healer | 4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f

General

Target

4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe
Size

479KB
MD5

3be509fc3b6d4fc036e3a808471a1426
SHA1

0fef31408b76787cf1b93425c2c9dfa2619b804a
SHA256

4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f
SHA512

e63f23e213e102b25f4de89054dac03ff5424bd2fb83abf8be99734353987f868439fb84a6f9b0466d87e65c49920274d99caa0383fb8fc894ac2ee26583af07
SSDEEP

6144:K9y+bnr+Dp0yN90QEXwp3yFkLKCrInepRJIVKxtbcVSP4ART2MguqX6zwRCbUfUF:HMrjy90udOzZUcVSPt5SKzcIs6jrF

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3436-15-0x00000000048D0000-0x00000000048EA000-memory.dmp	healer
behavioral1/memory/3436-18-0x0000000004980000-0x0000000004998000-memory.dmp	healer
behavioral1/memory/3436-48-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-46-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-44-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-42-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-32-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-40-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-38-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-36-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-34-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-30-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-28-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-26-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-24-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-22-0x0000000004980000-0x0000000004992000-memory.dmp	healer
behavioral1/memory/3436-21-0x0000000004980000-0x0000000004992000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k7298159.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k7298159.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k7298159.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k7298159.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k7298159.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k7298159.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/memory/1028-56-0x0000000000090000-0x00000000000B8000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c82-55.dat	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2776	y0701905.exe
3436	k7298159.exe
1028	l3716582.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k7298159.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k7298159.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y0701905.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y0701905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k7298159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l3716582.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3436	k7298159.exe
3436	k7298159.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3436	k7298159.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2776	2016	4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe	85
PID 2016 wrote to memory of 2776	2016	4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe	85
PID 2016 wrote to memory of 2776	2016	4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe	85
PID 2776 wrote to memory of 3436	2776	y0701905.exe	86
PID 2776 wrote to memory of 3436	2776	y0701905.exe	86
PID 2776 wrote to memory of 3436	2776	y0701905.exe	86
PID 2776 wrote to memory of 1028	2776	y0701905.exe	101
PID 2776 wrote to memory of 1028	2776	y0701905.exe	101
PID 2776 wrote to memory of 1028	2776	y0701905.exe	101

C:\Users\Admin\AppData\Local\Temp\4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe
"C:\Users\Admin\AppData\Local\Temp\4851dcf5819c0fb42d7b9e8bb4accb862c9663806ad5f2407b8c788ef70afd9f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0701905.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0701905.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7298159.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7298159.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3716582.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3716582.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0701905.exe

Filesize
307KB

MD5
56c06bf8c1bd2f4106fa9d532b8724bf

SHA1
9fec8cb079126b16afeb665f5b534f5d14daa9f6

SHA256
381fc6b5f3c6fc06d0139adde50db1c1c1594a000937bb67f93a858a02673436

SHA512
0710f9b49c08ad2937b58fc667a3b95354a37bb31ebd0761f016cc317201361a56cf8b03b55323a7cec40cefbfb837885ddffa2892fb5297347817786903237c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7298159.exe

Filesize
175KB

MD5
fb77dcec0fec3b0117c37eb9daae2fe6

SHA1
af36116624fcd1fc13af712e6d17bf3800a2d0fb

SHA256
b204eda5139d23783a6c7c464cc8862c838024ae83d68408c90e78a7e079eab2

SHA512
cd85faa7e0150d649ca6688a1e572b7073bef37720d8641f051e7eef03c56adf38a89590aed74ed3ac2147045b3c30ea23d35d55771f5549f98c01c98f5b9e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3716582.exe

Filesize
136KB

MD5
c737d795774eec8e8cdf7f8ecbc2d5f5

SHA1
d07b0f7025274a40551a4a9f1b402b990c3f4eec

SHA256
e092ee3cab622f95e1a03fb571da493614baf9fc0a7aca09d9bccb0277e2388d

SHA512
a51167b660251dde1ec7faa0a8affb25955b6f0b14c640db1c63d7c1ffea1fae7cdf1d61afccb464f7d2e2bd846c03efc71a1056807e89139bf5c2dcf312ec10

Download Submit
memory/1028-61-0x0000000006E90000-0x0000000006EDC000-memory.dmp

Filesize
304KB

Download
memory/1028-60-0x0000000006E50000-0x0000000006E8C000-memory.dmp

Filesize
240KB

Download
memory/1028-59-0x0000000006F20000-0x000000000702A000-memory.dmp

Filesize
1.0MB

Download
memory/1028-58-0x0000000006DB0000-0x0000000006DC2000-memory.dmp

Filesize
72KB

Download
memory/1028-57-0x0000000007330000-0x0000000007948000-memory.dmp

Filesize
6.1MB

Download
memory/1028-56-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/3436-36-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-22-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-44-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-42-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-32-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-40-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-38-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-48-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-34-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-30-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-28-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-26-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-24-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-46-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-21-0x0000000004980000-0x0000000004992000-memory.dmp

Filesize
72KB

Download
memory/3436-49-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/3436-50-0x0000000073D10000-0x00000000744C0000-memory.dmp

Filesize
7.7MB

Download
memory/3436-52-0x0000000073D10000-0x00000000744C0000-memory.dmp

Filesize
7.7MB

Download
memory/3436-20-0x0000000073D10000-0x00000000744C0000-memory.dmp

Filesize
7.7MB

Download
memory/3436-18-0x0000000004980000-0x0000000004998000-memory.dmp

Filesize
96KB

Download
memory/3436-19-0x0000000073D10000-0x00000000744C0000-memory.dmp

Filesize
7.7MB

Download
memory/3436-17-0x0000000004AB0000-0x0000000005054000-memory.dmp

Filesize
5.6MB

Download
memory/3436-16-0x0000000073D10000-0x00000000744C0000-memory.dmp

Filesize
7.7MB

Download
memory/3436-15-0x00000000048D0000-0x00000000048EA000-memory.dmp

Filesize
104KB

Download
memory/3436-14-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads