healer | 1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a

General

Target

1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe
Size

1.5MB
MD5

dea062157f9908a9ac48a25756223e8c
SHA1

4ce732bd461d4d5dc64915fa2047f716769b470f
SHA256

1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a
SHA512

d3938176b81d0522aabecbe5a0813c876c0037369e056564cfc7b27cc76b3786bea3f7caad3fabb8f843436244a02cab005bca8c5cf4d02e33da91d181e53090
SSDEEP

24576:syGWyHBIILpvW5335m3TqEW0Bj6l8vQghC1PgX770xTMmcqLMm99uftc3CZgZoSe:bGWyhIwvm35m3S056eD37CTMygMwcS6x

Score

10^/10

healer redline mazda discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3712-36-0x0000000002340000-0x000000000235A000-memory.dmp	healer
behavioral1/memory/3712-38-0x0000000004A20000-0x0000000004A38000-memory.dmp	healer
behavioral1/memory/3712-66-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-64-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-62-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-60-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-58-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-56-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-54-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-53-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-50-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-49-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-46-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-44-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-43-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-40-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer
behavioral1/memory/3712-39-0x0000000004A20000-0x0000000004A32000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a9334839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a9334839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a9334839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a9334839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a9334839.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a9334839.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b94-71.dat	family_redline
behavioral1/memory/2436-73-0x0000000000280000-0x00000000002B0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
864	v0774596.exe
4460	v7220384.exe
4388	v1808148.exe
4276	v5557052.exe
3712	a9334839.exe
2436	b3748217.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a9334839.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a9334839.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v5557052.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v0774596.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7220384.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v1808148.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	3712	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0774596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7220384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v1808148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5557052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9334839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3748217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3712	a9334839.exe
3712	a9334839.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	a9334839.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 864	4984	1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe	83
PID 4984 wrote to memory of 864	4984	1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe	83
PID 4984 wrote to memory of 864	4984	1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe	83
PID 864 wrote to memory of 4460	864	v0774596.exe	85
PID 864 wrote to memory of 4460	864	v0774596.exe	85
PID 864 wrote to memory of 4460	864	v0774596.exe	85
PID 4460 wrote to memory of 4388	4460	v7220384.exe	87
PID 4460 wrote to memory of 4388	4460	v7220384.exe	87
PID 4460 wrote to memory of 4388	4460	v7220384.exe	87
PID 4388 wrote to memory of 4276	4388	v1808148.exe	88
PID 4388 wrote to memory of 4276	4388	v1808148.exe	88
PID 4388 wrote to memory of 4276	4388	v1808148.exe	88
PID 4276 wrote to memory of 3712	4276	v5557052.exe	89
PID 4276 wrote to memory of 3712	4276	v5557052.exe	89
PID 4276 wrote to memory of 3712	4276	v5557052.exe	89
PID 4276 wrote to memory of 2436	4276	v5557052.exe	103
PID 4276 wrote to memory of 2436	4276	v5557052.exe	103
PID 4276 wrote to memory of 2436	4276	v5557052.exe	103

C:\Users\Admin\AppData\Local\Temp\1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe
"C:\Users\Admin\AppData\Local\Temp\1877a831661ae5b3330416c6bc765e854d4726027802160ca2b6fe823b75382a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0774596.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0774596.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7220384.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7220384.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1808148.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1808148.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5557052.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5557052.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9334839.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9334839.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 1104
        7⤵
        Program crash
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3748217.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3748217.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3712 -ip 3712
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0774596.exe

Filesize
1.3MB

MD5
0988ea638978db0a2b936879d69aae68

SHA1
7bd2af55b6b000b083c0eccd699746eb13498c48

SHA256
1802708cecea0dcd12ace9b3060203d67c4f3d2486ec3e9ec6f917799b17a454

SHA512
4d73474871d80a37cc79cd640e1a7e4d08f963fbfb61311f4e21d629a438f24ad4af2a262bb124178c391382106e3d403e59fc3ef6f9d8b73fb88a67412b1970

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7220384.exe

Filesize
867KB

MD5
209b2ec8f27aa2c7d98764171aa0a7ab

SHA1
822bc3bf3a9fb1b47fa3fde5345f073eb435ac39

SHA256
1a444d46d8a5b454780f2505c5c72e567db67835a72980a0276b0e4babef641b

SHA512
fd0f30a12ca606e206510cd739b61ad35251356c864bb5ed8a5ea0b5272f3c4f717b32d2c15a136cbb8149ac3f34e4b332553a785e791ab2356465c5731fb3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1808148.exe

Filesize
663KB

MD5
4016a3e034923b741f27aa3bb529c5da

SHA1
eebdae283d74aa8f424dd3c419ffedd63d8c2839

SHA256
ac28195c1ca40fffe97ebde5c95bd1fa6c4a5fc80660ba7c645e4d16f2481341

SHA512
3cecf3b15688a52c31af55049908574c91b6e9e8aeea27ab72aea730200655c72e9a096339ea958d478e7c7d84530c9603dc829db41cd8d1b73a193b0613f575

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5557052.exe

Filesize
394KB

MD5
dcd98cf126fd3c2368be34d480a80f46

SHA1
9656fee0cf27382525769386759dd487ec1dcacc

SHA256
95a79465d2787248e90995edffbd713cbf10329284c1b51efafa68d0552d92ac

SHA512
fcc9893c4799f6d7f7b20a7250b2380fa97d23e7d010965c79a74c6c479edcb511c5de135047c524056676ade87cb1ba939999ba6c2b91a325a325211b43c001

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9334839.exe

Filesize
315KB

MD5
e822789e003b179da6c1d8097d3a26d5

SHA1
0a158b8c2e2b7dd5e3bfecfa010a63d179e1bf23

SHA256
550e6cb17e65a97635b6d0d26f9f7aa5c043bc7e8ab918cc14bc318bfcbe318d

SHA512
d3bcc21c07c4c356c72d0fd2a508eacd66589136b4892ab2c5350537470a6f001dd80b63c9ae36b1e802e8c5230ae565ebdd25f6ce426fb34fc9fa47924b4bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3748217.exe

Filesize
168KB

MD5
54cf500a002a45c935552c0eff2c0645

SHA1
b9d186fc0aebd52c6f6af08d8856db128d312909

SHA256
77fabb560c648afe3c063b835a7c84073e171f33f9f51318f7e93dba3b26e03b

SHA512
1d81792f92fb4efba1e35f378e17b9f8934badbd30c422961b5d42d3d2de16f6463433de4df23c36f1ec5cb89701c3a61b621031ed2bf991dfa282d727601d9f

Download Submit
memory/2436-78-0x000000000A1C0000-0x000000000A1FC000-memory.dmp

Filesize
240KB

Download
memory/2436-77-0x000000000A160000-0x000000000A172000-memory.dmp

Filesize
72KB

Download
memory/2436-76-0x000000000A230000-0x000000000A33A000-memory.dmp

Filesize
1.0MB

Download
memory/2436-75-0x000000000A6D0000-0x000000000ACE8000-memory.dmp

Filesize
6.1MB

Download
memory/2436-74-0x0000000004A60000-0x0000000004A66000-memory.dmp

Filesize
24KB

Download
memory/2436-73-0x0000000000280000-0x00000000002B0000-memory.dmp

Filesize
192KB

Download
memory/2436-79-0x0000000004560000-0x00000000045AC000-memory.dmp

Filesize
304KB

Download
memory/3712-50-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-39-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-53-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-56-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-49-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-46-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-44-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-43-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-40-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-54-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-67-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3712-69-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3712-58-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-60-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-62-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-64-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-66-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3712-38-0x0000000004A20000-0x0000000004A38000-memory.dmp

Filesize
96KB

Download
memory/3712-37-0x0000000004B80000-0x0000000005124000-memory.dmp

Filesize
5.6MB

Download
memory/3712-36-0x0000000002340000-0x000000000235A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads