resource	yara_rule
behavioral10/memory/2680-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral10/memory/2680-66-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral10/memory/2680-68-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral10/memory/2680-70-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral10/memory/2680-72-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral10/memory/2680-74-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

resource	yara_rule
behavioral10/files/0x0007000000016d7b-44.dat	healer
behavioral10/files/0x0007000000016d7b-46.dat	healer
behavioral10/files/0x0007000000016d7b-47.dat	healer
behavioral10/memory/2620-48-0x0000000000390000-0x000000000039A000-memory.dmp	healer

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q6103369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q6103369.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q6103369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q6103369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q6103369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q6103369.exe

pid	Process
1724	z3297569.exe
1728	z6717777.exe
2608	z1745836.exe
2756	z2371937.exe
2620	q6103369.exe
2632	r5740488.exe

pid	Process
2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe
1724	z3297569.exe
1724	z3297569.exe
1728	z6717777.exe
1728	z6717777.exe
2608	z1745836.exe
2608	z1745836.exe
2756	z2371937.exe
2756	z2371937.exe
2756	z2371937.exe
2756	z2371937.exe
2632	r5740488.exe
2544	WerFault.exe
2544	WerFault.exe
2544	WerFault.exe
2544	WerFault.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	q6103369.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q6103369.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z1745836.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z2371937.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3297569.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z6717777.exe

description	pid	Process	procid_target
PID 2060 wrote to memory of 1724	2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe	28
PID 2060 wrote to memory of 1724	2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe	28
PID 2060 wrote to memory of 1724	2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe	28
PID 2060 wrote to memory of 1724	2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe	28
PID 2060 wrote to memory of 1724	2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe	28
PID 2060 wrote to memory of 1724	2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe	28
PID 2060 wrote to memory of 1724	2060	505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe	28
PID 1724 wrote to memory of 1728	1724	z3297569.exe	29
PID 1724 wrote to memory of 1728	1724	z3297569.exe	29
PID 1724 wrote to memory of 1728	1724	z3297569.exe	29
PID 1724 wrote to memory of 1728	1724	z3297569.exe	29
PID 1724 wrote to memory of 1728	1724	z3297569.exe	29
PID 1724 wrote to memory of 1728	1724	z3297569.exe	29
PID 1724 wrote to memory of 1728	1724	z3297569.exe	29
PID 1728 wrote to memory of 2608	1728	z6717777.exe	30
PID 1728 wrote to memory of 2608	1728	z6717777.exe	30
PID 1728 wrote to memory of 2608	1728	z6717777.exe	30
PID 1728 wrote to memory of 2608	1728	z6717777.exe	30
PID 1728 wrote to memory of 2608	1728	z6717777.exe	30
PID 1728 wrote to memory of 2608	1728	z6717777.exe	30
PID 1728 wrote to memory of 2608	1728	z6717777.exe	30
PID 2608 wrote to memory of 2756	2608	z1745836.exe	31
PID 2608 wrote to memory of 2756	2608	z1745836.exe	31
PID 2608 wrote to memory of 2756	2608	z1745836.exe	31
PID 2608 wrote to memory of 2756	2608	z1745836.exe	31
PID 2608 wrote to memory of 2756	2608	z1745836.exe	31
PID 2608 wrote to memory of 2756	2608	z1745836.exe	31
PID 2608 wrote to memory of 2756	2608	z1745836.exe	31
PID 2756 wrote to memory of 2620	2756	z2371937.exe	32
PID 2756 wrote to memory of 2620	2756	z2371937.exe	32
PID 2756 wrote to memory of 2620	2756	z2371937.exe	32
PID 2756 wrote to memory of 2620	2756	z2371937.exe	32
PID 2756 wrote to memory of 2620	2756	z2371937.exe	32
PID 2756 wrote to memory of 2620	2756	z2371937.exe	32
PID 2756 wrote to memory of 2620	2756	z2371937.exe	32
PID 2756 wrote to memory of 2632	2756	z2371937.exe	33
PID 2756 wrote to memory of 2632	2756	z2371937.exe	33
PID 2756 wrote to memory of 2632	2756	z2371937.exe	33
PID 2756 wrote to memory of 2632	2756	z2371937.exe	33
PID 2756 wrote to memory of 2632	2756	z2371937.exe	33
PID 2756 wrote to memory of 2632	2756	z2371937.exe	33
PID 2756 wrote to memory of 2632	2756	z2371937.exe	33
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2680	2632	r5740488.exe	35
PID 2632 wrote to memory of 2544	2632	r5740488.exe	36
PID 2632 wrote to memory of 2544	2632	r5740488.exe	36
PID 2632 wrote to memory of 2544	2632	r5740488.exe	36
PID 2632 wrote to memory of 2544	2632	r5740488.exe	36
PID 2632 wrote to memory of 2544	2632	r5740488.exe	36
PID 2632 wrote to memory of 2544	2632	r5740488.exe	36
PID 2632 wrote to memory of 2544	2632	r5740488.exe	36
PID 2680 wrote to memory of 2636	2680	AppLaunch.exe	37

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads