healer | 2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2

General

Target

2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe
Size

480KB
MD5

d1d4a5828cf450e8ed46fa95843247e3
SHA1

2989a4c21ddf12f4f14833f96bad28e419c0bf92
SHA256

2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2
SHA512

3f3f5cfa10b596a2db6add31593ffbcaa5a959bf7a3a154d9b0b742f4a38f4aa25e62817b05da3bcecda3f535b5d6636d84573d369ba15628176320a7196c81f
SSDEEP

12288:jMrAy90WhY7sD/lGhwcB8AUhYM7UgHbrj+A3:zylK7qwhdB8DXog7d3

Score

10^/10

healer redline mihan discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mihan

C2

217.196.96.101:4132

Attributes

auth_value
9a6a8fdae02ed7caa0a49a6ddc6d4520

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3468-15-0x00000000008F0000-0x000000000090A000-memory.dmp	healer
behavioral1/memory/3468-18-0x00000000023A0000-0x00000000023B8000-memory.dmp	healer
behavioral1/memory/3468-43-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-47-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-45-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-41-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-39-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-37-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-33-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-31-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-29-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-27-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-25-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-23-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-21-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-20-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer
behavioral1/memory/3468-35-0x00000000023A0000-0x00000000023B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9722668.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9722668.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9722668.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9722668.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9722668.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a9722668.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c9b-53.dat	family_redline
behavioral1/memory/1064-55-0x0000000000E20000-0x0000000000E50000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
688	v1638208.exe
3468	a9722668.exe
1064	b4168969.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a9722668.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9722668.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1638208.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v1638208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9722668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4168969.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3468	a9722668.exe
3468	a9722668.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	a9722668.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 688	408	2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe	83
PID 408 wrote to memory of 688	408	2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe	83
PID 408 wrote to memory of 688	408	2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe	83
PID 688 wrote to memory of 3468	688	v1638208.exe	84
PID 688 wrote to memory of 3468	688	v1638208.exe	84
PID 688 wrote to memory of 3468	688	v1638208.exe	84
PID 688 wrote to memory of 1064	688	v1638208.exe	95
PID 688 wrote to memory of 1064	688	v1638208.exe	95
PID 688 wrote to memory of 1064	688	v1638208.exe	95

C:\Users\Admin\AppData\Local\Temp\2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe
"C:\Users\Admin\AppData\Local\Temp\2dc6400630c791ee703f29bc4d9f911c3bb8129478e23f36a299e876a38c8ba2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1638208.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1638208.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a9722668.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a9722668.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4168969.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4168969.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1638208.exe

Filesize
309KB

MD5
4ef661651bd662e84b6090a61cf5c25e

SHA1
2a90186163178e63eb5db7fdc660147c0ece56e3

SHA256
81b586a7aba73b9be34a8715be7c213029d3d2ba88deb62e24dc9c20142567e7

SHA512
002a42521c7d7a799578f95be099814e4468c3698ec584b2f1ca797b1cc7d7141caa22c69c87c18145c1afc3eb4a96d3aa630d93a13982b0c9ab2a96167ba43e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a9722668.exe

Filesize
180KB

MD5
d145b86fa1b2be5b7e20492a7895f66d

SHA1
03419eb46feec6b2977b11142fe5cd1091b5f0ad

SHA256
67b9bbd228342e588951b6a6fb3e86974fb9bbb5248b2f0f1e23c829f698f750

SHA512
46da6dda722ee97cac92f4386d15ba4ba6eb7e970e6440a21f92ad34ae0b7419141572700892b4fca00faa72bd563d18edddf0665e7f597e25cd8de984a15798

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4168969.exe

Filesize
168KB

MD5
3b31780b627c8671cf63cfb8647d51ec

SHA1
986376db2308926aa6fb725bd8d8f4fb4f58ed0e

SHA256
8c71b74c11e5a297ed048305f8f61e773712c8466cefcc649f3b7858f26a98a3

SHA512
5d2395be686f681efc1ad324960002a587d1aaf510e5545aca1e72a63ebeef0a56ffbbd88be3ed54d055cbadf8fd524006be278ba4a55795b4866ac3a158a214

Download Submit
memory/1064-61-0x0000000005990000-0x00000000059DC000-memory.dmp

Filesize
304KB

Download
memory/1064-60-0x0000000005950000-0x000000000598C000-memory.dmp

Filesize
240KB

Download
memory/1064-59-0x00000000057D0000-0x00000000057E2000-memory.dmp

Filesize
72KB

Download
memory/1064-58-0x0000000005A20000-0x0000000005B2A000-memory.dmp

Filesize
1.0MB

Download
memory/1064-57-0x0000000005F30000-0x0000000006548000-memory.dmp

Filesize
6.1MB

Download
memory/1064-56-0x0000000003110000-0x0000000003116000-memory.dmp

Filesize
24KB

Download
memory/1064-55-0x0000000000E20000-0x0000000000E50000-memory.dmp

Filesize
192KB

Download
memory/3468-29-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-20-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-39-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-37-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-33-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-31-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-45-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-27-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-25-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-23-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-21-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-41-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-35-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-48-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Filesize
4KB

Download
memory/3468-49-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/3468-51-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/3468-47-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-43-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/3468-19-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/3468-18-0x00000000023A0000-0x00000000023B8000-memory.dmp

Filesize
96KB

Download
memory/3468-17-0x0000000004C90000-0x0000000005234000-memory.dmp

Filesize
5.6MB

Download
memory/3468-16-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/3468-15-0x00000000008F0000-0x000000000090A000-memory.dmp

Filesize
104KB

Download
memory/3468-14-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads