healer | 909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659

General

Target

909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe
Size

1.5MB
MD5

7ffd2c1647ca5e17db464660f01bbeed
SHA1

20419abbdb24e7970e3761a425bccb97172e9d0b
SHA256

909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659
SHA512

7a760ac53acb304293364a44c8883b73e37dea6754ad6b643f2736736b03f0e9d6d9687ec242892c1ede58aac7222dd8b0be9c7504415fbc56f72f6fdcf4c1ad
SSDEEP

24576:ZyTxZuXJPU0gZABtcNvJ4D9BClj3DaJT0D7wIR2Vlo6jfYF:MTx+ByZKSDsbo

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/436-36-0x00000000027F0000-0x000000000280A000-memory.dmp	healer
behavioral1/memory/436-38-0x0000000002880000-0x0000000002898000-memory.dmp	healer
behavioral1/memory/436-40-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-66-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-64-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-62-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-60-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-39-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-58-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-56-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-54-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-52-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-50-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-48-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-46-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-44-0x0000000002880000-0x0000000002892000-memory.dmp	healer
behavioral1/memory/436-42-0x0000000002880000-0x0000000002892000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1043271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1043271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1043271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1043271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1043271.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1043271.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b7b-71.dat	family_redline
behavioral1/memory/1412-73-0x0000000000080000-0x00000000000B0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1708	v7702848.exe
4716	v5822742.exe
2208	v2477554.exe
1668	v7574571.exe
436	a1043271.exe
1412	b5834279.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1043271.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1043271.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7702848.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5822742.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v2477554.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v7574571.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	436	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7574571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1043271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5834279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7702848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5822742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2477554.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	a1043271.exe
436	a1043271.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	a1043271.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1708	4492	909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe	84
PID 4492 wrote to memory of 1708	4492	909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe	84
PID 4492 wrote to memory of 1708	4492	909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe	84
PID 1708 wrote to memory of 4716	1708	v7702848.exe	86
PID 1708 wrote to memory of 4716	1708	v7702848.exe	86
PID 1708 wrote to memory of 4716	1708	v7702848.exe	86
PID 4716 wrote to memory of 2208	4716	v5822742.exe	88
PID 4716 wrote to memory of 2208	4716	v5822742.exe	88
PID 4716 wrote to memory of 2208	4716	v5822742.exe	88
PID 2208 wrote to memory of 1668	2208	v2477554.exe	89
PID 2208 wrote to memory of 1668	2208	v2477554.exe	89
PID 2208 wrote to memory of 1668	2208	v2477554.exe	89
PID 1668 wrote to memory of 436	1668	v7574571.exe	90
PID 1668 wrote to memory of 436	1668	v7574571.exe	90
PID 1668 wrote to memory of 436	1668	v7574571.exe	90
PID 1668 wrote to memory of 1412	1668	v7574571.exe	98
PID 1668 wrote to memory of 1412	1668	v7574571.exe	98
PID 1668 wrote to memory of 1412	1668	v7574571.exe	98

C:\Users\Admin\AppData\Local\Temp\909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe
"C:\Users\Admin\AppData\Local\Temp\909d3ed537981f9266817686e7c12946afef17fe8451be2b9bc8fc53ce28d659.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7702848.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7702848.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5822742.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5822742.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2477554.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2477554.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7574571.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7574571.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1043271.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1043271.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1080
        7⤵
        Program crash
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5834279.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5834279.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 436 -ip 436
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7702848.exe

Filesize
1.4MB

MD5
dc93639950a5136a15303216df3e9422

SHA1
f942242ec224975a1bb3c1f113d30cdc9fe3ff08

SHA256
c9cbd6776581193421a08993700768528562e40cb0ac27bdf7a819bfaf0eb372

SHA512
326a6e8e820267bf388eb44c51ad1b527c218a4364861dbae5aa94305e465ff6ee7b0cd12ec0538afab48c838b59a6f89b0191a055e77dbeeb8b40630dae1927

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5822742.exe

Filesize
911KB

MD5
936f0ea3b18d1b450c86dab234715ac9

SHA1
51d9840996fe71fb6366c4f982aa4d1e8ab4632d

SHA256
dd2049241d7376d6db59552ba4f23b195b5f0f47e4aa276e2c63035d3574fb4d

SHA512
ee7363ac856238dae5a8e204d4ffb4bc7bae1db0096f3823e12cef03ebd0fc05d95fb7bf01fd01b3785d7eb4edb7871764d3dadfbe48d49b664b793428c4a284

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v2477554.exe

Filesize
707KB

MD5
91331356b3801a9e2a1176ec19a72c89

SHA1
0e1e699833e137de4b870d96c77320204d428333

SHA256
12edbbaf0874ee05ec52ffe3870c33d127355efe8bbb05000112e9a8bbc54e60

SHA512
5f0e571c970fd9ddb09c9496ce8ba7db9e006d51439a2ca73c8afc4832b5c388fd376e253bcd9d55973c3ef8d977eec1f465c8a4b3610895d75df032bd1000ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7574571.exe

Filesize
416KB

MD5
7a15b725346a478062589f35e9065449

SHA1
45c5599ccc51f5f2001625ffb81b9ef301877547

SHA256
ca1d4774765e9845aee4f90fdc5ef657a3149cf5e4b1d567186744e969e376ba

SHA512
3e17410269ba08443842eb6ea1c2dd66cca50b137766aefcced2de09424fd4a05dd96e2de720b12257bbdf9ff645835f07d7b2598bdb7f904e48312743dab8d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1043271.exe

Filesize
360KB

MD5
7567b2dcb4ccf91b0cd47a393a9f046a

SHA1
eacd738a5f282255faf116e3cc9bc592c780e7df

SHA256
446be43177cb0fee97a94dfc78fb871fdf48488832845a0b3fb6ccda9dfd01b6

SHA512
2ef86034ec878d66f3746861282104523b166b40f9bf752d9367937f756a53f73802a28570d7fef57abf69e49e8bd8fbbb4c78e3c334308816fd38185e9b6298

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5834279.exe

Filesize
168KB

MD5
35a38808f7c5ee942631feb48edee4eb

SHA1
344db1b1c3dd5320cdd782c18fceddec098086ad

SHA256
e3c2e4087a4673f11aadf45894c08ca90133002227e555220db0fd7807b69684

SHA512
9faeca0d4b8d6d9c6531f649c9d10261790fa9a706eb4155b5adf91ea6f3310e49d587d860d408d52f50599a3585c240068eb3e7f84546dd963e6984ba5fc263

Download Submit
memory/436-54-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-48-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-40-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-66-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-64-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-62-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-60-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-39-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-58-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-56-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-37-0x0000000004E50000-0x00000000053F4000-memory.dmp

Filesize
5.6MB

Download
memory/436-52-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-50-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-38-0x0000000002880000-0x0000000002898000-memory.dmp

Filesize
96KB

Download
memory/436-46-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-44-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-42-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/436-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/436-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/436-36-0x00000000027F0000-0x000000000280A000-memory.dmp

Filesize
104KB

Download
memory/1412-73-0x0000000000080000-0x00000000000B0000-memory.dmp

Filesize
192KB

Download
memory/1412-74-0x00000000022B0000-0x00000000022B6000-memory.dmp

Filesize
24KB

Download
memory/1412-75-0x00000000050A0000-0x00000000056B8000-memory.dmp

Filesize
6.1MB

Download
memory/1412-76-0x0000000004B90000-0x0000000004C9A000-memory.dmp

Filesize
1.0MB

Download
memory/1412-77-0x00000000049E0000-0x00000000049F2000-memory.dmp

Filesize
72KB

Download
memory/1412-78-0x0000000004A80000-0x0000000004ABC000-memory.dmp

Filesize
240KB

Download
memory/1412-79-0x0000000004AC0000-0x0000000004B0C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads