healer | 30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9

General

Target

30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe
Size

1.5MB
MD5

721c8a7b74033a5e531665b81030ace1
SHA1

4ca45d1f5ad1f38e306031ce8febf97930ff89f7
SHA256

30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9
SHA512

673d4fe9935f0488effbb503fc88c27b804df312d551be7a3c4be0079573b760eb4aba20773cb270dfdb05555bbe646f8df69043ef364baffc964f679f874168
SSDEEP

24576:VyW8hCKerKRuWN61Y4WUQf5Jnh8vR44U4yM7Ud4YhZHRv7BuZV4+grO9uzl:wNSm8Y4WLPCvR44BnYhZHRv74ZVH2

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/628-36-0x00000000024E0000-0x00000000024FA000-memory.dmp	healer
behavioral1/memory/628-38-0x0000000002730000-0x0000000002748000-memory.dmp	healer
behavioral1/memory/628-39-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-48-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-64-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-62-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-60-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-58-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-57-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-54-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-53-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-50-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-46-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-66-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-44-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-42-0x0000000002730000-0x0000000002742000-memory.dmp	healer
behavioral1/memory/628-40-0x0000000002730000-0x0000000002742000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a0007612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a0007612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a0007612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a0007612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a0007612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a0007612.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c73-71.dat	family_redline
behavioral1/memory/4652-73-0x0000000000620000-0x0000000000650000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
3484	v3601629.exe
4548	v8128918.exe
3172	v9814464.exe
4440	v2683717.exe
628	a0007612.exe
4652	b4204221.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a0007612.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a0007612.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v8128918.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9814464.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v2683717.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v3601629.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	628	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2683717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0007612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4204221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3601629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v8128918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9814464.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
628	a0007612.exe
628	a0007612.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	a0007612.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 3484	1488	30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe	84
PID 1488 wrote to memory of 3484	1488	30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe	84
PID 1488 wrote to memory of 3484	1488	30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe	84
PID 3484 wrote to memory of 4548	3484	v3601629.exe	85
PID 3484 wrote to memory of 4548	3484	v3601629.exe	85
PID 3484 wrote to memory of 4548	3484	v3601629.exe	85
PID 4548 wrote to memory of 3172	4548	v8128918.exe	86
PID 4548 wrote to memory of 3172	4548	v8128918.exe	86
PID 4548 wrote to memory of 3172	4548	v8128918.exe	86
PID 3172 wrote to memory of 4440	3172	v9814464.exe	87
PID 3172 wrote to memory of 4440	3172	v9814464.exe	87
PID 3172 wrote to memory of 4440	3172	v9814464.exe	87
PID 4440 wrote to memory of 628	4440	v2683717.exe	88
PID 4440 wrote to memory of 628	4440	v2683717.exe	88
PID 4440 wrote to memory of 628	4440	v2683717.exe	88
PID 4440 wrote to memory of 4652	4440	v2683717.exe	97
PID 4440 wrote to memory of 4652	4440	v2683717.exe	97
PID 4440 wrote to memory of 4652	4440	v2683717.exe	97

C:\Users\Admin\AppData\Local\Temp\30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe
"C:\Users\Admin\AppData\Local\Temp\30c23518eff241b052532d2c99f786c3e964e98f78f9e4db327ba03c7739c1f9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3601629.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3601629.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8128918.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8128918.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9814464.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9814464.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2683717.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2683717.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0007612.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0007612.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 1084
        7⤵
        Program crash
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4204221.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4204221.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 628 -ip 628
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3601629.exe

Filesize
1.4MB

MD5
4c2f6dc42af05892ac9a89210354431d

SHA1
e5218e423267efd1c05dc4dc46ede67a0fd61809

SHA256
a62cd26cfefd08c1fb7818082a77370bbbfd0cece7706b494b24117ab9598ea1

SHA512
82e84bad2efb14a6fa157f26e5035c7847eedefcda21f183fc720c66c6fbd98663d429ce0991bc2e2318dba2facb46dcc64a8710d6415d65912240d8df718416

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8128918.exe

Filesize
911KB

MD5
b5765380999c994056c968e010c169e0

SHA1
859060449264e80d31d20300072a38a3b00e9a83

SHA256
86eacb875a58e137d7a9752e64eab43b15c4fabb89b580eafe491307c6b19af2

SHA512
e64d92702f7d70ca65b7380f7e3422e56083ff59c29e9229a8f3a64ee48471dcfb4c9d79a39e30dd4e6da2116a607169157354e92da49b87bff23d938b3c5508

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9814464.exe

Filesize
707KB

MD5
ff229810b1f658bf2241c809c37d5899

SHA1
db15a4a7213ac67aafb8478cc5fc9d2a08aa5549

SHA256
3a3f94c1351e22816710f36db5836fc42fecbc7724f0a64e4eff1863a79f5f3f

SHA512
6c92d1c313d1c194729bbcad622b93449ed057d4813393d2b3d2be00d7c173b99d41aaa7f594525bed66b39a692832b7273056c045bd8786c58eb042f2bd8202

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2683717.exe

Filesize
415KB

MD5
b099a511c54a329687b7a304a667f88c

SHA1
8b2c3af412aca134e5d5daff6ebff467d95cabd0

SHA256
9b30ede1c329f16d9b9f44d1a70cff727a3ddfc683c7a5692d72b9d0cc05ca72

SHA512
ede84a501e8cab2cf437250ea3923f491fde3e4c4c563b063567bffd23aadfa32d9ab85e0bc6db61b5d3cb974641901833d5db87c7ad4a5b7d55361c271bca88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0007612.exe

Filesize
361KB

MD5
8c7788454a5303ee8fd746c89c348b46

SHA1
7cfcc355e798a70fc51ad18794b4d0c7a7e019e7

SHA256
3b4b3f4b2b2361f8f26e7111a35edc4f0c73b45cf48d08241893a836bf7ed70f

SHA512
c636ae2d27f8d06227b2f7d6622da0fcc06386bbcc167b5c1a1acf7ebd651159f4bfcbd059c0791b2891a5ef38f2cbdba306ce5f2b1e55519f480df49721d756

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b4204221.exe

Filesize
168KB

MD5
0577fe44f2716274a676289ad1720fa5

SHA1
426725f0002074187a8e7627e3c9c187067738b8

SHA256
3090cb9597ba6e66ae6c31977eb37485e5a0fee68b4a82f7ec6dc7d4e35cf9c6

SHA512
530840c7a3690ebaa98662ba2fc4bd7dc52cbdefcd0328749927e78e38005d589ded752d57764d0c12714d01aee355ab7fbf19adbab0adb0aeeb32d4f7bf2c64

Download Submit
memory/628-39-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-66-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-37-0x0000000004F40000-0x00000000054E4000-memory.dmp

Filesize
5.6MB

Download
memory/628-48-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-64-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-62-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-60-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-58-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-57-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-54-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-53-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-50-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-46-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-38-0x0000000002730000-0x0000000002748000-memory.dmp

Filesize
96KB

Download
memory/628-44-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-42-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-40-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/628-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/628-36-0x00000000024E0000-0x00000000024FA000-memory.dmp

Filesize
104KB

Download
memory/628-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/4652-73-0x0000000000620000-0x0000000000650000-memory.dmp

Filesize
192KB

Download
memory/4652-74-0x00000000072D0000-0x00000000072D6000-memory.dmp

Filesize
24KB

Download
memory/4652-75-0x000000000A910000-0x000000000AF28000-memory.dmp

Filesize
6.1MB

Download
memory/4652-76-0x000000000A490000-0x000000000A59A000-memory.dmp

Filesize
1.0MB

Download
memory/4652-77-0x000000000A3C0000-0x000000000A3D2000-memory.dmp

Filesize
72KB

Download
memory/4652-78-0x000000000A420000-0x000000000A45C000-memory.dmp

Filesize
240KB

Download
memory/4652-79-0x00000000048D0000-0x000000000491C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads