healer | ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a

General

Target

ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe
Size

1.5MB
MD5

2c62669267c345b3a44fce9eb7471ddb
SHA1

2f56706db435949e7c6db65e974f501f9e2da51a
SHA256

ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a
SHA512

e1ce991619270b6446df6ef5f5a3e86fee2f799386132198b1768607047ea612522928ef84b216f0a8fbe32e5b7dcb5fb17177d81e910d56ac76f07e729d968f
SSDEEP

49152:bfZB7GdQXAKINApJY4CRRwTHAH9dhnbz9:DZB7Gd8894CRRwzqbhbz

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4408-36-0x0000000002720000-0x000000000273A000-memory.dmp	healer
behavioral1/memory/4408-38-0x0000000004C90000-0x0000000004CA8000-memory.dmp	healer
behavioral1/memory/4408-46-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-58-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-66-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-64-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-62-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-60-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-54-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-50-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-44-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-42-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-40-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-39-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-56-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-53-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer
behavioral1/memory/4408-48-0x0000000004C90000-0x0000000004CA2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1387006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1387006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1387006.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1387006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1387006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1387006.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023ba2-71.dat	family_redline
behavioral1/memory/1628-73-0x0000000000190000-0x00000000001C0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
2532	v5214559.exe
2940	v4596024.exe
4212	v2353353.exe
968	v9453595.exe
4408	a1387006.exe
1628	b2424198.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1387006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1387006.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v5214559.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4596024.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v2353353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v9453595.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4984	4408	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5214559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4596024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2353353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9453595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1387006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2424198.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4408	a1387006.exe
4408	a1387006.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	a1387006.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2532	2332	ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe	83
PID 2332 wrote to memory of 2532	2332	ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe	83
PID 2332 wrote to memory of 2532	2332	ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe	83
PID 2532 wrote to memory of 2940	2532	v5214559.exe	84
PID 2532 wrote to memory of 2940	2532	v5214559.exe	84
PID 2532 wrote to memory of 2940	2532	v5214559.exe	84
PID 2940 wrote to memory of 4212	2940	v4596024.exe	86
PID 2940 wrote to memory of 4212	2940	v4596024.exe	86
PID 2940 wrote to memory of 4212	2940	v4596024.exe	86
PID 4212 wrote to memory of 968	4212	v2353353.exe	88
PID 4212 wrote to memory of 968	4212	v2353353.exe	88
PID 4212 wrote to memory of 968	4212	v2353353.exe	88
PID 968 wrote to memory of 4408	968	v9453595.exe	89
PID 968 wrote to memory of 4408	968	v9453595.exe	89
PID 968 wrote to memory of 4408	968	v9453595.exe	89
PID 968 wrote to memory of 1628	968	v9453595.exe	104
PID 968 wrote to memory of 1628	968	v9453595.exe	104
PID 968 wrote to memory of 1628	968	v9453595.exe	104

C:\Users\Admin\AppData\Local\Temp\ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe
"C:\Users\Admin\AppData\Local\Temp\ca9081b88b82db1133887e6b92bf460b0d10afc642076c4209523eb0469c2a7a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5214559.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5214559.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4596024.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4596024.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2353353.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2353353.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9453595.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9453595.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1387006.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1387006.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1100
        7⤵
        Program crash
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2424198.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2424198.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4408 -ip 4408
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5214559.exe

Filesize
1.4MB

MD5
d1d618e357222f001af54b2a688b5bbf

SHA1
591fda7050425168c6ec89e870b5eeb3e88494c3

SHA256
1310b0e186ebb1ba261741a1497c75bb0305a5c82d8ccc05206bc7d66fae2cc2

SHA512
0aac4be232c7708d2b0a83d90113d56bc9d5e8a15b5af7a96852e5e25e6480b91d4826a2fbe1d561e06dfd107a2c3f6dfab2657b134d34d9d0a10f95aebe8f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4596024.exe

Filesize
913KB

MD5
5699c243afcc1a08ed2308a69b193240

SHA1
1d831d92523c813c0c7efeb6b6b6f4bd7207858d

SHA256
7a1a724670a7ed7efc7c1fe02f9554ff86883efd509c45dd8eb8f4c1218f9349

SHA512
2b2b971c3d5a8232279255844d90e139071d3b5104a04d71b1e74e56882ae8a8f8ff6f5220c88e677b639a4b94073fbbc483dd84fa792a876e98eebd3c447935

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2353353.exe

Filesize
708KB

MD5
7a58f88cdd1cf449695a21d42c3a2f21

SHA1
919259bc36f334dd4ce5e65cb213cdf9aa2abc11

SHA256
df90a487d524318b14477fb68176c90797a22afc23509eec2b05b7385f748b3a

SHA512
1a1e676f90b985cfecc180ce02f937b8f63b7b6c259e1d43a70c6b5c1b0018f1966858bbf563cf397ab29f8d207a2769ddec89600fc9728b27ae3acffdf330c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9453595.exe

Filesize
417KB

MD5
88e5c3b8e85319cfa0e02a9fb9df5c4d

SHA1
455f71951d88f819fc405036222cd6b2996c2de9

SHA256
18ecd14e0258ad4e0c3ded9dd8cae8353cf4f842505a4ce56c42968e1b206036

SHA512
f8e69d669d97fea683441cf5270729cdc25c225984d3c2331fb2f9957905a20805214fcb7b1a6f730a01d7f65d4e6c9960d1ea0703213dd084e4d7ae8cbb0935

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1387006.exe

Filesize
361KB

MD5
cef39b08253f37e4a37dedf643a3fbc5

SHA1
aa907ebfec9b40f9a561af9814e33b0b1611b32b

SHA256
22f4ff19fcdfef1e4d87173dd6c187af250f0f6aede3a9fdbae500b625ebacc9

SHA512
ca248bd414077e23bda79488cf22a23c5e055570e9942b171fef1c7a71d8b8d96c97515fd1f39619dbd312cead5e5dd777fe69b8a1ae321a6b7d111cb618391c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2424198.exe

Filesize
168KB

MD5
9767fb1a196d6ebd74e0e45c6134d995

SHA1
4a852760bb96fdc34cfd06618623eae9fbc5f944

SHA256
9e40573fef61b731e4adb4489f10e3199166793d7f9a4775546742ce9a03c411

SHA512
c7c2b62e2608af18af99473714578511e91b06a6551ed143cedb63bbd4c7e8debf7a5799ce31ae48e72683942ae254493ff89c0f7da18f4e77949d923bb43c18

Download Submit
memory/1628-78-0x0000000004CB0000-0x0000000004CEC000-memory.dmp

Filesize
240KB

Download
memory/1628-77-0x0000000004C50000-0x0000000004C62000-memory.dmp

Filesize
72KB

Download
memory/1628-79-0x0000000004E30000-0x0000000004E7C000-memory.dmp

Filesize
304KB

Download
memory/1628-76-0x0000000004D20000-0x0000000004E2A000-memory.dmp

Filesize
1.0MB

Download
memory/1628-75-0x0000000005230000-0x0000000005848000-memory.dmp

Filesize
6.1MB

Download
memory/1628-74-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download
memory/1628-73-0x0000000000190000-0x00000000001C0000-memory.dmp

Filesize
192KB

Download
memory/4408-46-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-48-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-50-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-44-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-42-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-40-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-39-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-56-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-53-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-54-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/4408-60-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/4408-62-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-64-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-66-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-58-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/4408-38-0x0000000004C90000-0x0000000004CA8000-memory.dmp

Filesize
96KB

Download
memory/4408-37-0x0000000004CE0000-0x0000000005284000-memory.dmp

Filesize
5.6MB

Download
memory/4408-36-0x0000000002720000-0x000000000273A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads