healer | e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723

General

Target

e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe
Size

1.5MB
MD5

3f8eb5521cd2e574a40793f025509c91
SHA1

7bbb137dcf320d59c100b6abbc9c7a7db42f504c
SHA256

e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723
SHA512

c98b2d1c6d11483e130b2c150730e934a41da0000a730da40bba2c704816a9fdb85deefb852939e8c6771881a4dd7e7c0200b73485b1342f7eddd9ee9f86cfa8
SSDEEP

49152:u1koChCNzrppJ5RFcXblrR5qOs8WN0sg4:faPJ5XMXBWN

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/5028-36-0x00000000025F0000-0x000000000260A000-memory.dmp	healer
behavioral1/memory/5028-38-0x0000000002690000-0x00000000026A8000-memory.dmp	healer
behavioral1/memory/5028-42-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-44-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-66-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-64-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-62-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-60-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-58-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-56-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-54-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-52-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-50-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-48-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-46-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-39-0x0000000002690000-0x00000000026A2000-memory.dmp	healer
behavioral1/memory/5028-40-0x0000000002690000-0x00000000026A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6597181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6597181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6597181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6597181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6597181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6597181.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cd1-71.dat	family_redline
behavioral1/memory/4232-73-0x0000000000CC0000-0x0000000000CF0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
2800	v1298748.exe
720	v8147273.exe
2160	v3390633.exe
3432	v0062254.exe
5028	a6597181.exe
4232	b1019279.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6597181.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6597181.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1298748.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v8147273.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v3390633.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v0062254.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	5028	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v1298748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v8147273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3390633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0062254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6597181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1019279.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	a6597181.exe
5028	a6597181.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	a6597181.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2800	4376	e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe	84
PID 4376 wrote to memory of 2800	4376	e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe	84
PID 4376 wrote to memory of 2800	4376	e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe	84
PID 2800 wrote to memory of 720	2800	v1298748.exe	85
PID 2800 wrote to memory of 720	2800	v1298748.exe	85
PID 2800 wrote to memory of 720	2800	v1298748.exe	85
PID 720 wrote to memory of 2160	720	v8147273.exe	86
PID 720 wrote to memory of 2160	720	v8147273.exe	86
PID 720 wrote to memory of 2160	720	v8147273.exe	86
PID 2160 wrote to memory of 3432	2160	v3390633.exe	87
PID 2160 wrote to memory of 3432	2160	v3390633.exe	87
PID 2160 wrote to memory of 3432	2160	v3390633.exe	87
PID 3432 wrote to memory of 5028	3432	v0062254.exe	89
PID 3432 wrote to memory of 5028	3432	v0062254.exe	89
PID 3432 wrote to memory of 5028	3432	v0062254.exe	89
PID 3432 wrote to memory of 4232	3432	v0062254.exe	99
PID 3432 wrote to memory of 4232	3432	v0062254.exe	99
PID 3432 wrote to memory of 4232	3432	v0062254.exe	99

C:\Users\Admin\AppData\Local\Temp\e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe
"C:\Users\Admin\AppData\Local\Temp\e23bfc038f9c9348b338ced43bbcc823c487edd579575e4cb2255876d50be723.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1298748.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1298748.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8147273.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8147273.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3390633.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3390633.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0062254.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0062254.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6597181.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6597181.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1084
        7⤵
        Program crash
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1019279.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1019279.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5028 -ip 5028
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1298748.exe

Filesize
1.4MB

MD5
a7e0fcab470e2ec4b22d9e499b23ba68

SHA1
e4fcf8075a8f1f17eec65f44ebd73814b803cfa1

SHA256
13c95422d1b6d6f91238992ce01b1a74bf0d4b21cd83110b083eccda30f46cf5

SHA512
9691521ef41f3fcbe5253e12f66dbff894703c08d2a8a6d115278475057c896344286f3cffd6168e51bad0a9b185349b3601e8f7f71964abe9dfe85edfd4c940

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8147273.exe

Filesize
915KB

MD5
8550a187a3da179bf69ebca4ea3ab91e

SHA1
f9f738bb4313ee4418d099fe0e73726c724d47e1

SHA256
58ec4bf10c5dad87dc07072ef6547dcf6fec183165c4b01d8de4bbc1d24b86e9

SHA512
3d503f27d58e3ef3c143b1ec6035aa25f036fe9f484435349a3b26bedf8a6ed74299088723bdef370419fc80b944d8b8209972918a9be85d7fcda1ea6696d0fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3390633.exe

Filesize
711KB

MD5
8e9daa3187ebe02772fc9a6ce2fa93dc

SHA1
24da69e6a7c888d7163f59636567b53a638b827e

SHA256
766c6856363366d9856bce19cea58173bce3218f649ce528e74ff11ef0194746

SHA512
e2049a65832428ebaed64b2d2fa862d521932893a3d6f2d72d4cf6c857b6923c0ed54fbc02f90d823d2a0b324f28e70e5b263b5c0c20f5661c5d186cf5b9b804

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0062254.exe

Filesize
416KB

MD5
b795ceb6046dd638c21068eb7dc669d9

SHA1
a43eff33714e2161e99baf0dbb7e2220bba02229

SHA256
77a70987f787ae0401d46736968b8c6eae1e0360d0449a16862cb0f3fe279ff6

SHA512
5d2406480c24d5980cc47e40c0842c13f80efb28f3d0670819d7524e6acfa31886c9ac7898de9275dc6f4261676af2869579b0276003bd0677c401905d69b464

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6597181.exe

Filesize
360KB

MD5
ad7613bc768d346544c57c516ff6de6d

SHA1
b90ac5bdb9c25835e19372609790f9348e911d67

SHA256
3c269797bc714b59085c9a93aa11dea0b516fec7c15c4c050f2880742e93f134

SHA512
696231300224f3c6a1deb1faf97c4bb9c7add7e4531f0637648b4363ced8735e0ecf5f87096adf7ac9595155c8c11a9bba0e32d72f7a0c7e9c6ac89ef2090a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b1019279.exe

Filesize
168KB

MD5
f8d01faa365a6852bd576f44d3256783

SHA1
db326b917f1b678fa1fcddb73ed8f0de4cdc56b3

SHA256
6f49bb2a856413986abbf89bef98fdf76129ceb66bd502fc608ad6c2828c6265

SHA512
535d59b77e1f160d1dc9ef70b75d1f6ac2663d43bf28d15e67b24efa6b45231660f1f9ed2679f8f7bccd46e9250faabccd136e429f3fdc7dcb2a44f7fa30884c

Download Submit
memory/4232-78-0x00000000056B0000-0x00000000056EC000-memory.dmp

Filesize
240KB

Download
memory/4232-77-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/4232-76-0x00000000057C0000-0x00000000058CA000-memory.dmp

Filesize
1.0MB

Download
memory/4232-75-0x0000000005CD0000-0x00000000062E8000-memory.dmp

Filesize
6.1MB

Download
memory/4232-74-0x0000000002CA0000-0x0000000002CA6000-memory.dmp

Filesize
24KB

Download
memory/4232-73-0x0000000000CC0000-0x0000000000CF0000-memory.dmp

Filesize
192KB

Download
memory/4232-79-0x00000000056F0000-0x000000000573C000-memory.dmp

Filesize
304KB

Download
memory/5028-54-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-40-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-56-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-60-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-52-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-50-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-48-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-46-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-39-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-58-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/5028-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/5028-62-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-64-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-66-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-44-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-42-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5028-38-0x0000000002690000-0x00000000026A8000-memory.dmp

Filesize
96KB

Download
memory/5028-37-0x0000000004DF0000-0x0000000005394000-memory.dmp

Filesize
5.6MB

Download
memory/5028-36-0x00000000025F0000-0x000000000260A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads