healer | 707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e

General

Target

707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe
Size

479KB
MD5

abd4f5b5d5f0691ea5f7c3afc44f6985
SHA1

34d04fc20dfd5aa787d7daab7ad13c9aa307a3fb
SHA256

707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e
SHA512

7a6dacecff4fb209dbca92075c337fa7ccc03a9d1e955a4a2f8e091808c546ad755ada66477189869f45be0e7df6ffeb18c51c0e0cd9ba81e03b1d903929c32e
SSDEEP

12288:vMrRy90rXYCWDInsoGBTrwn17szY/Zp7P:ayl5o2wn17s8/z7P

Score

10^/10

healer redline dona discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes

auth_value
9fbb198992bbc83a84ab1f21384813e3

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1904-15-0x0000000002080000-0x000000000209A000-memory.dmp	healer
behavioral1/memory/1904-18-0x0000000002530000-0x0000000002548000-memory.dmp	healer
behavioral1/memory/1904-47-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-45-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-43-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-41-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-39-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-37-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-35-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-33-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-31-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-29-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-27-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-25-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-23-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-21-0x0000000002530000-0x0000000002542000-memory.dmp	healer
behavioral1/memory/1904-20-0x0000000002530000-0x0000000002542000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8335678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8335678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8335678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8335678.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k8335678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8335678.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c7a-54.dat	family_redline
behavioral1/memory/3564-56-0x0000000000C20000-0x0000000000C50000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2736	y9504735.exe
1904	k8335678.exe
3564	l3109532.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k8335678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8335678.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9504735.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9504735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k8335678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l3109532.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	k8335678.exe
1904	k8335678.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	k8335678.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2736	5072	707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe	83
PID 5072 wrote to memory of 2736	5072	707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe	83
PID 5072 wrote to memory of 2736	5072	707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe	83
PID 2736 wrote to memory of 1904	2736	y9504735.exe	84
PID 2736 wrote to memory of 1904	2736	y9504735.exe	84
PID 2736 wrote to memory of 1904	2736	y9504735.exe	84
PID 2736 wrote to memory of 3564	2736	y9504735.exe	97
PID 2736 wrote to memory of 3564	2736	y9504735.exe	97
PID 2736 wrote to memory of 3564	2736	y9504735.exe	97

C:\Users\Admin\AppData\Local\Temp\707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe
"C:\Users\Admin\AppData\Local\Temp\707be9bb97748631ee4c59921b8eb2235f310b9e3816d5c33daec557cded0f5e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9504735.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9504735.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8335678.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8335678.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3109532.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3109532.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9504735.exe

Filesize
307KB

MD5
3d96c4d661f8dc3314e0b2e7f892d830

SHA1
f2648bd439644d72ed5d462c2d37b01eeda5d14d

SHA256
244eadedeffdcc341bf06224225277937e5d231677f4a09f17ae6cf259ee16d0

SHA512
dcb89f1f1dd8c5375a4681fafbb9262bc4e928d4112d0404400b531fb5406ca9863a81cc595deb2f431d4568f1f44ef5e55cc6fb07159d823bf330e3c549680d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8335678.exe

Filesize
179KB

MD5
661321401fb3f352d0dfde5fab3ca77a

SHA1
0f65574e987011b82a0666eeb408715aab424c41

SHA256
a5d7f3e60a1c51bd22ce7a92f330e5f792bfe0107f56148c6e7b8f6c330732bb

SHA512
2881da7c4ae9b487d47dc9d708ab408a0fce089a19cf94a81ff6518e7102c59754d3e91ce2b264a273b622cf5510dcc903293d9d4a5794887a4288984a42dfc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3109532.exe

Filesize
168KB

MD5
4ec3b64e405ce814743bd27f6408bd7a

SHA1
823a972b46515d0d7fd4aa7e166903ddb09e5f04

SHA256
ed82da9a8e689e99d150daf584c73304c0efeef3453c9ba3eae970763e700303

SHA512
de4f504859fc25b4a5ba76ba39287900ba5217f3ec400dbaa7f671a5c5f13a581a863e8ee28a4483bf386d25a9abd465d14dab7cc1679bddcceb49801026b902

Download Submit
memory/1904-31-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-23-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-17-0x0000000004B70000-0x0000000005114000-memory.dmp

Filesize
5.6MB

Download
memory/1904-18-0x0000000002530000-0x0000000002548000-memory.dmp

Filesize
96KB

Download
memory/1904-19-0x0000000073F30000-0x00000000746E0000-memory.dmp

Filesize
7.7MB

Download
memory/1904-47-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-45-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-43-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-25-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-39-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-37-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-35-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-33-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-15-0x0000000002080000-0x000000000209A000-memory.dmp

Filesize
104KB

Download
memory/1904-16-0x0000000073F30000-0x00000000746E0000-memory.dmp

Filesize
7.7MB

Download
memory/1904-29-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-41-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-27-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-21-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-20-0x0000000002530000-0x0000000002542000-memory.dmp

Filesize
72KB

Download
memory/1904-48-0x0000000073F30000-0x00000000746E0000-memory.dmp

Filesize
7.7MB

Download
memory/1904-49-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Filesize
4KB

Download
memory/1904-50-0x0000000073F30000-0x00000000746E0000-memory.dmp

Filesize
7.7MB

Download
memory/1904-52-0x0000000073F30000-0x00000000746E0000-memory.dmp

Filesize
7.7MB

Download
memory/1904-14-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Filesize
4KB

Download
memory/3564-56-0x0000000000C20000-0x0000000000C50000-memory.dmp

Filesize
192KB

Download
memory/3564-57-0x0000000002DB0000-0x0000000002DB6000-memory.dmp

Filesize
24KB

Download
memory/3564-58-0x0000000005C40000-0x0000000006258000-memory.dmp

Filesize
6.1MB

Download
memory/3564-59-0x0000000005730000-0x000000000583A000-memory.dmp

Filesize
1.0MB

Download
memory/3564-60-0x0000000005490000-0x00000000054A2000-memory.dmp

Filesize
72KB

Download
memory/3564-61-0x0000000005620000-0x000000000565C000-memory.dmp

Filesize
240KB

Download
memory/3564-62-0x0000000005660000-0x00000000056AC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads