healer | 34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1

General

Target

34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe
Size

1.5MB
MD5

a0b1f7c07bc7b5b94a93d829adef3f92
SHA1

61198872bd7fa05da5167ffe3f68478d82aa418e
SHA256

34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1
SHA512

12eff47f5f253b56a38f40ab31a1c86335bee427f5d080cdc829e0a7febeec89d7c022626ed2dc8316ad6dd3aedb34c4ae6fa873d4d576f7f141fe132a60a775
SSDEEP

24576:Dy+JqH3e2BYuIDNKpqcVh/w1mGgq2CrfYLzkKg8iaVVmY2AZtgfIa7QBzB91KtcI:Wi6BwNaDn/wQPqXrfmzzpH2AZtgf37oE

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2492-36-0x0000000000940000-0x000000000095A000-memory.dmp	healer
behavioral1/memory/2492-38-0x00000000025C0000-0x00000000025D8000-memory.dmp	healer
behavioral1/memory/2492-40-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-44-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-66-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-64-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-62-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-60-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-58-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-56-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-54-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-52-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-50-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-48-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-46-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-42-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer
behavioral1/memory/2492-39-0x00000000025C0000-0x00000000025D2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5085146.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a5085146.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5085146.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5085146.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5085146.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5085146.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b75-71.dat	family_redline
behavioral1/memory/1132-73-0x0000000000EF0000-0x0000000000F20000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
4348	v5711927.exe
2088	v9203013.exe
3616	v7946478.exe
1788	v6689903.exe
2492	a5085146.exe
1132	b7861771.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a5085146.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5085146.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5711927.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9203013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v7946478.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v6689903.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	2492	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5711927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9203013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7946478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6689903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5085146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7861771.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	a5085146.exe
2492	a5085146.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	a5085146.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4348	4052	34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe	83
PID 4052 wrote to memory of 4348	4052	34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe	83
PID 4052 wrote to memory of 4348	4052	34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe	83
PID 4348 wrote to memory of 2088	4348	v5711927.exe	84
PID 4348 wrote to memory of 2088	4348	v5711927.exe	84
PID 4348 wrote to memory of 2088	4348	v5711927.exe	84
PID 2088 wrote to memory of 3616	2088	v9203013.exe	86
PID 2088 wrote to memory of 3616	2088	v9203013.exe	86
PID 2088 wrote to memory of 3616	2088	v9203013.exe	86
PID 3616 wrote to memory of 1788	3616	v7946478.exe	88
PID 3616 wrote to memory of 1788	3616	v7946478.exe	88
PID 3616 wrote to memory of 1788	3616	v7946478.exe	88
PID 1788 wrote to memory of 2492	1788	v6689903.exe	90
PID 1788 wrote to memory of 2492	1788	v6689903.exe	90
PID 1788 wrote to memory of 2492	1788	v6689903.exe	90
PID 1788 wrote to memory of 1132	1788	v6689903.exe	102
PID 1788 wrote to memory of 1132	1788	v6689903.exe	102
PID 1788 wrote to memory of 1132	1788	v6689903.exe	102

C:\Users\Admin\AppData\Local\Temp\34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe
"C:\Users\Admin\AppData\Local\Temp\34f72b1354415ad584b5cb215382d7b239214ac4062f583593bad62663c87be1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5711927.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5711927.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9203013.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9203013.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7946478.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7946478.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6689903.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6689903.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5085146.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5085146.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1080
        7⤵
        Program crash
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7861771.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7861771.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2492 -ip 2492
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5711927.exe

Filesize
1.3MB

MD5
680a139f60fa227bcb74531f11927ce6

SHA1
021016dd6512efaf309d8676b96e6bb5d6da3582

SHA256
ea6da5f5bedaf0034251432d87193ec9493c419fe02865a46412312720edac4e

SHA512
6dc82a4fc723852624027c3667923970699de690f5d12aa3d9365463d921335260f3f863223db828cc7e5478d3c93cdddbb52e91c7b730a4c7d121cc11c93cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9203013.exe

Filesize
869KB

MD5
89b1117cb310ac9a1230e999a88af095

SHA1
0c374e4bbbd92b51137f100ae4a50b08bc7af72c

SHA256
c87f97d3be7273c0892a8c61333ae118a24a33d7c8e25cc75d88dd11bf77b618

SHA512
a58aea199164698007370ab9798fe14a1856ddc27551a86d2e47f9a68b1361d322c3a49de518449e7332000efc6b4567a2042e3033d555b9586323e065dea086

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7946478.exe

Filesize
665KB

MD5
dc109eb1e6b90cea0af8ffcf318d7f0d

SHA1
3402f2f9a1dea5e32a0cf2a51cc55151ef3db7f9

SHA256
67a10166c460bce4ef0ac169d08e52b79c66afa28fea3cd6d42ecce9908bae4e

SHA512
6d130a831de73c11aac6a15812431ec5df784346e8128a456ce2772185e1977cb7d5eeb8fc1da15fb0c01c0f000431e2ad506d7c4783792cbf22f7cc703784c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6689903.exe

Filesize
394KB

MD5
c014b5080bf4e6b58cbaa8c54a36baeb

SHA1
b72b2b4cf83ba81abe659485b434c82b59565870

SHA256
34052f3f6f58fd87bec40d991375497cb11f2f2cfaae1f659bdd1286f4b116a9

SHA512
9ae87d232a2c6ef1ee299d565f932f19feb7d3758990d5c6abbc9c02d86404a2732cc283d97c51ade385b11942a392dd6111f94abf08a515c3509d5555383a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5085146.exe

Filesize
315KB

MD5
ff458fe5b29fbda292345edf4b789c58

SHA1
de7518bc0a779ee4e416532672b1f3aa4cd87deb

SHA256
09d4ed704aa6db3c97047736fc8b7bc079fcd2f7c080120cf6538956a358a53f

SHA512
502f54161b5590c5f665fc5222ca77330bb4bbfc08512d4b6471746fe91054c62932f2853168ec3c0bd7421c663f9af77b8a7e69585d96ec14826570785e4020

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7861771.exe

Filesize
168KB

MD5
f1c6c99f88b8ded6b17b3172165f371f

SHA1
98127f9e8f2c2dfab20e20d241ebdf0233fb41d1

SHA256
53bc286df19941fe13eb8cf77af371f253bc0faf44a2982740786adf01de080a

SHA512
3cc4c67dc105b4b86babc2038279c0cfbea4514f973375451c979d852f163605952547ccb9c1a119d8486c1e63011e616b5ac69ca002d64b0303e21a90bff3b2

Download Submit
memory/1132-78-0x000000000AD00000-0x000000000AD3C000-memory.dmp

Filesize
240KB

Download
memory/1132-77-0x000000000ACA0000-0x000000000ACB2000-memory.dmp

Filesize
72KB

Download
memory/1132-76-0x000000000AD90000-0x000000000AE9A000-memory.dmp

Filesize
1.0MB

Download
memory/1132-75-0x000000000B2A0000-0x000000000B8B8000-memory.dmp

Filesize
6.1MB

Download
memory/1132-74-0x0000000001600000-0x0000000001606000-memory.dmp

Filesize
24KB

Download
memory/1132-73-0x0000000000EF0000-0x0000000000F20000-memory.dmp

Filesize
192KB

Download
memory/1132-79-0x00000000030E0000-0x000000000312C000-memory.dmp

Filesize
304KB

Download
memory/2492-54-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-39-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-56-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-60-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-52-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-50-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-48-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-46-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-42-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-58-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-67-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2492-69-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2492-62-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-64-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-66-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-44-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-40-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2492-38-0x00000000025C0000-0x00000000025D8000-memory.dmp

Filesize
96KB

Download
memory/2492-37-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download
memory/2492-36-0x0000000000940000-0x000000000095A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads