healer | be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c

General

Target

be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe
Size

480KB
MD5

d5e5e6696b3aa88baed5e012dac427a9
SHA1

b137651509057f548c030e5414dffd8e619c62c7
SHA256

be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c
SHA512

35aa6a256af3ed5ca29ec24efb12d28df418ab1c50a2bdbc1732a036cfa6d1188d29c66d02b5804a70edf4145cdd80220143f30cd18a74d3e1a5074323782cd4
SSDEEP

12288:7MrXy90khhCMrIRtLURmTkE5xJNOuxpQK:cythoMWUE11pQK

Score

10^/10

healer redline misfa discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

misfa

C2

217.196.96.101:4132

Attributes

auth_value
be2e6d9f1a5e54a81340947b20e561c1

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4760-15-0x0000000002350000-0x000000000236A000-memory.dmp	healer
behavioral1/memory/4760-18-0x00000000023B0000-0x00000000023C8000-memory.dmp	healer
behavioral1/memory/4760-29-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-45-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-43-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-41-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-39-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-37-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-47-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-33-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-31-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-27-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-25-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-23-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-21-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-20-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer
behavioral1/memory/4760-35-0x00000000023B0000-0x00000000023C2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a2392294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2392294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2392294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2392294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2392294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2392294.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c48-55.dat	family_redline
behavioral1/memory/2604-56-0x0000000000B40000-0x0000000000B6E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
532	v3090756.exe
4760	a2392294.exe
2604	b6732191.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a2392294.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2392294.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v3090756.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3090756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2392294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6732191.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4760	a2392294.exe
4760	a2392294.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	a2392294.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 532	2252	be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe	83
PID 2252 wrote to memory of 532	2252	be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe	83
PID 2252 wrote to memory of 532	2252	be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe	83
PID 532 wrote to memory of 4760	532	v3090756.exe	84
PID 532 wrote to memory of 4760	532	v3090756.exe	84
PID 532 wrote to memory of 4760	532	v3090756.exe	84
PID 532 wrote to memory of 2604	532	v3090756.exe	95
PID 532 wrote to memory of 2604	532	v3090756.exe	95
PID 532 wrote to memory of 2604	532	v3090756.exe	95

C:\Users\Admin\AppData\Local\Temp\be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe
"C:\Users\Admin\AppData\Local\Temp\be742fed3348270722a15da8580e40a0e93038b84c45d8370012f35cb22dd37c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3090756.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3090756.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2392294.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2392294.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b6732191.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b6732191.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3090756.exe

Filesize
309KB

MD5
186f623be1d02860d8c9121b5e9897ea

SHA1
2e61a16bb3e333cc79c3506641b4d4e339c6f6a7

SHA256
e74fceeaf79b26ac1c85227f1538a66cca09d8c55e8966b1f004c0ae3566be05

SHA512
f12b3517d47b1e33f8f825a37579c3d0a0d5ebac060fbc5cf568b1e01ab28432c67342ee4fc07b1bd82cf606606be3a6530d3feb7ce8eedfc5ff1f49450e53a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2392294.exe

Filesize
178KB

MD5
75833accf1ed59d2a6addc1faa601703

SHA1
5a71cd7b4422e98861c3de3b69bbe6eeb50b7895

SHA256
268b32bc779da6b96b749827b80cad32c05314257e8b954a42b37db3582746d0

SHA512
2b73f442cd62a2f85394b56ac9ac622ab7f8aa1d8ba6c58c2e03e938db209608fd42fad9e3c05eda74a8ea1f8f386fa840f3068eb05d2f1d49e6067caddcf2e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b6732191.exe

Filesize
168KB

MD5
7fc067bea6ed073115182ad2e8fd6049

SHA1
2208f2484695fb7ea02608e2cbf43f96b92321bc

SHA256
662d505a552ca31e5f595ae0219bdce4ee90251c997dcf84874fe0afa37cd714

SHA512
387d4d5ac8964f31bca5a3553330d718dd4967276d470a76ee59185ff7117aff1ba205db39af638d03feaa15ba75beef4188721f1a1f8e90f9731858698762c6

Download Submit
memory/2604-62-0x0000000005570000-0x00000000055BC000-memory.dmp

Filesize
304KB

Download
memory/2604-61-0x0000000005520000-0x000000000555C000-memory.dmp

Filesize
240KB

Download
memory/2604-60-0x00000000054B0000-0x00000000054C2000-memory.dmp

Filesize
72KB

Download
memory/2604-59-0x00000000055F0000-0x00000000056FA000-memory.dmp

Filesize
1.0MB

Download
memory/2604-58-0x0000000005B00000-0x0000000006118000-memory.dmp

Filesize
6.1MB

Download
memory/2604-57-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/2604-56-0x0000000000B40000-0x0000000000B6E000-memory.dmp

Filesize
184KB

Download
memory/4760-33-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-35-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-41-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-39-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-37-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-47-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-48-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/4760-31-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-27-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-25-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-23-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-21-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-20-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-43-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-49-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

Filesize
4KB

Download
memory/4760-50-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/4760-52-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/4760-45-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-29-0x00000000023B0000-0x00000000023C2000-memory.dmp

Filesize
72KB

Download
memory/4760-19-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/4760-18-0x00000000023B0000-0x00000000023C8000-memory.dmp

Filesize
96KB

Download
memory/4760-16-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/4760-17-0x0000000004A50000-0x0000000004FF4000-memory.dmp

Filesize
5.6MB

Download
memory/4760-15-0x0000000002350000-0x000000000236A000-memory.dmp

Filesize
104KB

Download
memory/4760-14-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads