healer | 796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245

General

Target

796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe
Size

688KB
MD5

ac6bd097404320142421f54d772797e9
SHA1

848fe3f09c8042070db590c7061532a2ea80cf44
SHA256

796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245
SHA512

d4b35c4f6645305ce8c3f36f5acf598c392a3e75eaf394afdc8c3ae788927df02c29c70b49ad4f3a05dc3da81202adf875c237cfb39c4788d616db0aae0d7ea0
SSDEEP

12288:UMrFy90i9/GIIJGjs6BALlGpkHDzPujL9kgQ0KXUR04s:5yLZGdIZyH/PujRkgbKE04s

Score

10^/10

healer redline lint discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes

auth_value
0e95262fb78243c67430f3148303e5b7

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b7c-19.dat	healer
behavioral1/memory/4824-22-0x0000000000BC0000-0x0000000000BCA000-memory.dmp	healer
behavioral1/memory/816-29-0x0000000007170000-0x000000000718A000-memory.dmp	healer
behavioral1/memory/816-31-0x00000000077A0000-0x00000000077B8000-memory.dmp	healer
behavioral1/memory/816-32-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-37-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-59-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-57-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-55-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-53-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-51-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-47-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-46-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-43-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-41-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-39-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-35-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-33-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer
behavioral1/memory/816-49-0x00000000077A0000-0x00000000077B2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ns0889VZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ns0889VZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ns0889VZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	py29dN96.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	py29dN96.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	py29dN96.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ns0889VZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ns0889VZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ns0889VZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	py29dN96.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	py29dN96.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	py29dN96.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b79-65.dat	family_redline
behavioral1/memory/4800-66-0x0000000000840000-0x0000000000872000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
3728	will9333.exe
4052	will6447.exe
4824	ns0889VZ.exe
816	py29dN96.exe
4800	qs9700ke.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	ns0889VZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	py29dN96.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	py29dN96.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	will6447.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	will9333.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	816	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	will6447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py29dN96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qs9700ke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	will9333.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4824	ns0889VZ.exe
4824	ns0889VZ.exe
816	py29dN96.exe
816	py29dN96.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	ns0889VZ.exe
Token: SeDebugPrivilege	816	py29dN96.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3728	1852	796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe	83
PID 1852 wrote to memory of 3728	1852	796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe	83
PID 1852 wrote to memory of 3728	1852	796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe	83
PID 3728 wrote to memory of 4052	3728	will9333.exe	85
PID 3728 wrote to memory of 4052	3728	will9333.exe	85
PID 3728 wrote to memory of 4052	3728	will9333.exe	85
PID 4052 wrote to memory of 4824	4052	will6447.exe	86
PID 4052 wrote to memory of 4824	4052	will6447.exe	86
PID 4052 wrote to memory of 816	4052	will6447.exe	94
PID 4052 wrote to memory of 816	4052	will6447.exe	94
PID 4052 wrote to memory of 816	4052	will6447.exe	94
PID 3728 wrote to memory of 4800	3728	will9333.exe	99
PID 3728 wrote to memory of 4800	3728	will9333.exe	99
PID 3728 wrote to memory of 4800	3728	will9333.exe	99

C:\Users\Admin\AppData\Local\Temp\796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe
"C:\Users\Admin\AppData\Local\Temp\796da2d87359bb80fd6c6959739ead17618846231719d8c6f91c7915c522a245.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will9333.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will9333.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will6447.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will6447.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns0889VZ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns0889VZ.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py29dN96.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py29dN96.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 1096
        5⤵
        Program crash
        
        PID:1884
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9700ke.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9700ke.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 816 -ip 816
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will9333.exe

Filesize
502KB

MD5
799c4b1e41904c8ef48544adf50e7f7b

SHA1
3e2d9d86d2db7ea2d4b01b4b5561d5958042ca3b

SHA256
806079dbcc3a77b0e3b6efb047763cd1a8c8ba0421cc248224a7bbe5443c73dd

SHA512
4126974da7beee5511958f1b1b594c501fda1112fb2915e2b4515f832e45a135f61b61107c631623e8c07c24d8bfd6d2797103d321efd60a2050f2c69d2187d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs9700ke.exe

Filesize
175KB

MD5
0ecc8ab62b7278cc6650517251f1543c

SHA1
b4273cda193a20d48e83241275ffc34ddad412f2

SHA256
b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

SHA512
c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will6447.exe

Filesize
357KB

MD5
06f41b2353be19e40026a5bad7d8cd8c

SHA1
914c2c1ddb0109c92a6d159258549e4f3ea2faff

SHA256
f33371fa1f12975bf7804494e15be70782237e1ffb10b59a54bb3e3845a871d3

SHA512
750715fa88d09b74df48f547f87b6c9c59e03153de5c2de0543560b1b85251293d7c1f47d97227335d955cabc9291cc0dbb040f62a255d947c7dd3b89aaf6a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns0889VZ.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py29dN96.exe

Filesize
337KB

MD5
4ae415bede1d28792efae3b7d8ed23a5

SHA1
f71140831308cd442892eca6c8730ce19c4644ab

SHA256
43c1619cb80820a4a3d8bfa1afdd5c7bb5c0c480901b462dd6536b6107373c2e

SHA512
9294120dd8a748eb42d91322b7d90168754d12db66ba4f17155c7a4e1db3793ec05d48f2ae83eb81446363058bc9bdd74d8b63286e9c58c1fca244f58f548af0

Download Submit
memory/816-51-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-41-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-29-0x0000000007170000-0x000000000718A000-memory.dmp

Filesize
104KB

Download
memory/816-30-0x00000000071B0000-0x0000000007754000-memory.dmp

Filesize
5.6MB

Download
memory/816-31-0x00000000077A0000-0x00000000077B8000-memory.dmp

Filesize
96KB

Download
memory/816-32-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-37-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-59-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-57-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-55-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-53-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-62-0x0000000000400000-0x0000000002B04000-memory.dmp

Filesize
39.0MB

Download
memory/816-47-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-46-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-43-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-60-0x0000000000400000-0x0000000002B04000-memory.dmp

Filesize
39.0MB

Download
memory/816-39-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-35-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-33-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-49-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/4800-66-0x0000000000840000-0x0000000000872000-memory.dmp

Filesize
200KB

Download
memory/4800-67-0x0000000005680000-0x0000000005C98000-memory.dmp

Filesize
6.1MB

Download
memory/4800-68-0x00000000051E0000-0x00000000052EA000-memory.dmp

Filesize
1.0MB

Download
memory/4800-69-0x0000000005110000-0x0000000005122000-memory.dmp

Filesize
72KB

Download
memory/4800-70-0x0000000005170000-0x00000000051AC000-memory.dmp

Filesize
240KB

Download
memory/4800-71-0x00000000052F0000-0x000000000533C000-memory.dmp

Filesize
304KB

Download
memory/4824-23-0x00007FFB80433000-0x00007FFB80435000-memory.dmp

Filesize
8KB

Download
memory/4824-21-0x00007FFB80433000-0x00007FFB80435000-memory.dmp

Filesize
8KB

Download
memory/4824-22-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads