healer | c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed

General

Target

c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe
Size

480KB
MD5

121621f2365b966228c396da8bc84c3e
SHA1

6833da1c97947c6892bcfd07b8e6faea786fc8c9
SHA256

c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed
SHA512

5a2eb15675ea5021ed25c60b23454a06d6b07cce214c1db7cbc9c19e9077583b856bd9e0e26d442fbf56c573f085ad5795f03ba37eec414b0417cee996ffe4ee
SSDEEP

12288:eMr4y90TFO0eETgEgILHW5c1u31UTPe8BLzwzfGkHy:yyg2EkEgoHCXKTpLzifpHy

Score

10^/10

healer redline dease discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dease

C2

217.196.96.101:4132

Attributes

auth_value
82e4d5f9abc21848e0345118814a4e6c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3084-15-0x0000000002190000-0x00000000021AA000-memory.dmp	healer
behavioral1/memory/3084-18-0x0000000004990000-0x00000000049A8000-memory.dmp	healer
behavioral1/memory/3084-21-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-46-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-44-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-42-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-40-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-48-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-38-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-36-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-34-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-32-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-30-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-28-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-26-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-24-0x0000000004990000-0x00000000049A2000-memory.dmp	healer
behavioral1/memory/3084-22-0x0000000004990000-0x00000000049A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k4388127.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k4388127.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k4388127.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k4388127.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k4388127.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k4388127.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c49-54.dat	family_redline
behavioral1/memory/2864-56-0x00000000003A0000-0x00000000003CE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3900	y5313195.exe
3084	k4388127.exe
2864	l8035849.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k4388127.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k4388127.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y5313195.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l8035849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y5313195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k4388127.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3084	k4388127.exe
3084	k4388127.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	k4388127.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3900	2252	c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe	83
PID 2252 wrote to memory of 3900	2252	c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe	83
PID 2252 wrote to memory of 3900	2252	c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe	83
PID 3900 wrote to memory of 3084	3900	y5313195.exe	84
PID 3900 wrote to memory of 3084	3900	y5313195.exe	84
PID 3900 wrote to memory of 3084	3900	y5313195.exe	84
PID 3900 wrote to memory of 2864	3900	y5313195.exe	93
PID 3900 wrote to memory of 2864	3900	y5313195.exe	93
PID 3900 wrote to memory of 2864	3900	y5313195.exe	93

C:\Users\Admin\AppData\Local\Temp\c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe
"C:\Users\Admin\AppData\Local\Temp\c7e30a789f16083873935c8cc0c169ff527b980490f442bf5ec020c7c5e6a7ed.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5313195.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5313195.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4388127.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4388127.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8035849.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8035849.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5313195.exe

Filesize
309KB

MD5
8e6250d0895354b61b384671a991e435

SHA1
699861d68af47f1937d6a12d9aa35690be37e5a1

SHA256
6df1b1808e908c5847cc55d354325ad9ae4580660a700334eac5cdd9115db5b8

SHA512
9af22784fc9b8702a68dcd7d8749dac7816a6fa58bcdda9481185bb05be80ef5a3254ce1da1109189b9140fb1267168bb6259356f44e8a3fa407e86671148e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4388127.exe

Filesize
181KB

MD5
0097d8e6de934f0da2a7fc387ed2e710

SHA1
0aa3c7a51897a254c24ac657742d0a5c58679d99

SHA256
fe8e0eced30ade329220422f7ce29ac628f65c61b5c510d8981e66799e3d3130

SHA512
d854b7538f6824d63b8b3e48f61dfb5587f6a928f76a69ef9994bf97901cd63c5926e1d16c66e4c53329c30ac9dd356c667b5305e1743d6d45e142a921446241

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8035849.exe

Filesize
168KB

MD5
7b57a5b71c9035ebc2e833f99622a685

SHA1
66cd314f6f854b38fca9d85011dd52f4115c7dac

SHA256
a4f677dbbe1444b5d2ea5cfac34bbfbd3800054391f7afcd8083e2fce3b9fd8c

SHA512
ab840648e96908df02eebd969ce60c12a800d1228097d5e03eaf7a75090c11dd5bb3fde6c64ef2d143f9c5df1a6c15336c8954b6dc8b05fecea260dd5be5de3d

Download Submit
memory/2864-62-0x00000000026B0000-0x00000000026FC000-memory.dmp

Filesize
304KB

Download
memory/2864-61-0x000000000A1A0000-0x000000000A1DC000-memory.dmp

Filesize
240KB

Download
memory/2864-60-0x000000000A140000-0x000000000A152000-memory.dmp

Filesize
72KB

Download
memory/2864-59-0x000000000A210000-0x000000000A31A000-memory.dmp

Filesize
1.0MB

Download
memory/2864-58-0x000000000A720000-0x000000000AD38000-memory.dmp

Filesize
6.1MB

Download
memory/2864-57-0x0000000002730000-0x0000000002736000-memory.dmp

Filesize
24KB

Download
memory/2864-56-0x00000000003A0000-0x00000000003CE000-memory.dmp

Filesize
184KB

Download
memory/3084-36-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-22-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-42-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-40-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-48-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-38-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-46-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-34-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-32-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-30-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-28-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-26-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-24-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-44-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-49-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

Filesize
4KB

Download
memory/3084-50-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/3084-52-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/3084-21-0x0000000004990000-0x00000000049A2000-memory.dmp

Filesize
72KB

Download
memory/3084-20-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/3084-19-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/3084-18-0x0000000004990000-0x00000000049A8000-memory.dmp

Filesize
96KB

Download
memory/3084-17-0x0000000004B60000-0x0000000005104000-memory.dmp

Filesize
5.6MB

Download
memory/3084-16-0x0000000073E80000-0x0000000074630000-memory.dmp

Filesize
7.7MB

Download
memory/3084-15-0x0000000002190000-0x00000000021AA000-memory.dmp

Filesize
104KB

Download
memory/3084-14-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads