healer | afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9

General

Target

afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe
Size

855KB
MD5

878d473eb4c58e02fc9e5c6bb20577f7
SHA1

20e1d3dcefa915a75cf749ca91b345cb40a7acc7
SHA256

afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9
SHA512

bcaf876566e46410377f1b550f29ed246a84472c8b2bf9c22013e1d272246b00fd58e3ad7597b62a6b9c1780f359d19aa7c63248a8b17345f8e6d8cd53859185
SSDEEP

24576:7yfPR1xWjSMTgDMN1IQlYA0WMyYNNqqPZK8tRgI66:ufPR1xWjSMTgD41hZzLYNFPZU

Score

10^/10

healer redline dubka discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes

auth_value
e5a9421183a033f283b2f23139b471f0

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b7b-19.dat	healer
behavioral1/memory/4100-22-0x0000000000DE0000-0x0000000000DEA000-memory.dmp	healer
behavioral1/memory/688-29-0x0000000002370000-0x000000000238A000-memory.dmp	healer
behavioral1/memory/688-31-0x0000000002710000-0x0000000002728000-memory.dmp	healer
behavioral1/memory/688-32-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-41-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-59-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-57-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-55-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-53-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-51-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-49-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-47-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-45-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-43-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-39-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-37-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-35-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/688-33-0x0000000002710000-0x0000000002722000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	rHM2367.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sGx6184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sGx6184.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	rHM2367.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	rHM2367.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	rHM2367.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	rHM2367.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	sGx6184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sGx6184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sGx6184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sGx6184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	rHM2367.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b79-64.dat	family_redline
behavioral1/memory/2656-66-0x0000000000D10000-0x0000000000D42000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
3908	vfs4621.exe
4068	vjz2266.exe
4100	rHM2367.exe
688	sGx6184.exe
2656	tEy82VZ.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	sGx6184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	rHM2367.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	sGx6184.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vfs4621.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	vjz2266.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1728	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	688	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vjz2266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sGx6184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tEy82VZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vfs4621.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4100	rHM2367.exe
4100	rHM2367.exe
688	sGx6184.exe
688	sGx6184.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	rHM2367.exe
Token: SeDebugPrivilege	688	sGx6184.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3908	1288	afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe	83
PID 1288 wrote to memory of 3908	1288	afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe	83
PID 1288 wrote to memory of 3908	1288	afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe	83
PID 3908 wrote to memory of 4068	3908	vfs4621.exe	84
PID 3908 wrote to memory of 4068	3908	vfs4621.exe	84
PID 3908 wrote to memory of 4068	3908	vfs4621.exe	84
PID 4068 wrote to memory of 4100	4068	vjz2266.exe	85
PID 4068 wrote to memory of 4100	4068	vjz2266.exe	85
PID 4068 wrote to memory of 688	4068	vjz2266.exe	98
PID 4068 wrote to memory of 688	4068	vjz2266.exe	98
PID 4068 wrote to memory of 688	4068	vjz2266.exe	98
PID 3908 wrote to memory of 2656	3908	vfs4621.exe	103
PID 3908 wrote to memory of 2656	3908	vfs4621.exe	103
PID 3908 wrote to memory of 2656	3908	vfs4621.exe	103

C:\Users\Admin\AppData\Local\Temp\afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe
"C:\Users\Admin\AppData\Local\Temp\afc24047933d8816acd5cb61af65848bfcd574b59a59f5b266ccc39afc5550c9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vfs4621.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vfs4621.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vjz2266.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vjz2266.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rHM2367.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rHM2367.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sGx6184.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sGx6184.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 1084
        5⤵
        Program crash
        
        PID:2952
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tEy82VZ.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tEy82VZ.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 688 -ip 688
1⤵
PID:1620

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vfs4621.exe

Filesize
500KB

MD5
27b4fb33091779daba29af9b0b1d5d6c

SHA1
9a08f7c72e0e0330a7ab657fe3f095336d9467b0

SHA256
b0f77689d83535f931f1c53a60c380284003fb29b59dcfb550a568df91695ed4

SHA512
bc9f638991bfe42ef63ce5cd26f528b007daac6cee9d953c9a9568100d995104e3c80913f8ace88c76c6872736a0e7ad71d26f81647831534ac9fa05d2ce0930

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tEy82VZ.exe

Filesize
175KB

MD5
dd0c9e110c68ce1fa5308979ef718f7b

SHA1
473deb8069f0841d47b74b7f414dacc6f96eca78

SHA256
dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

SHA512
29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vjz2266.exe

Filesize
355KB

MD5
bbb3560385d2667278bc921d028aa68e

SHA1
0454667e59343c904aaf81354795c3b87b4e7f2d

SHA256
91c05d1ecd3c820581bd0e2096c56cfa3699e89a8527c0096bb638d5bdcf03ee

SHA512
98871a73f9593f9ea78352420aec3391ccabf90e847bfc59553dbee869335286aac01c3b0deac8d0fba0e7567b2ba1b53c1f973a31d8d84f1f16443991e7eeed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\rHM2367.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sGx6184.exe

Filesize
295KB

MD5
304766f61a677814af31d2737d118b6f

SHA1
213a7e70d4f7d13e17ddff12152bcfe2c1cc2de4

SHA256
07c33396ed7ec1b40808aae921c50c552dc21b08beabbd5541b9fc9f062e08ac

SHA512
08c9202e988e4f6518a14f37b19eefc8b5901a2c07472140303c48535b67830e956759db3738b3bf63559220cb1e59f8045a2fad5d84530e9cb2e670740441ea

Download Submit
memory/688-51-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-43-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-29-0x0000000002370000-0x000000000238A000-memory.dmp

Filesize
104KB

Download
memory/688-30-0x0000000004BF0000-0x0000000005194000-memory.dmp

Filesize
5.6MB

Download
memory/688-31-0x0000000002710000-0x0000000002728000-memory.dmp

Filesize
96KB

Download
memory/688-32-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-41-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-59-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-57-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-55-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-53-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-62-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/688-49-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-47-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-45-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-60-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/688-39-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-37-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-35-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/688-33-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/2656-66-0x0000000000D10000-0x0000000000D42000-memory.dmp

Filesize
200KB

Download
memory/2656-67-0x0000000005C80000-0x0000000006298000-memory.dmp

Filesize
6.1MB

Download
memory/2656-68-0x00000000057F0000-0x00000000058FA000-memory.dmp

Filesize
1.0MB

Download
memory/2656-69-0x0000000005720000-0x0000000005732000-memory.dmp

Filesize
72KB

Download
memory/2656-70-0x0000000005780000-0x00000000057BC000-memory.dmp

Filesize
240KB

Download
memory/2656-71-0x0000000005900000-0x000000000594C000-memory.dmp

Filesize
304KB

Download
memory/4100-23-0x00007FFB808E3000-0x00007FFB808E5000-memory.dmp

Filesize
8KB

Download
memory/4100-22-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

Filesize
40KB

Download
memory/4100-21-0x00007FFB808E3000-0x00007FFB808E5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads