healer | 9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f

General

Target

9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe
Size

479KB
MD5

80841f6f6a690171226b1ed2eb3aedf4
SHA1

7a741ca9dc841ca4dd5c1bcded40b052e017e991
SHA256

9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f
SHA512

4884911d359f795cc158d02b44806eb0518ea586dcd9559669bab2b1a440400bfffd3c4ef6c1ee816dd88ca292412fd29bb38784c17a350dbd36944ab88fcc29
SSDEEP

12288:lMrIy90H0FJPBHKY6jWGOb3pVgnrS8Y/kgJ5zb4vwxb:5yBVqa5OrS8UBb4IV

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3228-15-0x0000000002250000-0x000000000226A000-memory.dmp	healer
behavioral1/memory/3228-18-0x0000000004F40000-0x0000000004F58000-memory.dmp	healer
behavioral1/memory/3228-20-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-46-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-44-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-42-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-40-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-38-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-36-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-34-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-32-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-30-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-28-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-27-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-24-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-22-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer
behavioral1/memory/3228-19-0x0000000004F40000-0x0000000004F52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k2885969.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k2885969.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k2885969.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k2885969.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k2885969.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k2885969.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ce5-52.dat	family_redline
behavioral1/memory/4000-54-0x0000000000E80000-0x0000000000EB0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3796	y0059820.exe
3228	k2885969.exe
4000	l7193590.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k2885969.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k2885969.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0059820.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y0059820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k2885969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l7193590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3228	k2885969.exe
3228	k2885969.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	k2885969.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3796	1852	9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe	85
PID 1852 wrote to memory of 3796	1852	9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe	85
PID 1852 wrote to memory of 3796	1852	9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe	85
PID 3796 wrote to memory of 3228	3796	y0059820.exe	86
PID 3796 wrote to memory of 3228	3796	y0059820.exe	86
PID 3796 wrote to memory of 3228	3796	y0059820.exe	86
PID 3796 wrote to memory of 4000	3796	y0059820.exe	94
PID 3796 wrote to memory of 4000	3796	y0059820.exe	94
PID 3796 wrote to memory of 4000	3796	y0059820.exe	94

C:\Users\Admin\AppData\Local\Temp\9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe
"C:\Users\Admin\AppData\Local\Temp\9b596722d6c9acb58568237d3ee7ba33c3b12e141c67cad74e52e760c72b2d8f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0059820.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0059820.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2885969.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2885969.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7193590.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7193590.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0059820.exe

Filesize
307KB

MD5
7c8490e59b865e7491c37c0bc2671989

SHA1
14b48cf5f8f638019552d30b618cbafcd77ec1ce

SHA256
d0dfac7ff71067b24c1040f95831b06a95904ae40e8191b9400b7defe5998662

SHA512
fbc6578159154859eabf51c8e354183982fb65cb977a7e19cbde8f2e3f3493dc64a444ed06c77c6308a64fc980a6668225e9f470f9adca9d3dc896868b194939

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2885969.exe

Filesize
180KB

MD5
43028eb2e4bc89977e12b8386a87598a

SHA1
83a595164c3143c7e90b612d3772c076cdc93015

SHA256
77ae0d2babc1a435adc50f5932f4e8f6e7b76ac03df21ff686ca7f59dd5b8d9a

SHA512
68c0a7bc0b7b3a3139d4ab84e8ffeb4a9804cb6f865d85fc7b525e07611a8e38bca9623cf844ac5468bbaae76dbba3ae7d92fe4f68a64ead9bb4a930c7f87654

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7193590.exe

Filesize
168KB

MD5
26321da81d4b7c039699ff3462ddaed2

SHA1
6278ef246a4e4cd7f7dd38ff0368da0409477dd3

SHA256
2cd9df6bd65ebf6b36a7ddb6aca7b3b694a2a67546c2c225a1251650d14601aa

SHA512
78671f65d8acdc8bca0d597ca87dcae6a6697fa05478f7e35a7de546dedce978ca4ca18b3718b0618c73f9ef0e798a2e9119da345baad98b6931d7f41272432b

Download Submit
memory/3228-30-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-17-0x0000000004940000-0x0000000004EE4000-memory.dmp

Filesize
5.6MB

Download
memory/3228-27-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-18-0x0000000004F40000-0x0000000004F58000-memory.dmp

Filesize
96KB

Download
memory/3228-20-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-46-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-44-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-42-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-40-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-38-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-36-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-34-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-32-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-15-0x0000000002250000-0x000000000226A000-memory.dmp

Filesize
104KB

Download
memory/3228-28-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-16-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3228-24-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-22-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-19-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/3228-47-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/3228-48-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3228-50-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3228-14-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/4000-54-0x0000000000E80000-0x0000000000EB0000-memory.dmp

Filesize
192KB

Download
memory/4000-55-0x00000000017B0000-0x00000000017B6000-memory.dmp

Filesize
24KB

Download
memory/4000-56-0x000000000B270000-0x000000000B888000-memory.dmp

Filesize
6.1MB

Download
memory/4000-57-0x000000000AD60000-0x000000000AE6A000-memory.dmp

Filesize
1.0MB

Download
memory/4000-58-0x0000000005690000-0x00000000056A2000-memory.dmp

Filesize
72KB

Download
memory/4000-59-0x000000000AC90000-0x000000000ACCC000-memory.dmp

Filesize
240KB

Download
memory/4000-60-0x0000000003120000-0x000000000316C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads