healer | 03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433

General

Target

03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe
Size

1.5MB
MD5

8868324231f6c1d29b9870c688ee9ceb
SHA1

b22e3bbad5460877583d758e0f83e52a728766a0
SHA256

03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433
SHA512

5b73cf24831fd0570b3180c45ecd6cb4596a42a26d20ead2ca57caa6210d60fe83f5c8143c6a23e07622f66a35dc4ad2c6c95b882c60a5082653dc39020a6463
SSDEEP

49152:vWvkjZshJ/lrzIeOfVX9oTJPdHFghDom:uYAJ/hUtXEPQD

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1812-36-0x0000000004D50000-0x0000000004D6A000-memory.dmp	healer
behavioral1/memory/1812-38-0x0000000004DD0000-0x0000000004DE8000-memory.dmp	healer
behavioral1/memory/1812-60-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-66-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-64-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-62-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-58-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-56-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-54-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-52-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-50-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-48-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-46-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-44-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-42-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-40-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/1812-39-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1808715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1808715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1808715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1808715.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1808715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1808715.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023b99-71.dat	family_redline
behavioral1/memory/4020-73-0x00000000006F0000-0x0000000000720000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
3184	v2510862.exe
2376	v5275904.exe
2292	v5699976.exe
756	v2713757.exe
1812	a1808715.exe
4020	b5828960.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1808715.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1808715.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v2510862.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v5275904.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v5699976.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v2713757.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1812	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2510862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5275904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5699976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2713757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1808715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5828960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1812	a1808715.exe
1812	a1808715.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	a1808715.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3184	2280	03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe	83
PID 2280 wrote to memory of 3184	2280	03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe	83
PID 2280 wrote to memory of 3184	2280	03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe	83
PID 3184 wrote to memory of 2376	3184	v2510862.exe	84
PID 3184 wrote to memory of 2376	3184	v2510862.exe	84
PID 3184 wrote to memory of 2376	3184	v2510862.exe	84
PID 2376 wrote to memory of 2292	2376	v5275904.exe	85
PID 2376 wrote to memory of 2292	2376	v5275904.exe	85
PID 2376 wrote to memory of 2292	2376	v5275904.exe	85
PID 2292 wrote to memory of 756	2292	v5699976.exe	87
PID 2292 wrote to memory of 756	2292	v5699976.exe	87
PID 2292 wrote to memory of 756	2292	v5699976.exe	87
PID 756 wrote to memory of 1812	756	v2713757.exe	89
PID 756 wrote to memory of 1812	756	v2713757.exe	89
PID 756 wrote to memory of 1812	756	v2713757.exe	89
PID 756 wrote to memory of 4020	756	v2713757.exe	99
PID 756 wrote to memory of 4020	756	v2713757.exe	99
PID 756 wrote to memory of 4020	756	v2713757.exe	99

C:\Users\Admin\AppData\Local\Temp\03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe
"C:\Users\Admin\AppData\Local\Temp\03ff4e3f997c1f69dde8d9b0e356baa96b0f8eb46c3113e101c145be64de5433.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2510862.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2510862.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5275904.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5275904.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5699976.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5699976.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2713757.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2713757.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1808715.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1808715.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 1080
        7⤵
        Program crash
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5828960.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5828960.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1812 -ip 1812
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2510862.exe

Filesize
1.4MB

MD5
06f6c87ca66e98ab336a291408fc3f10

SHA1
c996fbcba0dfc67f55a6af13b1fdb1a4175a2acd

SHA256
bac0c8f2128975ccede406047dbe1f253885b7e7f789beff15fb78876b8affb4

SHA512
e168c918b407e88507cd1167fe5464be4797714ed6bd72f34d422f608dd2eb656e53805928054870287668cc751c22c4757e08e78a1d4d7f98bba09e41096d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5275904.exe

Filesize
911KB

MD5
5a0f4a2f43e4d82ff985aa0368dc907c

SHA1
02c9a285bdaf8b5abac97d1a2a6890e2c89ab627

SHA256
fa2527fbecd5ea30a750e33e3f813735a53965124af771fce4ce2f4fa71e3577

SHA512
cb69acde683a9ecbde7b462921b9b1f06db7ff4a56cd1a4ca4a3fbbe3146bb0b99bc1c007bf48f0d57ed7180034fac99790a28c2672a976c038414d0c7c74ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5699976.exe

Filesize
707KB

MD5
3e9625fb582a363b11ee2a93962eda57

SHA1
8ef5252da59ff8bdf3505ff9ad8488ee3fe03cff

SHA256
55dc2b426194b380e5d34f71ccc905bc792ca2b1c510653226e92c74081cce3c

SHA512
28cfaccb093073d56d17fa178d3ecdbc5193f8988a95802813b930677bc9ab161226f7381e70638d8b193e4d1f2557843bbcfa36f2e8897b2309789143a435fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2713757.exe

Filesize
416KB

MD5
ffabc2f0e3dedb5b7c61c31adf76d9b9

SHA1
6a7963135dedb83b775b2b20dffd5a3d471b2c28

SHA256
b7ff403fe08e22953609e79d22bc55ec68a7a05c30abae9cd82817fdc3fde1d4

SHA512
7819e6b520d61638f2975e2ae6f13df1059dce0bfcf643e9dc9dac61d25420ad024ec4536f59e619b15f68cfbeed57a7249e3da5ef2f7c7377243811df9c333e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1808715.exe

Filesize
360KB

MD5
7498cd7bb262df93054813c785f252a0

SHA1
e00d369352e2a60bceb63147442887feeb45ac1b

SHA256
4aa72167285d9953add40ec29d5bf75a426def2f3fb8e041e3e88b5b168294d3

SHA512
d50cee12ffd2f52141d08939f7c07ffa02ac59174268f07c6252694a5ed1f5d03eb3fece0595611d91bed8d7313c37451c20d0730ef311f036bd0a6a98688b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b5828960.exe

Filesize
168KB

MD5
f4ec774e357816ca67a8c43df5114c45

SHA1
0ba3c22adeed87c95fe15ceff45b38be79d4a266

SHA256
90b7de6aff647fa21742da960ab1f4d8690dc69c3d413845c849174adc84de9f

SHA512
001c83f6f4432f10008bc9587667a1be87938d171459c31a091c4f52b761e618d9f033ed8849ee5da7a167b60a7a31efd964bbf890ac127b2e4c832083c6f7bb

Download Submit
memory/1812-60-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-44-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-37-0x0000000004F40000-0x00000000054E4000-memory.dmp

Filesize
5.6MB

Download
memory/1812-66-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-64-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-62-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-58-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-56-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-54-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-52-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-50-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-48-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-46-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-38-0x0000000004DD0000-0x0000000004DE8000-memory.dmp

Filesize
96KB

Download
memory/1812-42-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-40-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-39-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1812-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/1812-36-0x0000000004D50000-0x0000000004D6A000-memory.dmp

Filesize
104KB

Download
memory/1812-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/4020-73-0x00000000006F0000-0x0000000000720000-memory.dmp

Filesize
192KB

Download
memory/4020-74-0x0000000002800000-0x0000000002806000-memory.dmp

Filesize
24KB

Download
memory/4020-75-0x0000000005670000-0x0000000005C88000-memory.dmp

Filesize
6.1MB

Download
memory/4020-76-0x0000000005160000-0x000000000526A000-memory.dmp

Filesize
1.0MB

Download
memory/4020-77-0x0000000005070000-0x0000000005082000-memory.dmp

Filesize
72KB

Download
memory/4020-78-0x00000000050D0000-0x000000000510C000-memory.dmp

Filesize
240KB

Download
memory/4020-79-0x0000000005270000-0x00000000052BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads