healer | 53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8

General

Target

53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe
Size

731KB
MD5

b488f9d22b23985acc00f9e7b49fd3c1
SHA1

27487fd30e667d8af4839a8282c5557282ede2f8
SHA256

53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8
SHA512

0272f57a9c64787bdd64bd6203b7d7d66fa16cd216488a1d3d0cb54ab7cfb6540014988fc8ff1b5af3d368ea80784f3c04e6b640eff2f43082b71a5f7ba1b007
SSDEEP

12288:2Mrpy90zd/tlShuTaQvXypucvBXQTaGa69FOn4iKLSOUkuB9waANo8oma1OEMeWX:zy8lJTn6scJXkaOF4/OSOXaAeNmnh4GL

Score

10^/10

healer redline dars discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dars

C2

83.97.73.127:19045

Attributes

auth_value
7cd208e6b6c927262304d5d4d88647fd

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral1/memory/2076-22-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b6e-28.dat	family_redline
behavioral1/memory/1100-30-0x0000000000210000-0x000000000023E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4384	y1552604.exe
3572	y1131515.exe
1560	k1756823.exe
1100	l8542573.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1552604.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y1131515.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 2076	1560	k1756823.exe	88

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l8542573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1552604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1131515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1756823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	AppLaunch.exe
2076	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4384	556	53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe	83
PID 556 wrote to memory of 4384	556	53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe	83
PID 556 wrote to memory of 4384	556	53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe	83
PID 4384 wrote to memory of 3572	4384	y1552604.exe	84
PID 4384 wrote to memory of 3572	4384	y1552604.exe	84
PID 4384 wrote to memory of 3572	4384	y1552604.exe	84
PID 3572 wrote to memory of 1560	3572	y1131515.exe	85
PID 3572 wrote to memory of 1560	3572	y1131515.exe	85
PID 3572 wrote to memory of 1560	3572	y1131515.exe	85
PID 1560 wrote to memory of 2076	1560	k1756823.exe	88
PID 1560 wrote to memory of 2076	1560	k1756823.exe	88
PID 1560 wrote to memory of 2076	1560	k1756823.exe	88
PID 1560 wrote to memory of 2076	1560	k1756823.exe	88
PID 1560 wrote to memory of 2076	1560	k1756823.exe	88
PID 3572 wrote to memory of 1100	3572	y1131515.exe	90
PID 3572 wrote to memory of 1100	3572	y1131515.exe	90
PID 3572 wrote to memory of 1100	3572	y1131515.exe	90

C:\Users\Admin\AppData\Local\Temp\53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe
"C:\Users\Admin\AppData\Local\Temp\53f75dd3a4e4ffbe5021413028bbd987b88ea103afb90f33e914fa360453f0e8.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1552604.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1552604.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1131515.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1131515.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1756823.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1756823.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8542573.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8542573.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1552604.exe

Filesize
449KB

MD5
0ec6f1d0439821e4461c176a486380aa

SHA1
1aae6c16ab056a698391ad35115d969147e18bb5

SHA256
91ee5195e5fe73aaeb3663c88462857266770e50c4d585d27c000784ccb9e448

SHA512
d61f9a169b67505e942e144895489807815d9ae4eb75e0dfe963f8e1f21a149e0d038fee7debfed3c7e14eead3ada2075a29fb6ceeb70ef5a2ba63ca2950cda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1131515.exe

Filesize
277KB

MD5
3705524f538a0b56aad1ed915c79f100

SHA1
3d81926e5f02c1543e1d5dab5b6218ba239150b8

SHA256
195730c01b61f99fdb032f28b3e13b899e19576fe9ac12e8be3d713716e6ea32

SHA512
634779d8a165d91d18b139921da8f641413a1bc359857063d7c23100fffda01682b2bca5bbe778c0dce204b0da413c5f70713294074740ab81d670f60a203577

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k1756823.exe

Filesize
161KB

MD5
ccc38f8fc8af71cfe8996e1fdc5dd1bf

SHA1
3775a9c14b10e99085d8671a07c936c7998e7caf

SHA256
63838de0464491187980d10f17447a09a44b595af97604066dc021f3df790be2

SHA512
2e102e309e06c2f6599969471636796c57c0afedcb880089cc512ac1fab95a53954b3d476b2547ec785d4c26c7008da23dcc0e3295e38e446fbe22363e940019

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l8542573.exe

Filesize
168KB

MD5
b01f3cdd0b72bbaab7d7bda6255b5854

SHA1
49a45f3eefa0aabe0365c952741ddd9c8fbe9f88

SHA256
3d01856aa7e86a2c57f540f3d5122d70e37c799173642b11f3d96369ead89232

SHA512
3af946ff69d4560a00d08fc3b4a5fc42a468aaf0271a07bfa92549183fbb97b3a7d29b0a3f5354cbf36b4077f2a6863b807596c4180f62f22f3f82591654a01d

Download Submit
memory/1100-30-0x0000000000210000-0x000000000023E000-memory.dmp

Filesize
184KB

Download
memory/1100-31-0x00000000023F0000-0x00000000023F6000-memory.dmp

Filesize
24KB

Download
memory/1100-32-0x000000000A530000-0x000000000AB48000-memory.dmp

Filesize
6.1MB

Download
memory/1100-33-0x000000000A080000-0x000000000A18A000-memory.dmp

Filesize
1.0MB

Download
memory/1100-34-0x0000000009FB0000-0x0000000009FC2000-memory.dmp

Filesize
72KB

Download
memory/1100-35-0x000000000A010000-0x000000000A04C000-memory.dmp

Filesize
240KB

Download
memory/1100-36-0x0000000002450000-0x000000000249C000-memory.dmp

Filesize
304KB

Download
memory/2076-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads