healer | 2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d

General

Target

2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe
Size

520KB
MD5

39c08319793b82f5ca453c98af9053e3
SHA1

7799859287f028020adc4ed44a087cd5e1be2653
SHA256

2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d
SHA512

4725b20d7d317c605f1e6cc734e093594da1e836525ca1501e0c69752a1ccc4913c45aa49074723ab5cbabc0d17988f471c6ed2a9050764351811885168f570b
SSDEEP

12288:iMrjy90r//2tIQxQ7Nl5umjwxaZttiVdOUUhl0a6rZOaH6rV1p:pyE2tIQupuKZttiVd2iF6rV1p

Score

10^/10

healer redline polo discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

polo

C2

193.233.20.31:4125

Attributes

auth_value
f1a1b1041a864e0f1f788d42ececa8b3

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b81-12.dat	healer
behavioral1/memory/4860-15-0x0000000000350000-0x000000000035A000-memory.dmp	healer
behavioral1/memory/4816-22-0x00000000026E0000-0x00000000026FA000-memory.dmp	healer
behavioral1/memory/4816-24-0x0000000004DF0000-0x0000000004E08000-memory.dmp	healer
behavioral1/memory/4816-32-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-52-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-50-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-48-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-46-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-44-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-42-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-40-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-38-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-36-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-35-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-30-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-28-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-26-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer
behavioral1/memory/4816-25-0x0000000004DF0000-0x0000000004E02000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2357.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	rTW50s19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	rTW50s19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	rTW50s19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	rTW50s19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	rTW50s19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	rTW50s19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2357.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b7e-57.dat	family_redline
behavioral1/memory/5004-59-0x0000000000C40000-0x0000000000C72000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
336	unio1522.exe
4860	pro2357.exe
4816	rTW50s19.exe
5004	si826872.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2357.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	rTW50s19.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	rTW50s19.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	unio1522.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unio1522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rTW50s19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si826872.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4860	pro2357.exe
4860	pro2357.exe
4816	rTW50s19.exe
4816	rTW50s19.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	pro2357.exe
Token: SeDebugPrivilege	4816	rTW50s19.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 336	5024	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe	84
PID 5024 wrote to memory of 336	5024	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe	84
PID 5024 wrote to memory of 336	5024	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe	84
PID 336 wrote to memory of 4860	336	unio1522.exe	85
PID 336 wrote to memory of 4860	336	unio1522.exe	85
PID 336 wrote to memory of 4816	336	unio1522.exe	93
PID 336 wrote to memory of 4816	336	unio1522.exe	93
PID 336 wrote to memory of 4816	336	unio1522.exe	93
PID 5024 wrote to memory of 5004	5024	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe	94
PID 5024 wrote to memory of 5004	5024	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe	94
PID 5024 wrote to memory of 5004	5024	2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe	94

C:\Users\Admin\AppData\Local\Temp\2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe
"C:\Users\Admin\AppData\Local\Temp\2e82ef28672e670b9d9ca0dbffc037afbb9771ed2ff07f92fd62b77e4209795d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1522.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1522.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2357.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2357.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rTW50s19.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rTW50s19.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si826872.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si826872.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si826872.exe

Filesize
175KB

MD5
44a26d7004f8b65e1a8bac0ccac86d6a

SHA1
30b583c2c04c1167703ae255b4d44b96b411c8ff

SHA256
37384f1bfb6d2193e4ece0ed1f6989f9ebd238e7b4582e1aedfa136cdfd07eb9

SHA512
17788355a5190ca17ead744cad71ebb7cfc7ceb84625310d31a469af0fbd50b2c304ce969530e99effeb0d23b0530b57a001f02fe918abc40ea68ad336fa187b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1522.exe

Filesize
378KB

MD5
17d2e4bcf40ee0b38999258802ffbb50

SHA1
65dc70a75af9e353186130caf91e41679f3b7c5c

SHA256
d52bc734c0380d599550e53c136efbbef497893f307b115495dafc4ecfdd8692

SHA512
9782586cce84ad6d21c4e422b858901e0b2804c4872bb117f64a4cf2086527160e430eff173eec2c82a2f24f69c3b96cd41e5a412fe80a9737b6c8fa3c2a7e31

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2357.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rTW50s19.exe

Filesize
398KB

MD5
360bee6bf65e2e29df0127bc2bb3e080

SHA1
7c4cf3a35b9d2f791c0e97e68a9a614e0a60e252

SHA256
0ca7dd45596da456f3dc06f781d08a89e122fbb2f736b4e25cece980e683a94b

SHA512
76871012ae247eaabc068aa74376d8b0592ed4cbe1c2220272319ebf365c6fe8f62c8c71a13449dd31567c6d58f4ff143e0b25dc2156306093fb12509c621d98

Download Submit
memory/4816-40-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-35-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-22-0x00000000026E0000-0x00000000026FA000-memory.dmp

Filesize
104KB

Download
memory/4816-23-0x0000000004F00000-0x00000000054A4000-memory.dmp

Filesize
5.6MB

Download
memory/4816-24-0x0000000004DF0000-0x0000000004E08000-memory.dmp

Filesize
96KB

Download
memory/4816-32-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-52-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-50-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-48-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-46-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-44-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-42-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-55-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/4816-38-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-36-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-53-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/4816-30-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-28-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-26-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4816-25-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4860-16-0x00007FFEC5883000-0x00007FFEC5885000-memory.dmp

Filesize
8KB

Download
memory/4860-15-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/4860-14-0x00007FFEC5883000-0x00007FFEC5885000-memory.dmp

Filesize
8KB

Download
memory/5004-59-0x0000000000C40000-0x0000000000C72000-memory.dmp

Filesize
200KB

Download
memory/5004-60-0x0000000005BE0000-0x00000000061F8000-memory.dmp

Filesize
6.1MB

Download
memory/5004-61-0x0000000005710000-0x000000000581A000-memory.dmp

Filesize
1.0MB

Download
memory/5004-62-0x0000000005640000-0x0000000005652000-memory.dmp

Filesize
72KB

Download
memory/5004-63-0x00000000056A0000-0x00000000056DC000-memory.dmp

Filesize
240KB

Download
memory/5004-64-0x0000000005820000-0x000000000586C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads