healer | 7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de

General

Target

7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe
Size

1.5MB
MD5

24f212c644227284d077e7e88a0cde8a
SHA1

d045616dc1fed40af3470185abf3e0a7d703fa1f
SHA256

7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de
SHA512

99969ad9e48d478b3bd923bba4a28b74526080ec99d22184aef03935ab137274b23cbaf07d0004d1d3006c3b48d0a41e45d704a0c5d8d7887637a57a96f1e81b
SSDEEP

24576:eyBeFLAtQFfDQOA2ngrHC6Mtf1Sh1MnAI3E8VP1mTZIA16kR1SK2+XZK+A:tdK9DQOpngrHC6wwcnvjVgT+zkLSH+V

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2976-36-0x0000000002480000-0x000000000249A000-memory.dmp	healer
behavioral1/memory/2976-38-0x0000000004C90000-0x0000000004CA8000-memory.dmp	healer
behavioral1/memory/2976-48-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-66-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-64-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-62-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-60-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-58-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-56-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-54-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-52-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-50-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-46-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-45-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-42-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-40-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/2976-39-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9120493.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9120493.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9120493.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9120493.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9120493.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a9120493.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b70-71.dat	family_redline
behavioral1/memory/2388-73-0x0000000000230000-0x0000000000260000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1732	v2120546.exe
2380	v3789149.exe
4176	v0805027.exe
4184	v0856785.exe
2976	a9120493.exe
2388	b2993977.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a9120493.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9120493.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2120546.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3789149.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v0805027.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v0856785.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4684	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	2976	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2120546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3789149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0805027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0856785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9120493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2993977.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	a9120493.exe
2976	a9120493.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	a9120493.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1732	4376	7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe	83
PID 4376 wrote to memory of 1732	4376	7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe	83
PID 4376 wrote to memory of 1732	4376	7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe	83
PID 1732 wrote to memory of 2380	1732	v2120546.exe	85
PID 1732 wrote to memory of 2380	1732	v2120546.exe	85
PID 1732 wrote to memory of 2380	1732	v2120546.exe	85
PID 2380 wrote to memory of 4176	2380	v3789149.exe	86
PID 2380 wrote to memory of 4176	2380	v3789149.exe	86
PID 2380 wrote to memory of 4176	2380	v3789149.exe	86
PID 4176 wrote to memory of 4184	4176	v0805027.exe	88
PID 4176 wrote to memory of 4184	4176	v0805027.exe	88
PID 4176 wrote to memory of 4184	4176	v0805027.exe	88
PID 4184 wrote to memory of 2976	4184	v0856785.exe	90
PID 4184 wrote to memory of 2976	4184	v0856785.exe	90
PID 4184 wrote to memory of 2976	4184	v0856785.exe	90
PID 4184 wrote to memory of 2388	4184	v0856785.exe	102
PID 4184 wrote to memory of 2388	4184	v0856785.exe	102
PID 4184 wrote to memory of 2388	4184	v0856785.exe	102

C:\Users\Admin\AppData\Local\Temp\7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe
"C:\Users\Admin\AppData\Local\Temp\7f25a605b85333c3ba7ddf2cc95e58c3c6f9ecf390346de0cc07ab38122f97de.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120546.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120546.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3789149.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3789149.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0805027.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0805027.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0856785.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0856785.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9120493.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9120493.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 1080
        7⤵
        Program crash
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2993977.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2993977.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2976 -ip 2976
1⤵
PID:2944

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2120546.exe

Filesize
1.4MB

MD5
617d3b40d1a9df94187b848e99314ebb

SHA1
97595ed7ec4d08f469fbf4223558a3e3e20da107

SHA256
76c4137e188e44a275a09da2bdf59ea5eb9efbc74fa3831d387eed867f59f03d

SHA512
f4b9c513c56d325eab59ffdee0ff14d846c01fafdb732ae6feb518e10ba77cfc96c1ef520cc23e8c0a7963ee6ef951553df8385ac878caa7fc62dc076171d02d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3789149.exe

Filesize
912KB

MD5
35880e77a4b55071ae862e4fb50f3bc5

SHA1
1e97ce8ee09d0ee5ffdfdc9de7715c871c1e6f7d

SHA256
983438ed3d9a956672077aebb42e3505505dd8530c2d0713b9a6159c2d24487e

SHA512
0b842f6c25b6a6beaed79a6846d1b5f66769c9632a220d3d81506ed5b99e27c3404b0d9db7b3f3ec2fa79ddbc7ba934323c39367bf764ca549cd401c9b5e8d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v0805027.exe

Filesize
707KB

MD5
a46f4423ff9cc66ad9828694d79bb7c2

SHA1
a08aa7cf85ac0f05c56d688ed8dd275270239807

SHA256
7c29ac5eda700059919eb4438f83f0dd4db1326f43b656d60bd412391688794a

SHA512
55a208c0c936a0079d3368a31b3d92721e3ad66282248587e876377a572a148d4a6e69f20229aba163b5144e7fee2ef8aa6a6345a79742e0a8d0cf9e5bb034e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0856785.exe

Filesize
415KB

MD5
ca593a1d8de4e7a231ae8c02902e49fa

SHA1
cd1e917fd45fd3708fa4eecd7c0071bbbeb68e9b

SHA256
9c224cf334f9c8586d3eb3951137364fb4e9c0c97c332087c44f20731ed887c6

SHA512
accc2b44914343f9fdbcd9bb841740d3090fd7a822636063283f6cf722b0b7087d64d6b6fa48380e4854cccd97f93f1d2ef1840c302b63373adca5238a470cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9120493.exe

Filesize
361KB

MD5
00040bfe58afbcc9b8d8f547fc8f64d3

SHA1
412efb53830032349e68098267a65deb9f77bbb2

SHA256
06391da901fe35685d401865cd6021ae89eb8a10338443b3d7cbb8d3e8d10c04

SHA512
d8303f22d8eccf43aca10604d3d7150a9a38311287e241e4f83b02750d1bc9d3d35b42b20ae99f575cd10bf3446799b9c62a70a9e7e78980a1452686e7606cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2993977.exe

Filesize
168KB

MD5
48eb229a2b5791e6985f7d637b223d27

SHA1
529be5e61ae752619f4c656992dc11774d3884dd

SHA256
abf900a4414abf94e04e017da02b4a2a67a1fb43108cf5f9e020d8499ff1e143

SHA512
6d523c79be6b335b0d60648a9e6af265a14e5c7002b1c96dd9358aeb931fd1b88dc6ce158418fe066ef3e1d107065d77b31afb5dafe839790c35f958167248a3

Download Submit
memory/2388-78-0x000000000A030000-0x000000000A06C000-memory.dmp

Filesize
240KB

Download
memory/2388-77-0x0000000009FD0000-0x0000000009FE2000-memory.dmp

Filesize
72KB

Download
memory/2388-76-0x000000000A0A0000-0x000000000A1AA000-memory.dmp

Filesize
1.0MB

Download
memory/2388-75-0x000000000A5A0000-0x000000000ABB8000-memory.dmp

Filesize
6.1MB

Download
memory/2388-74-0x00000000023B0000-0x00000000023B6000-memory.dmp

Filesize
24KB

Download
memory/2388-73-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/2388-79-0x0000000002300000-0x000000000234C000-memory.dmp

Filesize
304KB

Download
memory/2976-52-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-39-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-54-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-58-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-50-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-46-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-45-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-42-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-40-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-56-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/2976-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/2976-60-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-62-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-64-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-66-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-48-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/2976-38-0x0000000004C90000-0x0000000004CA8000-memory.dmp

Filesize
96KB

Download
memory/2976-37-0x0000000004D40000-0x00000000052E4000-memory.dmp

Filesize
5.6MB

Download
memory/2976-36-0x0000000002480000-0x000000000249A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads