healer | f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5

General

Target

f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe
Size

479KB
MD5

224633a4bc9104f0f81489948e3a6610
SHA1

c27bc8dc240a9b4c23821fb3b35a5fd4e0de4d78
SHA256

f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5
SHA512

3bef96ea6464dde450abba618d4f84eb49d86b030fa39448aaf8a941805cf57b48cc1479aa9f284f8477679daaa6b5f9959467466d1a62d479e491fc648cde9e
SSDEEP

12288:5Mr4y90mt8+WUjstTSpDswBnL1RpvU//8id:hyH0cwuzLbK/kG

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4748-15-0x0000000002010000-0x000000000202A000-memory.dmp	healer
behavioral1/memory/4748-19-0x0000000004970000-0x0000000004988000-memory.dmp	healer
behavioral1/memory/4748-25-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-47-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-45-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-43-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-42-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-39-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-37-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-35-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-33-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-31-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-29-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-27-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-23-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-22-0x0000000004970000-0x0000000004982000-memory.dmp	healer
behavioral1/memory/4748-20-0x0000000004970000-0x0000000004982000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5311608.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k5311608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5311608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5311608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5311608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5311608.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c01-53.dat	family_redline
behavioral1/memory/4968-55-0x0000000000760000-0x0000000000790000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1424	y8946735.exe
4748	k5311608.exe
4968	l0056333.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k5311608.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5311608.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y8946735.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l0056333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8946735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k5311608.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	k5311608.exe
4748	k5311608.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	k5311608.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1424	2160	f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe	84
PID 2160 wrote to memory of 1424	2160	f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe	84
PID 2160 wrote to memory of 1424	2160	f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe	84
PID 1424 wrote to memory of 4748	1424	y8946735.exe	85
PID 1424 wrote to memory of 4748	1424	y8946735.exe	85
PID 1424 wrote to memory of 4748	1424	y8946735.exe	85
PID 1424 wrote to memory of 4968	1424	y8946735.exe	92
PID 1424 wrote to memory of 4968	1424	y8946735.exe	92
PID 1424 wrote to memory of 4968	1424	y8946735.exe	92

C:\Users\Admin\AppData\Local\Temp\f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe
"C:\Users\Admin\AppData\Local\Temp\f42fa3305229c7ec3ec66163a6ebba3dcde4c9b136d9ec8fa6bfbdd0a12854a5N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8946735.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8946735.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5311608.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5311608.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0056333.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0056333.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8946735.exe

Filesize
307KB

MD5
6656a41ce97ae59fa8b4533d97eb82dd

SHA1
e9c2fa12ce65767c21cf79b239732a663b7463a0

SHA256
d078cfff3803f63a15734262c443250f456433fdad506a079e4ad010bcab9ef5

SHA512
d305249b15f30894828809c7f6b14da67babf603120a175805e83dc778395be6915244a74566b2b87362e0feec4799c89f75bbb173a0f4096985209b24f2c008

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5311608.exe

Filesize
180KB

MD5
349e3b9e09b6dd6e73da47c2198f07cd

SHA1
f3e2634524bedd91378683951677fc29266fbcb3

SHA256
894e7c115399261c4bd85d3a68f87086fc20380982a71ed85bd7191d97e860ee

SHA512
b8d5919807b0692135084fb1a2b926170700568ebe91dbbbfa1aed1fa5fdbd09445f0d78b1cab07f78612ea3bb12a2315280934be33cd9b02ff1124d915862db

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0056333.exe

Filesize
168KB

MD5
3189ef282204d665f723a06ffc58f1c1

SHA1
5f2423ef3ef1c8d2427213173959ccf713ef9dbc

SHA256
f9f66a0b1656a62b6289987f004a95b9bb1bf71f79987cfddfe4d73f531d14ae

SHA512
7d0bb6e76054027cf2aaa2db5e9ae4cd993b3bf106f957c538de8f52411858b1ea8f5beef8652f201df0d0320d613d899025397df5c2e673bfb636f49a941e9f

Download Submit
memory/4748-33-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-51-0x0000000073DE0000-0x0000000074590000-memory.dmp

Filesize
7.7MB

Download
memory/4748-31-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-18-0x00000000049E0000-0x0000000004F84000-memory.dmp

Filesize
5.6MB

Download
memory/4748-19-0x0000000004970000-0x0000000004988000-memory.dmp

Filesize
96KB

Download
memory/4748-25-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-47-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-45-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-43-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-42-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-39-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-37-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-35-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-15-0x0000000002010000-0x000000000202A000-memory.dmp

Filesize
104KB

Download
memory/4748-17-0x0000000073DE0000-0x0000000074590000-memory.dmp

Filesize
7.7MB

Download
memory/4748-29-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-16-0x0000000073DE0000-0x0000000074590000-memory.dmp

Filesize
7.7MB

Download
memory/4748-23-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-22-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-20-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-48-0x0000000073DEE000-0x0000000073DEF000-memory.dmp

Filesize
4KB

Download
memory/4748-49-0x0000000073DE0000-0x0000000074590000-memory.dmp

Filesize
7.7MB

Download
memory/4748-27-0x0000000004970000-0x0000000004982000-memory.dmp

Filesize
72KB

Download
memory/4748-14-0x0000000073DEE000-0x0000000073DEF000-memory.dmp

Filesize
4KB

Download
memory/4968-55-0x0000000000760000-0x0000000000790000-memory.dmp

Filesize
192KB

Download
memory/4968-56-0x0000000005070000-0x0000000005076000-memory.dmp

Filesize
24KB

Download
memory/4968-57-0x0000000005850000-0x0000000005E68000-memory.dmp

Filesize
6.1MB

Download
memory/4968-58-0x0000000005340000-0x000000000544A000-memory.dmp

Filesize
1.0MB

Download
memory/4968-59-0x0000000005100000-0x0000000005112000-memory.dmp

Filesize
72KB

Download
memory/4968-60-0x0000000005270000-0x00000000052AC000-memory.dmp

Filesize
240KB

Download
memory/4968-61-0x00000000052C0000-0x000000000530C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads