healer | 24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f

General

Target

24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe
Size

1.5MB
MD5

05b3da06290cad6c04f4e5a08e682a88
SHA1

c8dbc024b1a0822e1435de9727a53f92714d8f1b
SHA256

24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f
SHA512

4b1ba83a3e77caa51fe11c658c50233f124fc6cf1c1e9fc845bf5d6147311c10aa0815ee333c615a196b21389c293855039d73e3a9e111e2cbd188cfaaa189fa
SSDEEP

24576:Ky4mR3tWxrc8BZRMTG85p9X4r2FkF3jmyyabQg4SItbGIDJUcoXHLX8oG0l8Pcp:RjR3opzeSOpaTxIpGIicCHL7G0l

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4024-36-0x0000000002900000-0x000000000291A000-memory.dmp	healer
behavioral1/memory/4024-38-0x0000000004DD0000-0x0000000004DE8000-memory.dmp	healer
behavioral1/memory/4024-64-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-62-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-60-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-59-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-57-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-54-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-52-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-66-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-50-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-49-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-46-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-44-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-42-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-41-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer
behavioral1/memory/4024-39-0x0000000004DD0000-0x0000000004DE2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a1646832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a1646832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a1646832.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a1646832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a1646832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a1646832.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c48-71.dat	family_redline
behavioral1/memory/4804-73-0x00000000009E0000-0x0000000000A08000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1556	v8766668.exe
3112	v0724215.exe
1808	v6277529.exe
3364	v7945082.exe
4024	a1646832.exe
4804	b3757240.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a1646832.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a1646832.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8766668.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0724215.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v6277529.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v7945082.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	4024	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7945082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1646832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3757240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v8766668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0724215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v6277529.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	a1646832.exe
4024	a1646832.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	a1646832.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1556	4852	24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe	83
PID 4852 wrote to memory of 1556	4852	24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe	83
PID 4852 wrote to memory of 1556	4852	24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe	83
PID 1556 wrote to memory of 3112	1556	v8766668.exe	84
PID 1556 wrote to memory of 3112	1556	v8766668.exe	84
PID 1556 wrote to memory of 3112	1556	v8766668.exe	84
PID 3112 wrote to memory of 1808	3112	v0724215.exe	85
PID 3112 wrote to memory of 1808	3112	v0724215.exe	85
PID 3112 wrote to memory of 1808	3112	v0724215.exe	85
PID 1808 wrote to memory of 3364	1808	v6277529.exe	86
PID 1808 wrote to memory of 3364	1808	v6277529.exe	86
PID 1808 wrote to memory of 3364	1808	v6277529.exe	86
PID 3364 wrote to memory of 4024	3364	v7945082.exe	88
PID 3364 wrote to memory of 4024	3364	v7945082.exe	88
PID 3364 wrote to memory of 4024	3364	v7945082.exe	88
PID 3364 wrote to memory of 4804	3364	v7945082.exe	102
PID 3364 wrote to memory of 4804	3364	v7945082.exe	102
PID 3364 wrote to memory of 4804	3364	v7945082.exe	102

C:\Users\Admin\AppData\Local\Temp\24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe
"C:\Users\Admin\AppData\Local\Temp\24f0e43e14cbdb3b0d51e77a1586c8c2d51e0f8f2df7fabfcdd311357bf8bd6f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8766668.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8766668.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0724215.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0724215.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6277529.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6277529.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7945082.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7945082.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1646832.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1646832.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1084
        7⤵
        Program crash
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3757240.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3757240.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4024 -ip 4024
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8766668.exe

Filesize
1.4MB

MD5
fca53e452465b72b3bd17baf2f0151f9

SHA1
00dab4cba3ff31a087e5b9ca2d0a10cc53810dec

SHA256
b64eb030855cd4007c536360ad4668598bfb9424261c40d2b0e3552c94b17384

SHA512
cf70933c45fc3e1ac06f2e4f41617ab562f82912154b46f615adf16ed692364ecd0cb1a723efd26d120172cf936fac15e48d8a10a79240ccc7977bae8409bb2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0724215.exe

Filesize
914KB

MD5
e7cba55693c8ab23f83ece5d944b367d

SHA1
bad25ba8f270984864b98411ea411f8dddbd9271

SHA256
323f9e8d96eccac2090c122ee78ec1215d1f657ecef98dde4a54476f9921d96f

SHA512
1f148478a15754cc99a21c899cccd0197ee0e4696be855e9e1794fede28cea6eac1c77e42c67e8c629f7905efe5bc7843457e29e4e3927a59ccbd871a51f5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v6277529.exe

Filesize
709KB

MD5
962f290e6ade320d3e11eee626560d0d

SHA1
0b93992246d7cafca86800cbc9d8dbc5d0750837

SHA256
e683329813df893722262d3ad99a40d19724d8067404fcd3725b22e5ca624102

SHA512
693d9f9448ad06fc6305c491175dff8a2847821dd6f9d5f5a9661621689152ebc9e0c659fd96e329dfc2d085d166b7f43e0c2565dee19709e3e8f57386e49964

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7945082.exe

Filesize
418KB

MD5
3bf6010b5ed35a6247aca20d4e391ef8

SHA1
86ceede3dd652bb15daacf5a9f0e34d79204ffcd

SHA256
19011e2567577f83a84f29eda132ec5cb16e4561afea49d9137f9f730bfc61c1

SHA512
d2fb8bc4496ce361e36d95377e120334093e94f764086c971a37932759a41a0330d1a646f30a97e3d41e8f3dbb3fe0dad21b1755cfd55425cbc246ea3c6fcc46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1646832.exe

Filesize
361KB

MD5
1c15edbe59b8cbb7853b2633d367616c

SHA1
6b6bf423e9f19dc068da9d4de19eac95ac8fb455

SHA256
2ad448835316e787d4a9eeade9bd0f29c88f5e277e0c6364b88c6181996c8664

SHA512
5f71875407cbec078626db6c42e39f523923ca15ee963dba55b31683f3502247421375fc0df22cb72bd90a9f23503fd8c8efafade0e2e13b3f31bf71559f1c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3757240.exe

Filesize
136KB

MD5
6192c6b20605525768f6bc0f35563bbe

SHA1
dd7b7564989b8f6490449ac8d260b806d640de8b

SHA256
e9c6e9b173d8efb59d44d2c1d26244f6af49f9fb21e6a4878defde4197100e23

SHA512
c513269f2da1450fc0576045880252344f8a26ac4d36668f9b9a11b18cfb577fd2fee0840cf153ca9c6e69cb81102a1b379887208d6da79290a42a33dcde1f81

Download Submit
memory/4024-50-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-44-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-64-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-62-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-60-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-59-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-57-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-54-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-52-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-66-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-37-0x0000000004E50000-0x00000000053F4000-memory.dmp

Filesize
5.6MB

Download
memory/4024-49-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-46-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-38-0x0000000004DD0000-0x0000000004DE8000-memory.dmp

Filesize
96KB

Download
memory/4024-42-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-41-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-39-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4024-67-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/4024-69-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/4024-36-0x0000000002900000-0x000000000291A000-memory.dmp

Filesize
104KB

Download
memory/4804-73-0x00000000009E0000-0x0000000000A08000-memory.dmp

Filesize
160KB

Download
memory/4804-74-0x0000000007CA0000-0x00000000082B8000-memory.dmp

Filesize
6.1MB

Download
memory/4804-75-0x0000000007740000-0x0000000007752000-memory.dmp

Filesize
72KB

Download
memory/4804-76-0x0000000007870000-0x000000000797A000-memory.dmp

Filesize
1.0MB

Download
memory/4804-77-0x00000000077C0000-0x00000000077FC000-memory.dmp

Filesize
240KB

Download
memory/4804-78-0x0000000004B50000-0x0000000004B9C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads