healer | 442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc

General

Target

442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe
Size

1.5MB
MD5

b919a388cac91b83b576838afc2cbf34
SHA1

228165c079ed99771c43dd0ddfded06f0fab76f3
SHA256

442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc
SHA512

2e8ba962837dafabc3eed2ddcd0965f0ef87055ecdb44f4acfb7b6867fa2d91f5dcd2e40dfd0ef60d6e613f7826c6f532426940018c99dea87006da9b5f91d6b
SSDEEP

49152:iG9lRoqo0PtOWoX4HbIUypM+cvyOzKm4AN:/DOHXix+cqVm

Score

10^/10

healer redline max discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

max

C2

185.161.248.73:4164

Attributes

auth_value
efb1499709a5d08ed1ddf71cff71211f

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2424-35-0x0000000002070000-0x000000000208A000-memory.dmp	healer
behavioral1/memory/2424-37-0x0000000002530000-0x0000000002548000-memory.dmp	healer
behavioral1/memory/2424-53-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-65-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-63-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-61-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-59-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-57-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-55-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-51-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-49-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-47-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-45-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-43-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-41-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-38-0x0000000002530000-0x0000000002543000-memory.dmp	healer
behavioral1/memory/2424-39-0x0000000002530000-0x0000000002543000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a60850341.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a60850341.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a60850341.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a60850341.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a60850341.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a60850341.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c93-68.dat	family_redline
behavioral1/memory/4268-70-0x0000000000DC0000-0x0000000000DF0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1972	i22918571.exe
4928	i23774803.exe
1592	i78901595.exe
4292	i62460532.exe
2424	a60850341.exe
4268	b60115743.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a60850341.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a60850341.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	i22918571.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	i23774803.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	i78901595.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	i62460532.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3956	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i62460532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a60850341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b60115743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i22918571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i23774803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i78901595.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	a60850341.exe
2424	a60850341.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	a60850341.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1972	4716	442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe	83
PID 4716 wrote to memory of 1972	4716	442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe	83
PID 4716 wrote to memory of 1972	4716	442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe	83
PID 1972 wrote to memory of 4928	1972	i22918571.exe	84
PID 1972 wrote to memory of 4928	1972	i22918571.exe	84
PID 1972 wrote to memory of 4928	1972	i22918571.exe	84
PID 4928 wrote to memory of 1592	4928	i23774803.exe	86
PID 4928 wrote to memory of 1592	4928	i23774803.exe	86
PID 4928 wrote to memory of 1592	4928	i23774803.exe	86
PID 1592 wrote to memory of 4292	1592	i78901595.exe	87
PID 1592 wrote to memory of 4292	1592	i78901595.exe	87
PID 1592 wrote to memory of 4292	1592	i78901595.exe	87
PID 4292 wrote to memory of 2424	4292	i62460532.exe	89
PID 4292 wrote to memory of 2424	4292	i62460532.exe	89
PID 4292 wrote to memory of 2424	4292	i62460532.exe	89
PID 4292 wrote to memory of 4268	4292	i62460532.exe	99
PID 4292 wrote to memory of 4268	4292	i62460532.exe	99
PID 4292 wrote to memory of 4268	4292	i62460532.exe	99

C:\Users\Admin\AppData\Local\Temp\442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe
"C:\Users\Admin\AppData\Local\Temp\442c37fafbde798c99c72aa1a2affe6c0321a3d06ec3a990e4e4f28edb40f8fc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i22918571.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i22918571.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i23774803.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i23774803.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i78901595.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i78901595.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i62460532.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i62460532.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a60850341.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a60850341.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b60115743.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b60115743.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4268

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i22918571.exe

Filesize
1.2MB

MD5
2f1a74ecc2c33955f4c00a1d9ab22bfd

SHA1
062aadf6e621e90448d11b91d9c496b16fa0e9f5

SHA256
8af835221db5c4c849b4d3de8084cb2ab017f072c60ab6fcf7a549bf5fb0cb8f

SHA512
0bb13aae2c4357e8cb43b177fcc2be017c5786988cdb667ecd551ed0dbdcdde59a1ecc904d05ca13644df6b448741ba98dbd57d01c5063a558533a438ecdecbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i23774803.exe

Filesize
1.1MB

MD5
1a1a71a5703d59fcc36db064afabaefa

SHA1
e182d0ab74b0e1fb91c62a43c268c79c14081550

SHA256
f34bee2759f79938f2042ff2e96ceb6d33de7fc12b2f64ff231a185c43f3da17

SHA512
0472656299955933c25e5b02dd1c85472fd626f06f6d61f8a1a722957e253c0dd6c67041da020558156fc8e1d3fd5e008afe388e401eb17bc06c76a34273714a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i78901595.exe

Filesize
594KB

MD5
bc3d20ecc4dd8814cff2fb1e76bf677d

SHA1
2fbeff7d88ebe9d6a38b1c66a65bdaaaca122cd5

SHA256
08dd0d30ee5a47357fca4d58208008005c47978331da5ddbc07680eab3254d39

SHA512
196cba5a2b3539d35a78aea3c24ba7f67a8a2d06c63520a560f6eddcd541cc72ea1e9c6e4819bd5e8a5ae07d9cf9d780e01970b94149928f044c9d3674d143bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i62460532.exe

Filesize
310KB

MD5
5640c0bd2707dd35da117561c132eabf

SHA1
7f7074f58f75db7356229fafd07be3ec0409b2e5

SHA256
6beb1d4a901586c0df760b2ac7174285ef0a7bb65ca831e710e85ffd0d84c28c

SHA512
af9d41441fb115d97ac6471c9a2a04773463ce5f05d7abd99e24f23540e501a2bf76b1c4af1edf8b9c1778b3cc1d4ebc32094d9c11134e574394161ab7652dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a60850341.exe

Filesize
177KB

MD5
1c776c9a32817dd68d5fc1f59b6ed4bd

SHA1
e8cef59da39912cd9d508fb0de13cc842b83fe26

SHA256
9b3107a519334a1241ce21554ed54cf256d4190bdd165b09c0d5a9ff9e7713f7

SHA512
ff115e2b97e80efecc1fb38671a5738b7a8bdee2dceaec7a6d9289872aa03d24f0afd57a8440eb97c19963300c1154379aaa5f6ada9183c1652e33084598b80e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b60115743.exe

Filesize
168KB

MD5
38807f5c9ba08c5040b8876fd9f6ebdd

SHA1
6140e28448dc271ba097de0ea57abda78924349f

SHA256
de9f20eaa610c0d28a7f0269d8c45f7c47b8d780e6b6a39394a2d48e4c36910b

SHA512
c9075e161556eb24f7f90c4b755e3d4305e6c3f0b47a730066cb9177a36706f2485340eaba53c23534a22d6d1f8005bd911e7c1aded314a6e18acc8531549413

Download Submit
memory/2424-55-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-43-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-53-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-65-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-63-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-61-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-59-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-57-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-36-0x0000000004AE0000-0x0000000005084000-memory.dmp

Filesize
5.6MB

Download
memory/2424-51-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-49-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-47-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-45-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-37-0x0000000002530000-0x0000000002548000-memory.dmp

Filesize
96KB

Download
memory/2424-41-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-38-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-39-0x0000000002530000-0x0000000002543000-memory.dmp

Filesize
76KB

Download
memory/2424-35-0x0000000002070000-0x000000000208A000-memory.dmp

Filesize
104KB

Download
memory/4268-70-0x0000000000DC0000-0x0000000000DF0000-memory.dmp

Filesize
192KB

Download
memory/4268-71-0x00000000055E0000-0x00000000055E6000-memory.dmp

Filesize
24KB

Download
memory/4268-72-0x000000000B130000-0x000000000B748000-memory.dmp

Filesize
6.1MB

Download
memory/4268-73-0x000000000AC30000-0x000000000AD3A000-memory.dmp

Filesize
1.0MB

Download
memory/4268-74-0x000000000AB60000-0x000000000AB72000-memory.dmp

Filesize
72KB

Download
memory/4268-75-0x000000000ABC0000-0x000000000ABFC000-memory.dmp

Filesize
240KB

Download
memory/4268-76-0x0000000002F50000-0x0000000002F9C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads