healer | bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8

General

Target

bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe
Size

860KB
MD5

72ce993ee26a2be7db87c2968142d6f6
SHA1

22d54998a8098ff3ab61b4658ab333f03399c7f9
SHA256

bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8
SHA512

a948367d7f3c1b7cc737b8538d9ce51b90e30ba3dc727a0ac6a56adb232d9c628ed49ba55fb563f4bf0831aa4088a100f5ed378c8008f0542ed08cf1e8dc12ac
SSDEEP

12288:2Mr1y90QiY1h81pzoPO0/bGm6ZshtLZ3BHsT863T6U0EUJ7OE43E7x2Obo:7yH7vWpzoG0j/3LTI863T6lOE432x2b

Score

10^/10

healer redline dubka discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes

auth_value
e5a9421183a033f283b2f23139b471f0

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4064-25-0x0000000002720000-0x000000000273A000-memory.dmp	healer
behavioral1/memory/4064-27-0x00000000028F0000-0x0000000002908000-memory.dmp	healer
behavioral1/memory/4064-28-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-35-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-55-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-53-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-51-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-49-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-47-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-43-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-41-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-39-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-37-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-33-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-31-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-29-0x00000000028F0000-0x0000000002902000-memory.dmp	healer
behavioral1/memory/4064-45-0x00000000028F0000-0x0000000002902000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	mOO89rU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	mOO89rU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	mOO89rU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	mOO89rU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	mOO89rU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	mOO89rU.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cba-64.dat	family_redline
behavioral1/memory/464-66-0x0000000000230000-0x0000000000262000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
3012	dMt9717.exe
404	dTc6284.exe
4064	mOO89rU.exe
464	nab84ai.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	mOO89rU.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	mOO89rU.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	dMt9717.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	dTc6284.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	4064	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dMt9717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dTc6284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mOO89rU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nab84ai.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	mOO89rU.exe
4064	mOO89rU.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	mOO89rU.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3012	4976	bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe	83
PID 4976 wrote to memory of 3012	4976	bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe	83
PID 4976 wrote to memory of 3012	4976	bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe	83
PID 3012 wrote to memory of 404	3012	dMt9717.exe	84
PID 3012 wrote to memory of 404	3012	dMt9717.exe	84
PID 3012 wrote to memory of 404	3012	dMt9717.exe	84
PID 404 wrote to memory of 4064	404	dTc6284.exe	86
PID 404 wrote to memory of 4064	404	dTc6284.exe	86
PID 404 wrote to memory of 4064	404	dTc6284.exe	86
PID 404 wrote to memory of 464	404	dTc6284.exe	100
PID 404 wrote to memory of 464	404	dTc6284.exe	100
PID 404 wrote to memory of 464	404	dTc6284.exe	100

C:\Users\Admin\AppData\Local\Temp\bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe
"C:\Users\Admin\AppData\Local\Temp\bf341e3686e0147c75d3e30f855eb8356e6f6bb088e791f949ecdfd70ad07fa8.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dMt9717.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dMt9717.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTc6284.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTc6284.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mOO89rU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mOO89rU.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 1084
        5⤵
        Program crash
        
        PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nab84ai.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nab84ai.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4064 -ip 4064
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dMt9717.exe

Filesize
715KB

MD5
d909a3e3c58b88d8af1d1536771604c6

SHA1
bdd2fe2f259f70f784c36eb6dd9cd38b1b0a684d

SHA256
e5b9fa7d22918e74cfcec7c6968f3b8a4615a6751fbe6f745385cc75a58d8739

SHA512
86deb4288027963804852a0f808d46367d0e3fcb720ed7d74291f654390a097b3446e4e81f9daca8615a9e30f780e7a6e4fbd4ebeb17bf023614c2271a2c92cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTc6284.exe

Filesize
379KB

MD5
8b656ca624117562be64412d024104a6

SHA1
5aac5f18e8098369e30d75ca58176b4937feb547

SHA256
722ff7e738b47e20139aa0a54ff51caaca6b22146a44dd1a269c8eca17629975

SHA512
6fee1af0201c8055c670b49e7eebd976dd63f4336144a2a666a99c3596bbe91ab678dff1bcc8a8cd20807ffdc6123f6b13a55a32d35a5423d038e612620a2f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mOO89rU.exe

Filesize
245KB

MD5
bbcaab6d431de6d63e20ec7a085b0526

SHA1
e5bb15ef7458b516b37602649498b3d13c4df67d

SHA256
e0bd77d953de9c400b8338ca69f2aeb4eadfae945c75081b3c61fcc23ede76ee

SHA512
4f9ba138d9b458bb24907b2873a5eb0648858a60c0afac97c7b41adc2a3033d12037770b8d266ec8e2fb821dc8dcefc65c7150af534110e407a9cc672e317ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nab84ai.exe

Filesize
175KB

MD5
dd0c9e110c68ce1fa5308979ef718f7b

SHA1
473deb8069f0841d47b74b7f414dacc6f96eca78

SHA256
dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

SHA512
29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

Download Submit
memory/464-71-0x0000000004E20000-0x0000000004E6C000-memory.dmp

Filesize
304KB

Download
memory/464-70-0x0000000004CA0000-0x0000000004CDC000-memory.dmp

Filesize
240KB

Download
memory/464-69-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/464-68-0x0000000004D10000-0x0000000004E1A000-memory.dmp

Filesize
1.0MB

Download
memory/464-67-0x0000000005190000-0x00000000057A8000-memory.dmp

Filesize
6.1MB

Download
memory/464-66-0x0000000000230000-0x0000000000262000-memory.dmp

Filesize
200KB

Download
memory/4064-39-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-45-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-53-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-51-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-49-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-47-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-43-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-41-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-35-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-37-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-33-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-31-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-29-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-55-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-56-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4064-57-0x0000000000910000-0x0000000000A10000-memory.dmp

Filesize
1024KB

Download
memory/4064-58-0x0000000000640000-0x000000000066D000-memory.dmp

Filesize
180KB

Download
memory/4064-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4064-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4064-61-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4064-28-0x00000000028F0000-0x0000000002902000-memory.dmp

Filesize
72KB

Download
memory/4064-27-0x00000000028F0000-0x0000000002908000-memory.dmp

Filesize
96KB

Download
memory/4064-26-0x0000000004E80000-0x0000000005424000-memory.dmp

Filesize
5.6MB

Download
memory/4064-25-0x0000000002720000-0x000000000273A000-memory.dmp

Filesize
104KB

Download
memory/4064-24-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4064-23-0x0000000000640000-0x000000000066D000-memory.dmp

Filesize
180KB

Download
memory/4064-22-0x0000000000910000-0x0000000000A10000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads