healer | 6c95b3e57e2949fd5bcbb331fd39e29c61bc609346367c0d9d6ce496a63ac98c

General

Target
2026-09-13_69399af8619198ae3b8de74780dc0026_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 177KB
Sample260913-rkg7bazvex
SHA256 6c95b3e57e2949fd5bcbb331fd39e29c61bc609346367c0d9d6ce496a63ac98c
MD5 69399af8619198ae3b8de74780dc0026
SHA1 c73c9ee78bcb00bc2430c383583e79238128e183
SHA512 a42be58940393056b02bbfca3860616adfbabe20d95043c59ccbd93a8f79f934f7549f3bcd9c0c8be6d7aba19c4e4191c458242b039d5024a4816a64bbb34f01
SSDEEP 3072:fohG5jWKZ9X+5xr9vvEDSaxVIyh96+Z7nVEA:fxWi9OvVvEDSa19T7VJ
TLSH
T17B048D203648C077F5AB247189E9DA756AB8B8350B5F65DBFBC4066D0F217E26B30347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper evasion healer trojan

Malware Config

Signatures

Family: Healer
Healer an antivirus disabler dropper.
dropper healer

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/5880-2-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	AppLaunch.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	AppLaunch.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	AppLaunch.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/memory/5880-2-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 5880	4316	2026-09-13_69399af8619198ae3b8de74780dc0026_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_69399af8619198ae3b8de74780dc0026_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5880	AppLaunch.exe
5880	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5880	AppLaunch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 5880	4316	2026-09-13_69399af8619198ae3b8de74780dc0026_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 4316 wrote to memory of 5880	4316	2026-09-13_69399af8619198ae3b8de74780dc0026_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-13_69399af8619198ae3b8de74780dc0026_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_69399af8619198ae3b8de74780dc0026_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender Real-time Protection settings
  - Modifies Windows Defender TamperProtection settings
  - Modifies Windows Defender notification settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5880