904hCifJ0ff2kWQwwrPkmOTsbFMn:2yWapPIrsOFMn

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/936-15-0x00000000021B0000-0x00000000021CA000-memory.dmp	healer
behavioral1/memory/936-18-0x0000000004F40000-0x0000000004F58000-memory.dmp	healer
behavioral1/memory/936-35-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-47-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-45-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-43-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-41-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-39-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-37-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-25-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-20-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-33-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-31-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-29-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-27-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-23-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/936-21-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5194413.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5194413.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5194413.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k5194413.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5194413.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5194413.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c8f-54.dat	family_redline
behavioral1/memory/764-56-0x0000000000050000-0x0000000000080000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1944	y8877052.exe
936	k5194413.exe
764	l7503601.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k5194413.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5194413.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8877052.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8877052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k5194413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7503601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
936	k5194413.exe
936	k5194413.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	k5194413.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1944	2488	0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe	83
PID 2488 wrote to memory of 1944	2488	0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe	83
PID 2488 wrote to memory of 1944	2488	0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe	83
PID 1944 wrote to memory of 936	1944	y8877052.exe	85
PID 1944 wrote to memory of 936	1944	y8877052.exe	85
PID 1944 wrote to memory of 936	1944	y8877052.exe	85
PID 1944 wrote to memory of 764	1944	y8877052.exe	97
PID 1944 wrote to memory of 764	1944	y8877052.exe	97
PID 1944 wrote to memory of 764	1944	y8877052.exe	97

C:\Users\Admin\AppData\Local\Temp\0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe
"C:\Users\Admin\AppData\Local\Temp\0554cc0d65d529806c9f1195401ba39e2e264454cc3374b3eb0b4e08632f5f9c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8877052.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8877052.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5194413.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5194413.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7503601.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7503601.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8877052.exe

Filesize
307KB

MD5
8026513f06ecd8c17981920bac5f9cd6

SHA1
2f0a001d3c1b0be146acbfd9b4d3d5ea786b1b86

SHA256
ba58521a40fbc46211eafa6c869aad3e9fe74d91b6bc3d7fcd09ad11fa9145ac

SHA512
897402f66c2ae9fd6960f86f92990fcf58fbbc608cb9163d058814f0a2ce00ddad21d1389db605770a8d9e483e54bbe7c57e76a50a6f6cf6bce0b18a2a896e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5194413.exe

Filesize
180KB

MD5
842ed286d82d5fec57721115f43531f2

SHA1
7446b1ccf3a73c1c8656434279392dac728d44a8

SHA256
7d201bbac0aa24ee24dc4ca7c3fb7d6441c5b4199d86b6d1e4f19c5dc7a97ccb

SHA512
6ab7df451cb570b06a9e50faf62e545525b5eb22c81f2416ec2e991c36f75cae218bf134810775c0205ccad57d8209546b6983f47abccd87af8024f69d92c1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7503601.exe

Filesize
168KB

MD5
3c9c8439826a52c7a506a3b46081ea55

SHA1
c5087c6c7c965ad4d006c931443a14a5d17c1f8d

SHA256
b007ea1605406af8e15cb5a11eb1d5885012674a4a6ef3aa78f0abe97ed6b16d

SHA512
21001c3ddc78c36a90e4be6d02bcffc7d2372ed4a02f7e4448b38873de28c33d6a287305150940df66aaa160d25875ac153636b209575d4ce554981cde53963d

Download Submit
memory/764-62-0x0000000004AC0000-0x0000000004B0C000-memory.dmp

Filesize
304KB

Download
memory/764-61-0x0000000004820000-0x000000000485C000-memory.dmp

Filesize
240KB

Download
memory/764-60-0x00000000047C0000-0x00000000047D2000-memory.dmp

Filesize
72KB

Download
memory/764-59-0x0000000004BD0000-0x0000000004CDA000-memory.dmp

Filesize
1.0MB

Download
memory/764-58-0x00000000050E0000-0x00000000056F8000-memory.dmp

Filesize
6.1MB

Download
memory/764-57-0x0000000002170000-0x0000000002176000-memory.dmp

Filesize
24KB

Download
memory/764-56-0x0000000000050000-0x0000000000080000-memory.dmp

Filesize
192KB

Download
memory/936-25-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-21-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-43-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-41-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-39-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-37-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-48-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/936-20-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-33-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-31-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-29-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-27-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-23-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-45-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-49-0x0000000073CCE000-0x0000000073CCF000-memory.dmp

Filesize
4KB

Download
memory/936-50-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/936-52-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/936-47-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-35-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/936-19-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/936-17-0x0000000004930000-0x0000000004ED4000-memory.dmp

Filesize
5.6MB

Download
memory/936-18-0x0000000004F40000-0x0000000004F58000-memory.dmp

Filesize
96KB

Download
memory/936-16-0x0000000073CC0000-0x0000000074470000-memory.dmp

Filesize
7.7MB

Download
memory/936-15-0x00000000021B0000-0x00000000021CA000-memory.dmp

Filesize
104KB

Download
memory/936-14-0x0000000073CCE000-0x0000000073CCF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads