healer | 56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8c

General

Target

56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe
Size

709KB
MD5

c60975c34b621d8c7bcc950a25defbb0
SHA1

b4f830db820cf36758628265b8d7d0aabd5b18d1
SHA256

56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8c
SHA512

c3bf5d1f398627c819474a742a48bc0c09411b265dfa6d86da66235f1ff4fcd01897b7fda3c333c5cc4e3549fbfeddc8de5ef9ab227fc93db5dd0e1ec4c0e4ad
SSDEEP

12288:cMrry90pw/unxSE5N8GV8pW8HM8/f5dU3qRK5+GEfcZgGHLaXE6AN+7nYb:HyR/00EOpWmM4RgUGsWjLd6AkrYb

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3596-19-0x00000000025A0000-0x00000000025BA000-memory.dmp	healer
behavioral1/memory/3596-21-0x0000000002880000-0x0000000002898000-memory.dmp	healer
behavioral1/memory/3596-48-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-49-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-43-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-41-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-39-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-37-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-35-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-33-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-31-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-29-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-27-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-25-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-23-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-45-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/3596-22-0x0000000002880000-0x0000000002892000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5621551.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5621551.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5621551.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a5621551.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5621551.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5621551.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cb9-59.dat	family_redline
behavioral1/memory/5012-60-0x00000000000C0000-0x00000000000E8000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3348	v9472234.exe
3596	a5621551.exe
5012	b4164856.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a5621551.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5621551.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9472234.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4460	3596	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4164856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9472234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5621551.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3596	a5621551.exe
3596	a5621551.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	a5621551.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3348	4464	56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe	84
PID 4464 wrote to memory of 3348	4464	56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe	84
PID 4464 wrote to memory of 3348	4464	56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe	84
PID 3348 wrote to memory of 3596	3348	v9472234.exe	85
PID 3348 wrote to memory of 3596	3348	v9472234.exe	85
PID 3348 wrote to memory of 3596	3348	v9472234.exe	85
PID 3348 wrote to memory of 5012	3348	v9472234.exe	95
PID 3348 wrote to memory of 5012	3348	v9472234.exe	95
PID 3348 wrote to memory of 5012	3348	v9472234.exe	95

C:\Users\Admin\AppData\Local\Temp\56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe
"C:\Users\Admin\AppData\Local\Temp\56bc948ce24a704733ca8cf4575adc50b28bbdc3bb9728758e00bc184e062a8cN.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9472234.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9472234.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5621551.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5621551.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 1084
      4⤵
      Program crash
      PID:4460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4164856.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4164856.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3596 -ip 3596
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9472234.exe

Filesize
417KB

MD5
c83cbff6fbc32c87c3db87e0ed9cf55a

SHA1
c0b13d4048addc1a1d398cd2e0544214a8b61a51

SHA256
063c68bd36be6e6f0dbee501c0188d8832ac4bc0c189a7031a2050ab5c0d7cb0

SHA512
88a827bef962b11d67dcea66ddcd9ac1c29042c0932a3d29167579d5214fe382a0deb91331441136fe70e36eb29536f85c078236199a78a27e2168fcddd0db5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5621551.exe

Filesize
360KB

MD5
cfc970933fe0c378052e63dfbfa75692

SHA1
342baa4a28b31e63a929ef57722341d3d61fe350

SHA256
dbfd1f3428fdba0c8deacd645fcd9d41d2c07ebf2ae1b697f206a52c51d84eb4

SHA512
5de8a21f89bd8ac59aad3287b1880dd41b7864d4310fa60ac074138d31a8344ac28fe306380423803ddcb53f55a9cc74c1f0736af907471f34c4b404122fdd82

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4164856.exe

Filesize
136KB

MD5
8c2f1d4fc3fe11282914ce66f38ebff9

SHA1
91f018615fab39e711313cbc76fcdcc59e00f388

SHA256
ca724e9242a3251123da1e2dc12e5368b25c6ade31de06870e0798ca122c40b0

SHA512
9d86dea2c8f89514540bedafcded6e38122a76caa00130049cf517793c04c8fba1f10219cc888013b4a47786616c8de1d064221ec01ef4684ad3a80f4e7c4da7

Download Submit
memory/3596-29-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-49-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-18-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3596-27-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-20-0x0000000004F00000-0x00000000054A4000-memory.dmp

Filesize
5.6MB

Download
memory/3596-21-0x0000000002880000-0x0000000002898000-memory.dmp

Filesize
96KB

Download
memory/3596-48-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-25-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-43-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-41-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-39-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-37-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-35-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-23-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-31-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-16-0x0000000000850000-0x000000000087D000-memory.dmp

Filesize
180KB

Download
memory/3596-19-0x00000000025A0000-0x00000000025BA000-memory.dmp

Filesize
104KB

Download
memory/3596-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3596-33-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-45-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-22-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3596-50-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/3596-51-0x0000000000850000-0x000000000087D000-memory.dmp

Filesize
180KB

Download
memory/3596-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3596-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3596-55-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3596-15-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/5012-60-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/5012-62-0x0000000006E20000-0x0000000006E32000-memory.dmp

Filesize
72KB

Download
memory/5012-61-0x0000000007380000-0x0000000007998000-memory.dmp

Filesize
6.1MB

Download
memory/5012-63-0x0000000006F50000-0x000000000705A000-memory.dmp

Filesize
1.0MB

Download
memory/5012-64-0x0000000006E80000-0x0000000006EBC000-memory.dmp

Filesize
240KB

Download
memory/5012-65-0x00000000043D0000-0x000000000441C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads