healer | 5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df

General

Target

5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe
Size

478KB
MD5

f3cb3a0da428790bd194b99d27f9f380
SHA1

0aa6798b5760bd7e385ae381cf1db44f3f246178
SHA256

5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df
SHA512

dea4034cae13a81507b25ede8f0ceba45b615eab14d6abfc8f71499b3dfc6ce9d8311b9cd3070a957fc990dd6fe2ce732e754e2ca0f4070df7e89628acd9a243
SSDEEP

12288:pMr5y90QeczUQ55DZHbOsFmYHjcivYFOHgL:EyN555FIYHjdmOHo

Score

10^/10

healer redline mauga discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mauga

C2

217.196.96.102:4132

Attributes

auth_value
36f5411cf117f54076fbbb9ea0631fee

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4008-15-0x0000000004A10000-0x0000000004A2A000-memory.dmp	healer
behavioral1/memory/4008-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral1/memory/4008-47-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-45-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-43-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-41-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-39-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-37-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-35-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-33-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-31-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-29-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-27-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-25-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-23-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/4008-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3098769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3098769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3098769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3098769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3098769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a3098769.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b94-54.dat	family_redline
behavioral1/memory/4080-56-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3576	v4672763.exe
4008	a3098769.exe
4080	b2654033.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a3098769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3098769.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4672763.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4672763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3098769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2654033.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	a3098769.exe
4008	a3098769.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	a3098769.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3576	2720	5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe	83
PID 2720 wrote to memory of 3576	2720	5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe	83
PID 2720 wrote to memory of 3576	2720	5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe	83
PID 3576 wrote to memory of 4008	3576	v4672763.exe	84
PID 3576 wrote to memory of 4008	3576	v4672763.exe	84
PID 3576 wrote to memory of 4008	3576	v4672763.exe	84
PID 3576 wrote to memory of 4080	3576	v4672763.exe	93
PID 3576 wrote to memory of 4080	3576	v4672763.exe	93
PID 3576 wrote to memory of 4080	3576	v4672763.exe	93

C:\Users\Admin\AppData\Local\Temp\5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe
"C:\Users\Admin\AppData\Local\Temp\5f0f954edaa9bef5bdb925286c66a403ddfb9f9b64b6e71b178600de1d7c36df.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4672763.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4672763.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3098769.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3098769.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2654033.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2654033.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4672763.exe

Filesize
307KB

MD5
efad3ae43f6c44b9c13db02698657456

SHA1
1d6ceab16dbef7c4d33ebc6b83b1ade6db087406

SHA256
6aea34a3732552fc6851c6f769912448313f3f989a41a4633ee71c2c1bcc97b4

SHA512
911be1062714f935b0b8a685e56f823fa297038f64a143304c98d1160e87c5c33859b09902ccc8b2bdbbfc67ebb788aa641f7afd2940aebea24bb7a7cc16d8c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3098769.exe

Filesize
182KB

MD5
7aaba273a30e57c4bab4863db941d9f1

SHA1
0914a868ff71787aa53eb736e99d2ee5e9bc37e9

SHA256
f24e0b7e0b7723010ae20ec6b5be6820f5b117d06110e4847eb04a47362af7a0

SHA512
b5d59df189e70aebd8d7ee6644ef38c3c5a75962c011bc8747f571d719a4cdc7111c9bf34af2d76bd1b77126b4eabeee84afb5811873ff1839d6551cd8366da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2654033.exe

Filesize
168KB

MD5
734ece795e2ef807703ff269caf184ff

SHA1
d5b9e510fcc80a9df023f5c4028beeab71ba26a5

SHA256
1ee2f1820dddefba9bb9037b2e6a80b6d193ae9b668d488a9e907c25bb2356af

SHA512
054468fffe90f87c02975eda7a047ae38f7c232dfdc976eab245f7da252e54cb230d520cc772a2df7dc289cd552c61f034c304a5a931e2ff332234ef13f21491

Download Submit
memory/4008-33-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-50-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/4008-17-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/4008-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/4008-19-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/4008-47-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-27-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-43-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-41-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-39-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-37-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-35-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-48-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/4008-15-0x0000000004A10000-0x0000000004A2A000-memory.dmp

Filesize
104KB

Download
memory/4008-31-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-29-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-45-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-25-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-23-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/4008-49-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/4008-16-0x0000000004B30000-0x00000000050D4000-memory.dmp

Filesize
5.6MB

Download
memory/4008-52-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/4008-14-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/4080-56-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Filesize
184KB

Download
memory/4080-57-0x0000000005430000-0x0000000005436000-memory.dmp

Filesize
24KB

Download
memory/4080-58-0x000000000AE70000-0x000000000B488000-memory.dmp

Filesize
6.1MB

Download
memory/4080-59-0x000000000A980000-0x000000000AA8A000-memory.dmp

Filesize
1.0MB

Download
memory/4080-60-0x000000000A8B0000-0x000000000A8C2000-memory.dmp

Filesize
72KB

Download
memory/4080-61-0x000000000A910000-0x000000000A94C000-memory.dmp

Filesize
240KB

Download
memory/4080-62-0x0000000004DF0000-0x0000000004E3C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads