healer | 096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be

General

Target

096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe
Size

1.5MB
MD5

50b40208ee78684c1a1a5605bd1429c3
SHA1

ea73f46c4db4ebd3c61876ea3fc4958e1bc48056
SHA256

096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be
SHA512

1c77b0e523c3f279a59af4d65d1af66f9d7075c60c8e244a3238453427dd887dc376b3ac37d7ac67e1cbc02df6258f43ebb298ca59739bd9dee8f814bcd977f0
SSDEEP

24576:YyVIYQAVOwJ5jbuo59OFqibV5PjFjbqgu/tJL81gxlbTtclvjLV4GBsZerq:fVVQA0G5Co5IFTV5Pj1atJGYlc5qG+Zq

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 18 IoCs

resource	yara_rule
behavioral1/memory/3184-36-0x0000000002010000-0x000000000202A000-memory.dmp	healer
behavioral1/memory/3184-38-0x00000000024C0000-0x00000000024D8000-memory.dmp	healer
behavioral1/memory/3184-64-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-66-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-65-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-62-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-60-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-58-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-56-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-54-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-52-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-50-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-48-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-46-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-44-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-42-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-39-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer
behavioral1/memory/3184-40-0x00000000024C0000-0x00000000024D2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2069297.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a2069297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2069297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2069297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2069297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2069297.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cb1-71.dat	family_redline
behavioral1/memory/4884-73-0x0000000000A00000-0x0000000000A30000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
3836	v4843889.exe
2036	v9137863.exe
2380	v1734353.exe
2144	v3433007.exe
3184	a2069297.exe
4884	b2411439.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a2069297.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2069297.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v9137863.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v1734353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v3433007.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4843889.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3912	3184	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v1734353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3433007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2069297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2411439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4843889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9137863.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	a2069297.exe
3184	a2069297.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	a2069297.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3836	3600	096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe	83
PID 3600 wrote to memory of 3836	3600	096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe	83
PID 3600 wrote to memory of 3836	3600	096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe	83
PID 3836 wrote to memory of 2036	3836	v4843889.exe	84
PID 3836 wrote to memory of 2036	3836	v4843889.exe	84
PID 3836 wrote to memory of 2036	3836	v4843889.exe	84
PID 2036 wrote to memory of 2380	2036	v9137863.exe	86
PID 2036 wrote to memory of 2380	2036	v9137863.exe	86
PID 2036 wrote to memory of 2380	2036	v9137863.exe	86
PID 2380 wrote to memory of 2144	2380	v1734353.exe	88
PID 2380 wrote to memory of 2144	2380	v1734353.exe	88
PID 2380 wrote to memory of 2144	2380	v1734353.exe	88
PID 2144 wrote to memory of 3184	2144	v3433007.exe	89
PID 2144 wrote to memory of 3184	2144	v3433007.exe	89
PID 2144 wrote to memory of 3184	2144	v3433007.exe	89
PID 2144 wrote to memory of 4884	2144	v3433007.exe	100
PID 2144 wrote to memory of 4884	2144	v3433007.exe	100
PID 2144 wrote to memory of 4884	2144	v3433007.exe	100

C:\Users\Admin\AppData\Local\Temp\096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe
"C:\Users\Admin\AppData\Local\Temp\096cd20a79fd6187c0e8277c5224d9dcf9bfa1221565537c3f3ed15626c4d9be.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4843889.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4843889.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9137863.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9137863.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1734353.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1734353.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3433007.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3433007.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2069297.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2069297.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1080
        7⤵
        Program crash
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2411439.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2411439.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3184 -ip 3184
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4843889.exe

Filesize
1.3MB

MD5
2bf50b4c527b18cb3a9de997074ba214

SHA1
e4141342aab689431ef150ce897e608eb538ee7c

SHA256
d7e767f0901321522dacbc9bcc9b528947ac51cff8dcfb29a91a7384950fd40c

SHA512
74462be7c68470c9fca151b834a4cb3205d1e30b227b61ddb34bfea71be74328a8519ce5e52f51078adb2ea581adcbff02bc7e0e1892fc7fa1808ee11ba2c679

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9137863.exe

Filesize
867KB

MD5
95e9e79734653ede7086999a123cc40a

SHA1
7079e13c2255c864a06996f1b02a5af9d32128b5

SHA256
6c25cdba5ffcca79d43542f3049beb6606411541436c04f178d3d05f43c9ff43

SHA512
1683f2ba7db9763a98faa575ec482b0316d59eaac0758fe2395d46dc576407847abd0d40c72b517bcdf6d1eb0920e033c443bb528c1a75f53c2eba31b10efa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1734353.exe

Filesize
664KB

MD5
0c72012162481240430c9fc703026909

SHA1
062b9bf0283a2638c0ad190ff7319050ccae8523

SHA256
02f3e1fe030458681b2df049d06dc39906eff66dcfc6dd4bca16067610e5f0a1

SHA512
4daac9badae381a5bbfcdd6c1b356c0330e77a350804db37418b0937bb440cb4b07af5d8015a5f6e4ee992e45f217fbb1965dafc7111cdaf2d6957b0acdc8e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3433007.exe

Filesize
394KB

MD5
56a518fe3f95ed3af5a6b89b0af7fa03

SHA1
eba05dad3db74b08a64c25a604c779991ecfe4fd

SHA256
49a2ec9c1ee1a8b025897ce34332e5ea8b71016e55cd22b750a19e776fa9985b

SHA512
d31feb073cbc55623cee5136b8b6d11c65f58fb5e5f968f61d6ddd94fc5c91f058b543fa1750d3947a5ebc133f6d35addb548adb616955207f501b98f726ae42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a2069297.exe

Filesize
315KB

MD5
56a5e06aab1e13dd60b882c3f2c5ffdb

SHA1
f592edea6ff179cdb06b7dcab6d09cb1855249e5

SHA256
35f9debaaffd04dac144ae12cf47577474a9c69db485dd4ad6d1d44ce77b0d5d

SHA512
bb55197c77318648ee9e174b9e15461725782b83c4ea8b85841ca08f909f0fad6ee4f4bfa45818f2e17291d745314d71ce13a83a4fac49e5ba37c4fd98cde8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2411439.exe

Filesize
168KB

MD5
07607d5e2f0cdedf92dc4283d23b60ce

SHA1
7eeeac54c3d4d15e118a4a9711bcb5379e082d0b

SHA256
dc99b28a5d7bc3c73a9eba0d491bf13471623c27011a9ba099e719f9ab11b80f

SHA512
7fc8f09642aebe225a3f038e36e5241f1ae8f0218f7e6ac115b53775efa2ab192ed277d49317841ba8610377de38cf805feb403c06dec8e1e4a30281b57861be

Download Submit
memory/3184-52-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-46-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-64-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-66-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-65-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-62-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-60-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-58-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-56-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-54-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-37-0x0000000004C70000-0x0000000005214000-memory.dmp

Filesize
5.6MB

Download
memory/3184-50-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-48-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-38-0x00000000024C0000-0x00000000024D8000-memory.dmp

Filesize
96KB

Download
memory/3184-44-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-42-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-39-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-40-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/3184-67-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3184-69-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3184-36-0x0000000002010000-0x000000000202A000-memory.dmp

Filesize
104KB

Download
memory/4884-73-0x0000000000A00000-0x0000000000A30000-memory.dmp

Filesize
192KB

Download
memory/4884-74-0x00000000051E0000-0x00000000051E6000-memory.dmp

Filesize
24KB

Download
memory/4884-75-0x0000000005970000-0x0000000005F88000-memory.dmp

Filesize
6.1MB

Download
memory/4884-76-0x0000000005460000-0x000000000556A000-memory.dmp

Filesize
1.0MB

Download
memory/4884-77-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/4884-78-0x00000000053E0000-0x000000000541C000-memory.dmp

Filesize
240KB

Download
memory/4884-79-0x0000000005570000-0x00000000055BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads