healer | 5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d

General

Target

5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe
Size

479KB
MD5

c9944d9eba38a4240247e5079bebcb76
SHA1

6d3a45d6c3e3a59240ff3eedd4ce190364463266
SHA256

5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d
SHA512

9ff84e8f1e3ba6ff0ad8c74243753141fe806bcabb38ffab19bd849c23cce51c0cedbf8df555f5aab4b6ea79bc60b53554e0dc76eedbd11992d3a10e6257cf45
SSDEEP

12288:AMr7y90bKC5SwGjTI0kylcUamQuSkn1E+xZ2p:ryK5PGjT4hUt1S+/2p

Score

10^/10

healer redline dumud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes

auth_value
3e18d4b90418aa3e78d8822e87c62f5c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4052-15-0x00000000049F0000-0x0000000004A0A000-memory.dmp	healer
behavioral1/memory/4052-18-0x0000000005080000-0x0000000005098000-memory.dmp	healer
behavioral1/memory/4052-25-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-23-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-47-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-45-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-43-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-41-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-39-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-37-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-35-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-33-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-31-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-29-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-27-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-20-0x0000000005080000-0x0000000005092000-memory.dmp	healer
behavioral1/memory/4052-21-0x0000000005080000-0x0000000005092000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8540152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8540152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8540152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8540152.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	k8540152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8540152.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b7d-53.dat	family_redline
behavioral1/memory/3516-55-0x0000000000F30000-0x0000000000F60000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
5116	y2592081.exe
4052	k8540152.exe
3516	l3933928.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	k8540152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8540152.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2592081.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y2592081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k8540152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l3933928.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4052	k8540152.exe
4052	k8540152.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	k8540152.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 5116	2248	5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe	83
PID 2248 wrote to memory of 5116	2248	5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe	83
PID 2248 wrote to memory of 5116	2248	5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe	83
PID 5116 wrote to memory of 4052	5116	y2592081.exe	84
PID 5116 wrote to memory of 4052	5116	y2592081.exe	84
PID 5116 wrote to memory of 4052	5116	y2592081.exe	84
PID 5116 wrote to memory of 3516	5116	y2592081.exe	93
PID 5116 wrote to memory of 3516	5116	y2592081.exe	93
PID 5116 wrote to memory of 3516	5116	y2592081.exe	93

C:\Users\Admin\AppData\Local\Temp\5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe
"C:\Users\Admin\AppData\Local\Temp\5b58d0a9153c2b390d5ecf75e4f8ded3ba713f380ef4c9ecb42db5e60ee3b38d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2592081.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2592081.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8540152.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8540152.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3933928.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3933928.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2592081.exe

Filesize
307KB

MD5
7fd7609204b2c93130f0d31f1c6c0be7

SHA1
2b7f2edab1260d6e3228d9e11d5991bd9df86309

SHA256
faeb9387741a6ed17393129e105a715a62cf6134a751adb4a44a0863bcfaf782

SHA512
b255abc949d1f53c0f6622007bd4ad5c484a2588d5fdd1bac78690a3918e43fc3da279045ed57710f78c84e9fb84bd6eada8268196aa828b1966128ddf3624e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k8540152.exe

Filesize
180KB

MD5
5ddcf9579ba22e8358404ca2900a0443

SHA1
adb7df57a74e3d76218340b343a5124829f04644

SHA256
e1c8a4d85664d860ead93c930996a61ba43ee9ac52a76d9b86a84981a386d35a

SHA512
dde464326ea2302342f06495e9ac360730015cd40e3e0dced84789fd0196429fd50f7c732fea69f945348e2cc3d1624bf93fbdff6fb99faff8c424c43da80c3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l3933928.exe

Filesize
168KB

MD5
4a6632346a0331915748778771111b57

SHA1
5093e0a4dc60edf3f01a91d4e52fbf3145d59f0f

SHA256
12e3a2a5a9c7311e6c7a68229fe7fd1b6f944f46b338ab23e9621a348a359937

SHA512
5547414ed3ba55b4f785274c19b60e2655a64fe4e0b8fc8a26dbec1a56460061c3501a5f9fe115c8090481edb2dcf9154935af17f9a19524a50faf7c2cd77ea5

Download Submit
memory/3516-61-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Filesize
304KB

Download
memory/3516-60-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/3516-59-0x00000000058A0000-0x00000000058B2000-memory.dmp

Filesize
72KB

Download
memory/3516-58-0x0000000005970000-0x0000000005A7A000-memory.dmp

Filesize
1.0MB

Download
memory/3516-57-0x0000000005E80000-0x0000000006498000-memory.dmp

Filesize
6.1MB

Download
memory/3516-56-0x0000000007BE0000-0x0000000007BE6000-memory.dmp

Filesize
24KB

Download
memory/3516-55-0x0000000000F30000-0x0000000000F60000-memory.dmp

Filesize
192KB

Download
memory/4052-33-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-19-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/4052-41-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-39-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-37-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-35-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-45-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-31-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-29-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-27-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-20-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-43-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-21-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-48-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/4052-49-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/4052-51-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/4052-47-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-23-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-25-0x0000000005080000-0x0000000005092000-memory.dmp

Filesize
72KB

Download
memory/4052-18-0x0000000005080000-0x0000000005098000-memory.dmp

Filesize
96KB

Download
memory/4052-16-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/4052-17-0x0000000004A70000-0x0000000005014000-memory.dmp

Filesize
5.6MB

Download
memory/4052-15-0x00000000049F0000-0x0000000004A0A000-memory.dmp

Filesize
104KB

Download
memory/4052-14-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads