healer | e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db

General

Target

e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe
Size

1.5MB
MD5

850a8adb122b0ae5e3baef9758194111
SHA1

98218c9aa99af6f6e968f843d771ac6b350b068e
SHA256

e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db
SHA512

c3bf0a9793bc6d2e18e0bfacbf4626e4f29d3cddac339b800059744a39ace64fdbb53133b76ff1f827abf4c0a5a30be5d91e03adf8fbdd5462f45e8b2ffb933d
SSDEEP

24576:vyaqmZ5iKHYJ7XRQabhChf8R65Dt1s+0McTwK1Djl/xydP4+IXSZY/UgBUZI+l:6hmeKHYJ7B7QZDt14McTw6DZ5CZiUZ

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3560-36-0x0000000000A80000-0x0000000000A9A000-memory.dmp	healer
behavioral1/memory/3560-38-0x0000000002620000-0x0000000002638000-memory.dmp	healer
behavioral1/memory/3560-40-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-66-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-64-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-62-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-60-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-58-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-56-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-54-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-52-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-50-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-48-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-46-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-44-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-43-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/3560-39-0x0000000002620000-0x0000000002632000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a4690089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4690089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4690089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4690089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4690089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4690089.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c95-70.dat	family_redline
behavioral1/memory/3188-73-0x0000000000E80000-0x0000000000EB0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
2204	v9744775.exe
2216	v3844188.exe
4832	v2179371.exe
5000	v1478437.exe
3560	a4690089.exe
3188	b4842703.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a4690089.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4690089.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v1478437.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v9744775.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3844188.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v2179371.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	3560	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9744775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3844188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2179371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v1478437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4690089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4842703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3560	a4690089.exe
3560	a4690089.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3560	a4690089.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2204	3492	e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe	83
PID 3492 wrote to memory of 2204	3492	e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe	83
PID 3492 wrote to memory of 2204	3492	e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe	83
PID 2204 wrote to memory of 2216	2204	v9744775.exe	84
PID 2204 wrote to memory of 2216	2204	v9744775.exe	84
PID 2204 wrote to memory of 2216	2204	v9744775.exe	84
PID 2216 wrote to memory of 4832	2216	v3844188.exe	85
PID 2216 wrote to memory of 4832	2216	v3844188.exe	85
PID 2216 wrote to memory of 4832	2216	v3844188.exe	85
PID 4832 wrote to memory of 5000	4832	v2179371.exe	87
PID 4832 wrote to memory of 5000	4832	v2179371.exe	87
PID 4832 wrote to memory of 5000	4832	v2179371.exe	87
PID 5000 wrote to memory of 3560	5000	v1478437.exe	88
PID 5000 wrote to memory of 3560	5000	v1478437.exe	88
PID 5000 wrote to memory of 3560	5000	v1478437.exe	88
PID 5000 wrote to memory of 3188	5000	v1478437.exe	99
PID 5000 wrote to memory of 3188	5000	v1478437.exe	99
PID 5000 wrote to memory of 3188	5000	v1478437.exe	99

C:\Users\Admin\AppData\Local\Temp\e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe
"C:\Users\Admin\AppData\Local\Temp\e9de70cdaeb6a0e8e747df765f484422f76028b27714d943cc661da5b31906db.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9744775.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9744775.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3844188.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3844188.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2179371.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2179371.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1478437.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1478437.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4690089.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4690089.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 1080
        7⤵
        Program crash
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4842703.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4842703.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3560 -ip 3560
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9744775.exe

Filesize
1.4MB

MD5
f08ccda8d6f59c8afbe88e3ae455deb9

SHA1
716c462e1f794cbcc0a6ac82f53045943266ebcd

SHA256
f340b2545da833f8c5d23e6a99e66619cb51d620df12b3c5c76e029005689d5e

SHA512
4066e05122119ce04fc81853dd1c3aa4913c4e233ec7c2e2b8da6f70dd8f60054a1218da2250bc7e09d89c21dc0370d9c0c83d2094f415544235b80616361694

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3844188.exe

Filesize
913KB

MD5
37d3a91cc31485867d19afe756e7b08f

SHA1
ec58807090e5382b768eb15b460100f2cb530a4d

SHA256
035df32bdc4fdbd1665758cb08f926546a6fa0e87403216150c73011b94e408d

SHA512
9c6677c16e56082da284e8837b9111dfa0d0913d881c4e649ade62e087d5fb601b4cb63630527b783feba7e9e29df8632a2973afc36447da82f019030151ef99

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2179371.exe

Filesize
708KB

MD5
78c24fb7bd14518363a56eeafeb8321f

SHA1
04bea52c5e76fe73288152ce93e201e505f87b6f

SHA256
e348361384762fcb3d4ce715514c595edd803885d72d28fb8823a702ce532f3f

SHA512
ac8c05461fc88ecd56b9f2e159fbaabc4097af0313d84de28235101c5025b827f942938c98e76ab0d8ffd0f362827356dd8f6b87e724348a20fab435cd4c2a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1478437.exe

Filesize
415KB

MD5
a50119f22c084d1aeeb70e09c88b091a

SHA1
b1417390cdc3947bb57fc2bf203c352918d2c0bd

SHA256
1f5e78035f4e40eb2fe34b2ae33ec7325688f12219c318a470a4af9fcd3894a2

SHA512
3591b34b1dd9f67bd27e2b3cd36a3a83206b9a060d2b5f574a825391d7c7b883ae921de67115d0440a1cb2e56e0d31c81e89359d171e710ebc4f8496db09defb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4690089.exe

Filesize
361KB

MD5
4aafff2fbdfb18d7c89f7a2ba56a67fb

SHA1
a27b54c15ae5694672dc77817618b75930e3bf38

SHA256
5c75a4cb740317344f5555c84f25bde0d569911d4c7f8183583133d6ea027292

SHA512
77e25d102e88a6b3a6c7d6b957993c60e7500a84f50e53c420e645dffe633530244dbc13b49a2ff945fe96efa10b995fd64a269ccaf2d7425c929882e78f0ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4842703.exe

Filesize
168KB

MD5
6e7997775cc769a120eaad701d3eaf7a

SHA1
ce34802aaaa32e26953f12433df06167b966203a

SHA256
17f7e0c275010a01fc5728a2986c18dac7b4c977177d4186318712105501b111

SHA512
4a64833a81655465419015cc0a9756f26336340963fbb31b16b42b7ec60bfc815ac5754d9c0af1e13a3ce438837982761062347e53a29a4f1d7a22003b5b6b14

Download Submit
memory/3188-78-0x000000000ADB0000-0x000000000ADEC000-memory.dmp

Filesize
240KB

Download
memory/3188-77-0x000000000AD50000-0x000000000AD62000-memory.dmp

Filesize
72KB

Download
memory/3188-76-0x000000000AE20000-0x000000000AF2A000-memory.dmp

Filesize
1.0MB

Download
memory/3188-75-0x000000000B2A0000-0x000000000B8B8000-memory.dmp

Filesize
6.1MB

Download
memory/3188-74-0x0000000005690000-0x0000000005696000-memory.dmp

Filesize
24KB

Download
memory/3188-73-0x0000000000E80000-0x0000000000EB0000-memory.dmp

Filesize
192KB

Download
memory/3188-79-0x0000000005040000-0x000000000508C000-memory.dmp

Filesize
304KB

Download
memory/3560-52-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-39-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-54-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-58-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-50-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-48-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-46-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-44-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-43-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-56-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3560-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3560-60-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-62-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-64-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-66-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-40-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/3560-38-0x0000000002620000-0x0000000002638000-memory.dmp

Filesize
96KB

Download
memory/3560-37-0x0000000004EF0000-0x0000000005494000-memory.dmp

Filesize
5.6MB

Download
memory/3560-36-0x0000000000A80000-0x0000000000A9A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads