healer | d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad

General

Target

d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe
Size

1.5MB
MD5

31b1b3203d6cf125193efafefd1c8757
SHA1

ea74a34706d33807a8029a88d56c00321def7b96
SHA256

d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad
SHA512

b123a039a2ec9529c4e057ca14fb2a0a12fec54fdb78001d37acf34a1731fa10cd5df4c38e9af8f7955433caafd6ad3bb00e5ec2c21480215d5bceae26aefdf3
SSDEEP

24576:LylHvXBF671MJaicQRioMCLR7m7Ot1UgeFNNcueSAG7VfmqbQi4h8XMaibJtc0Vs:+J7Ui/R37RgPNyud7VfhSham/cQGQ

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4164-36-0x0000000004960000-0x000000000497A000-memory.dmp	healer
behavioral1/memory/4164-38-0x0000000004A20000-0x0000000004A38000-memory.dmp	healer
behavioral1/memory/4164-46-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-66-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-64-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-62-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-60-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-58-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-56-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-54-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-52-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-50-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-48-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-44-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-40-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-39-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/4164-42-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a4811816.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4811816.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4811816.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4811816.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4811816.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4811816.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ccb-71.dat	family_redline
behavioral1/memory/5072-73-0x0000000000E90000-0x0000000000EC0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
3288	v6177706.exe
4816	v3410495.exe
1292	v4265021.exe
1620	v6703720.exe
4164	a4811816.exe
5072	b7246357.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a4811816.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4811816.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v4265021.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v6703720.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6177706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3410495.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	4164	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6177706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3410495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4265021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6703720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4811816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7246357.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	a4811816.exe
4164	a4811816.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	a4811816.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3288	1644	d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe	83
PID 1644 wrote to memory of 3288	1644	d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe	83
PID 1644 wrote to memory of 3288	1644	d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe	83
PID 3288 wrote to memory of 4816	3288	v6177706.exe	84
PID 3288 wrote to memory of 4816	3288	v6177706.exe	84
PID 3288 wrote to memory of 4816	3288	v6177706.exe	84
PID 4816 wrote to memory of 1292	4816	v3410495.exe	85
PID 4816 wrote to memory of 1292	4816	v3410495.exe	85
PID 4816 wrote to memory of 1292	4816	v3410495.exe	85
PID 1292 wrote to memory of 1620	1292	v4265021.exe	86
PID 1292 wrote to memory of 1620	1292	v4265021.exe	86
PID 1292 wrote to memory of 1620	1292	v4265021.exe	86
PID 1620 wrote to memory of 4164	1620	v6703720.exe	88
PID 1620 wrote to memory of 4164	1620	v6703720.exe	88
PID 1620 wrote to memory of 4164	1620	v6703720.exe	88
PID 1620 wrote to memory of 5072	1620	v6703720.exe	101
PID 1620 wrote to memory of 5072	1620	v6703720.exe	101
PID 1620 wrote to memory of 5072	1620	v6703720.exe	101

C:\Users\Admin\AppData\Local\Temp\d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe
"C:\Users\Admin\AppData\Local\Temp\d728cd2d6c44518474bf21c4ec91d0101b7a8b5a6d26a185e17e79e8bdcff4ad.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6177706.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6177706.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3410495.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3410495.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4265021.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4265021.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6703720.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6703720.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4811816.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4811816.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1080
        7⤵
        Program crash
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7246357.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7246357.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4164 -ip 4164
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6177706.exe

Filesize
1.3MB

MD5
f91f7f8c28df1069345dbc0a03a5a28e

SHA1
a93c55811e02557179007c0489fc1008f3a97bfd

SHA256
075ce6283832a3b0e9a4de0c88ab613baa4caf0b8a220c6d07b8bcfd19b0d686

SHA512
9baace85dbe63b4e0bd86188c8e049d31252500d727df85423fd79679f95853505644941533299102a87e7fac94bfca4738db989b91e5d9e2a590dc6392ee05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3410495.exe

Filesize
867KB

MD5
26c05484f0df07bc0ee887b57d3dc976

SHA1
83a91f243781060717763d231fbcc8e6a8cd413a

SHA256
0d7b33197b841eefe4d947cdbb838f287f2d0b2ad09ead67dc77f80dbd04c82f

SHA512
2612ea6b043b130ab3963a3888266d2c5233f540bbff9921357cc1ee07e9127b86a6664947e1359b96876d76a4b3ec4bf8061f13c1a7a37f25553a06184dbe43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v4265021.exe

Filesize
662KB

MD5
ff2492e89faae4f2c77d441e03db29f2

SHA1
895bcdaf1a2236d5b817beff1f27c74c72b34c55

SHA256
25cf64b791a53fd1a0fc2ad8dddd2eb7902cda953da4122578779b6b9fb87951

SHA512
defdc08e43e637b07db56ca3beb9972da4cb2df94bd348711e22645ead23bc6843db3c89dd7fa1e3eaebbbd305ba4c946e1b74a1b4215e9bb2923d4c70d8a168

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6703720.exe

Filesize
393KB

MD5
920b768d7dde02db890b88e921fc70ff

SHA1
69c03ae83390e7bc6dafc7fae62a881c8809a452

SHA256
c395646c9e967ade08bff38cc06f389b2d05b7baea05353e40d10133c9d7ec30

SHA512
7ac878a8c9ab52360ca05b7ab26847ce826403002626ac48f41a42bc368f20778344ed2d49ebcf19928098cf3caea718c8633153ecd1fbef71ff00dfc831dc68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a4811816.exe

Filesize
315KB

MD5
d1f6c469915d8ee440018a3e0394f4f0

SHA1
f65625edd460e6e408414cdc6102cb7a8c243926

SHA256
136ee4785eb421a8aa9176e4a3ad8100d42b2a57d749d4bf70039c69e350d13e

SHA512
b4abf1e0198ffb37ae907711e33421611d3c70f1168c0957c03e655be20ecdc8c92ae662d348174d3aa54c00adf462bafab36ee54c8b6c59adcb4ea4aa79da6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7246357.exe

Filesize
168KB

MD5
74c16f7abc550db4c5beaa660783ce6c

SHA1
6242374285e7cd8d5db663be5b9251b3edad906d

SHA256
7b067d1c3b5de722ea1d799d21f190b6ad5ee4570101469d8bec316e839bd7c2

SHA512
44949b7c6033f36010fbd9a99b8fd963f56940651fdcc570003cc34382b647a8fbf94bda831e73af17b9eec4404a5a2b46a9c743b1ac438a2d47ae3c4157d968

Download Submit
memory/4164-52-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-44-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-46-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-66-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-64-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-62-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-60-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-58-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-56-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-54-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-37-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/4164-50-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-48-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-38-0x0000000004A20000-0x0000000004A38000-memory.dmp

Filesize
96KB

Download
memory/4164-40-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-39-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-42-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/4164-67-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4164-69-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4164-36-0x0000000004960000-0x000000000497A000-memory.dmp

Filesize
104KB

Download
memory/5072-73-0x0000000000E90000-0x0000000000EC0000-memory.dmp

Filesize
192KB

Download
memory/5072-74-0x0000000001730000-0x0000000001736000-memory.dmp

Filesize
24KB

Download
memory/5072-75-0x000000000B1F0000-0x000000000B808000-memory.dmp

Filesize
6.1MB

Download
memory/5072-76-0x000000000AD20000-0x000000000AE2A000-memory.dmp

Filesize
1.0MB

Download
memory/5072-77-0x000000000AC30000-0x000000000AC42000-memory.dmp

Filesize
72KB

Download
memory/5072-78-0x000000000AC90000-0x000000000ACCC000-memory.dmp

Filesize
240KB

Download
memory/5072-79-0x0000000005160000-0x00000000051AC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads