healer | e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc

General

Target

e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe
Size

479KB
MD5

91ff9d71403424485cb589d4777b4bc2
SHA1

8d4748a03c9f3eb759bc1322b786d7fc2b12af40
SHA256

e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc
SHA512

12e8ec8d3c9d400396107a8848e86375be67f8c2c6d9f7e4aed4816097a6fad13f98b86e7c478fc7abd428d2d322e3f7a6d9b4d7e0c151690cd72c70038c106e
SSDEEP

12288:hMrUy903aDqkWHKiEjJ/N+mWv4T+QQJ/4pNLFtmN7iO17i9/Y:Ny9iTEpNSQO17P

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2208-15-0x0000000002510000-0x000000000252A000-memory.dmp	healer
behavioral1/memory/2208-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp	healer
behavioral1/memory/2208-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-48-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer
behavioral1/memory/2208-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k0825218.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k0825218.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k0825218.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k0825218.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k0825218.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k0825218.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cc0-54.dat	family_redline
behavioral1/memory/3540-56-0x00000000004D0000-0x0000000000500000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3448	y9491505.exe
2208	k0825218.exe
3540	l6390271.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k0825218.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k0825218.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9491505.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1796	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y9491505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k0825218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l6390271.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2208	k0825218.exe
2208	k0825218.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	k0825218.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3448	540	e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe	85
PID 540 wrote to memory of 3448	540	e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe	85
PID 540 wrote to memory of 3448	540	e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe	85
PID 3448 wrote to memory of 2208	3448	y9491505.exe	86
PID 3448 wrote to memory of 2208	3448	y9491505.exe	86
PID 3448 wrote to memory of 2208	3448	y9491505.exe	86
PID 3448 wrote to memory of 3540	3448	y9491505.exe	97
PID 3448 wrote to memory of 3540	3448	y9491505.exe	97
PID 3448 wrote to memory of 3540	3448	y9491505.exe	97

C:\Users\Admin\AppData\Local\Temp\e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe
"C:\Users\Admin\AppData\Local\Temp\e25b7d76cc862dd6fd106c1cdbf29bd5c81cb7d1fbc2e9a45fc195fd62dc93fc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9491505.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9491505.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0825218.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0825218.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6390271.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6390271.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3540

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9491505.exe

Filesize
307KB

MD5
782e9d71069b3dc20c08e1d717414737

SHA1
db30757a8b077cfc96038d69c3bb2203730d5ddb

SHA256
bf1e85df9bf8d44dada0ec446a617d0e0c1c6fdb060edeb055ad35b8bf6c3401

SHA512
15adf6b053ff8f6a2b13938c3e23ac4aef1b622c5eba3a0a5ab0488a1f837cc886e9d8b74cd0e256322b14a6987beaf36e89546fa49c472c3521a6a0ce4766e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0825218.exe

Filesize
180KB

MD5
b4abf5bc690641e1ae5b23a79aebd529

SHA1
3f88318f0fb909c17dd8d460c6a1d28e92ec4094

SHA256
3b917cdb2dd63d3a6a0fe09e9aab0550f36af77a94607f65d2e2e0dd1746826b

SHA512
b0d0d2c792540ab35fc87c153f0c9e400100a8d23157cb52ce121e7103b2d27c640c48dc39a78a3ca42bd55f12fa1b43feae221364e81a5570fc6d0980db5b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l6390271.exe

Filesize
168KB

MD5
a986dd83b618ade8633d5ffbcad46ab5

SHA1
e4008542587a428b0c9fd5d884a904a52b7c137b

SHA256
a1251ab0ad11fa037278fa6aaca9768177d8904e62f937bd5ab1fc1a0033a0f7

SHA512
8e7a2a4251684280a62a972a8606ed688028386df3291490153d1b07370b182417f3d659a83d83650a49ca655e393653290c850e5147094d0f8293fc30bf698b

Download Submit
memory/2208-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-50-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/2208-17-0x0000000004B50000-0x00000000050F4000-memory.dmp

Filesize
5.6MB

Download
memory/2208-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

Filesize
96KB

Download
memory/2208-19-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/2208-20-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/2208-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-48-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-15-0x0000000002510000-0x000000000252A000-memory.dmp

Filesize
104KB

Download
memory/2208-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-21-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/2208-49-0x0000000073CFE000-0x0000000073CFF000-memory.dmp

Filesize
4KB

Download
memory/2208-16-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/2208-52-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/2208-14-0x0000000073CFE000-0x0000000073CFF000-memory.dmp

Filesize
4KB

Download
memory/3540-56-0x00000000004D0000-0x0000000000500000-memory.dmp

Filesize
192KB

Download
memory/3540-57-0x0000000004CF0000-0x0000000004CF6000-memory.dmp

Filesize
24KB

Download
memory/3540-58-0x0000000005450000-0x0000000005A68000-memory.dmp

Filesize
6.1MB

Download
memory/3540-59-0x0000000004F40000-0x000000000504A000-memory.dmp

Filesize
1.0MB

Download
memory/3540-60-0x0000000004E50000-0x0000000004E62000-memory.dmp

Filesize
72KB

Download
memory/3540-61-0x0000000004EB0000-0x0000000004EEC000-memory.dmp

Filesize
240KB

Download
memory/3540-62-0x0000000005050000-0x000000000509C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads