healer | aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de

General

Target

aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe
Size

478KB
MD5

84e29cdc73344bdf7bd83888a27d5b16
SHA1

a2c6f7adb08c8ec2e5e6e19021589fd859e7a4b7
SHA256

aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de
SHA512

ea00972661d53b7f11e5a2e6de407bb6fd170dc9bc95651ba2e6ef43647763d00add68f29e454568fde41b1aa1ce92504e7b7f5700d8ef38416ecb51cd90c0ab
SSDEEP

12288:eMrDy90/WWrH7hvW8DoxRBRkj96oZwz7AI:NyA/vNLj9Ab

Score

10^/10

healer redline morty discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

morty

C2

217.196.96.101:4132

Attributes

auth_value
fe1a24c211cc8e5bf9ff11c737ce0e97

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4644-15-0x0000000000910000-0x000000000092A000-memory.dmp	healer
behavioral1/memory/4644-18-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/4644-29-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-47-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-45-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-43-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-41-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-39-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-37-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-35-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-33-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-31-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-25-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-23-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-21-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-20-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/4644-27-0x0000000004980000-0x0000000004992000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1421986.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1421986.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1421986.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1421986.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1421986.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1421986.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b78-54.dat	family_redline
behavioral1/memory/860-56-0x0000000000010000-0x000000000003E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3688	v8522109.exe
4644	a1421986.exe
860	b3553776.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1421986.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1421986.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8522109.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v8522109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1421986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3553776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	a1421986.exe
4644	a1421986.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	a1421986.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3688	3856	aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe	83
PID 3856 wrote to memory of 3688	3856	aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe	83
PID 3856 wrote to memory of 3688	3856	aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe	83
PID 3688 wrote to memory of 4644	3688	v8522109.exe	84
PID 3688 wrote to memory of 4644	3688	v8522109.exe	84
PID 3688 wrote to memory of 4644	3688	v8522109.exe	84
PID 3688 wrote to memory of 860	3688	v8522109.exe	95
PID 3688 wrote to memory of 860	3688	v8522109.exe	95
PID 3688 wrote to memory of 860	3688	v8522109.exe	95

C:\Users\Admin\AppData\Local\Temp\aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe
"C:\Users\Admin\AppData\Local\Temp\aa0ef8163cb076b3dc28e11262833dbb5221e39287ebe268e99a6217bdbb53de.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8522109.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8522109.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1421986.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1421986.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3553776.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3553776.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8522109.exe

Filesize
307KB

MD5
20f5926f178f5412a45f76def4cc7255

SHA1
1c450257a65af0561595663e9f9b86ff6a8d9507

SHA256
38d3b6bed0dff4e555c165a405b72b8c5b9477d17047cc2803288cf354ec8a1d

SHA512
3d46a024d18e55afce7fe774a0866e37bd8d0c06d848a3acd1e56df1a56e50f50abc605c0453b00b178273b01d7eb02e33643426e44711f0b061d3458581d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1421986.exe

Filesize
178KB

MD5
1fd9479053e33bd6656b99bc3cb7c256

SHA1
c9b282e47a91c33e6ab3ac7cfebf5bf591259b1b

SHA256
41a0f7b5bd8ba880724ffedd931e5a3265ebd1950420ab7c1ccb5943a8295a4c

SHA512
6323004605448d7859fe0709523a3651a93b071066f3b624ee7d92aeb53cf41018a52c57e17bdc72ac752b0bca1343b8d278a0e6922a1b82957b73ce1b10768e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3553776.exe

Filesize
168KB

MD5
e547c0eecd7c475949119360286d5a67

SHA1
849afcffb28564deef3b89966c8e6d663a87c695

SHA256
f7b3f3177339e582d27593f9db0deebfd026882e629be18a721c222ab43fa9f5

SHA512
a3da3d6acd6ce0f1f62e6cd28a85399d9b6d20f633132a7ce3c8a34cb621e0068895805e5094e26b082f399e6cbdcb55c79688c1807a1349f386ed5c52b6678f

Download Submit
memory/860-62-0x0000000004A40000-0x0000000004A8C000-memory.dmp

Filesize
304KB

Download
memory/860-61-0x0000000004A00000-0x0000000004A3C000-memory.dmp

Filesize
240KB

Download
memory/860-60-0x0000000004880000-0x0000000004892000-memory.dmp

Filesize
72KB

Download
memory/860-59-0x0000000004B10000-0x0000000004C1A000-memory.dmp

Filesize
1.0MB

Download
memory/860-58-0x0000000005020000-0x0000000005638000-memory.dmp

Filesize
6.1MB

Download
memory/860-57-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/860-56-0x0000000000010000-0x000000000003E000-memory.dmp

Filesize
184KB

Download
memory/4644-33-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-27-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-41-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-39-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-37-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-35-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-45-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-31-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-25-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-23-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-48-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4644-21-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-20-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-43-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-49-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download
memory/4644-50-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4644-52-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4644-47-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-29-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/4644-19-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4644-18-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/4644-16-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4644-17-0x0000000004A00000-0x0000000004FA4000-memory.dmp

Filesize
5.6MB

Download
memory/4644-15-0x0000000000910000-0x000000000092A000-memory.dmp

Filesize
104KB

Download
memory/4644-14-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads