healer | 3e2152014824a6561c2a48c29926c44d393465b43dc8f86a3e65c00b9252ee5f

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2023 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe
Size

600KB
MD5

4263b0d330ce65e7861edfd863576c30
SHA1

6c6e14f010b7ad9d33aac1530909ce9dd2d9184b
SHA256

3e2152014824a6561c2a48c29926c44d393465b43dc8f86a3e65c00b9252ee5f
SHA512

5b28c2bfec61d8b013cc3531285242e68ebbb827cdb694bd49398b071d6f3b7247113a49860bb133cffd17cbba859802d3a57e1ad21a2fe5008959d7d6a2fbb6
SSDEEP

12288:rMrey90cokvsank6p+oqH+hqpgmFxYXXNWsD0vl0MQC2rMx22E0:Zy/sJ+vmFxYnNr090MQCpxJE0

Score

10^/10

healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1736-19-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1736-20-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1736-21-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1736-23-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/3956-14-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 4 IoCs

pid	Process
1888	z9664862.exe
4176	q5285307.exe
1020	r0070509.exe
2112	s3043295.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9664862.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4176 set thread context of 3956	4176	q5285307.exe	87
PID 1020 set thread context of 1736	1020	r0070509.exe	94
PID 2112 set thread context of 4348	2112	s3043295.exe	103

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3708	4176	WerFault.exe	85
2180	1020	WerFault.exe	91
448	1736	WerFault.exe	94
2272	2112	WerFault.exe	101

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	AppLaunch.exe
3956	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	AppLaunch.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1888	4924	NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe	83
PID 4924 wrote to memory of 1888	4924	NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe	83
PID 4924 wrote to memory of 1888	4924	NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe	83
PID 1888 wrote to memory of 4176	1888	z9664862.exe	85
PID 1888 wrote to memory of 4176	1888	z9664862.exe	85
PID 1888 wrote to memory of 4176	1888	z9664862.exe	85
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 4176 wrote to memory of 3956	4176	q5285307.exe	87
PID 1888 wrote to memory of 1020	1888	z9664862.exe	91
PID 1888 wrote to memory of 1020	1888	z9664862.exe	91
PID 1888 wrote to memory of 1020	1888	z9664862.exe	91
PID 1020 wrote to memory of 532	1020	r0070509.exe	93
PID 1020 wrote to memory of 532	1020	r0070509.exe	93
PID 1020 wrote to memory of 532	1020	r0070509.exe	93
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 1020 wrote to memory of 1736	1020	r0070509.exe	94
PID 4924 wrote to memory of 2112	4924	NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe	101
PID 4924 wrote to memory of 2112	4924	NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe	101
PID 4924 wrote to memory of 2112	4924	NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe	101
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103
PID 2112 wrote to memory of 4348	2112	s3043295.exe	103

C:\Users\Admin\AppData\Local\Temp\NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4263b0d330ce65e7861edfd863576c30_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9664862.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9664862.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5285307.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5285307.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 148
      4⤵
      Program crash
      PID:3708
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0070509.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0070509.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:532
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 548
        5⤵
        Program crash
        
        PID:448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 148
      4⤵
      Program crash
      PID:2180
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3043295.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3043295.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 220
    3⤵
    - Program crash
    PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4176 -ip 4176
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1020 -ip 1020
1⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1736 -ip 1736
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2112 -ip 2112
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3043295.exe

Filesize
380KB

MD5
e3bbb3222cb0fb8a59c644d92aed4a22

SHA1
739d382d269cf3cf49aa9a2fb18fdb23e8ca7d98

SHA256
71e8af8d39c9b5f87fc61a76bb5b8efc249edf98f664fe9cce54071854143010

SHA512
6dbd0cf66dcd37901f1c88389ad4641603307ceec266c654321d371db2a1fbdbaedd19b24dfe3981e22caffc19ab2eaf4b2a155b99e1d170751d48914734afa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s3043295.exe

Filesize
380KB

MD5
e3bbb3222cb0fb8a59c644d92aed4a22

SHA1
739d382d269cf3cf49aa9a2fb18fdb23e8ca7d98

SHA256
71e8af8d39c9b5f87fc61a76bb5b8efc249edf98f664fe9cce54071854143010

SHA512
6dbd0cf66dcd37901f1c88389ad4641603307ceec266c654321d371db2a1fbdbaedd19b24dfe3981e22caffc19ab2eaf4b2a155b99e1d170751d48914734afa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9664862.exe

Filesize
338KB

MD5
9ec971752815b67e902907573f69ebfa

SHA1
1062cc6cbd098db0fa8ee6c0006d0984bb4f93e7

SHA256
ced6eb532ebff1de4ea6dc523313b97bfc8bfb99c897b40c55a533f61b8ec664

SHA512
f0f308bc27926b4dfd31427e97f875bcdce0d979f02bbe9182d6536fb42a3e32fcfb1bab28e9abc5c59cae03f5acaf1fbad395ab9d22490ff52616315d58a814

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9664862.exe

Filesize
338KB

MD5
9ec971752815b67e902907573f69ebfa

SHA1
1062cc6cbd098db0fa8ee6c0006d0984bb4f93e7

SHA256
ced6eb532ebff1de4ea6dc523313b97bfc8bfb99c897b40c55a533f61b8ec664

SHA512
f0f308bc27926b4dfd31427e97f875bcdce0d979f02bbe9182d6536fb42a3e32fcfb1bab28e9abc5c59cae03f5acaf1fbad395ab9d22490ff52616315d58a814

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5285307.exe

Filesize
217KB

MD5
82cb594ef7a417f592a7bd2a86e1255a

SHA1
77e5ac8e4ed1bf5a8e714640437862d34a640a2b

SHA256
be6b45afb65aa5af4e93ac8d79e771eb0621ded0db4b22c1fbd139cf8be7563d

SHA512
c083f36cb10dd47d44506d40628ab16631189bfda98dd565d0e3918694d39691a35ac17b8c9b519ba716bac2254b566c7fe203820d0c7439b56f59e1d1a1603e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\q5285307.exe

Filesize
217KB

MD5
82cb594ef7a417f592a7bd2a86e1255a

SHA1
77e5ac8e4ed1bf5a8e714640437862d34a640a2b

SHA256
be6b45afb65aa5af4e93ac8d79e771eb0621ded0db4b22c1fbd139cf8be7563d

SHA512
c083f36cb10dd47d44506d40628ab16631189bfda98dd565d0e3918694d39691a35ac17b8c9b519ba716bac2254b566c7fe203820d0c7439b56f59e1d1a1603e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0070509.exe

Filesize
346KB

MD5
4ea1c01649f657c9f7e78b692a574129

SHA1
7224684f993d5786fe243ddb8b6c74b6c60e6c9a

SHA256
c3605b01a5c3a42151578a5027ebfab7ca63fc7e4bbcf579c08dd3e1a6ac2b09

SHA512
959d52240e3863c24f820e7e637f6ad1810323773bc888fd6a2043ac1204ca23ebea0a9f11bae38364e3b0b421c6a4b3eaaf6341f4b7d9b2bff16f52242c93f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r0070509.exe

Filesize
346KB

MD5
4ea1c01649f657c9f7e78b692a574129

SHA1
7224684f993d5786fe243ddb8b6c74b6c60e6c9a

SHA256
c3605b01a5c3a42151578a5027ebfab7ca63fc7e4bbcf579c08dd3e1a6ac2b09

SHA512
959d52240e3863c24f820e7e637f6ad1810323773bc888fd6a2043ac1204ca23ebea0a9f11bae38364e3b0b421c6a4b3eaaf6341f4b7d9b2bff16f52242c93f6

Download Submit
memory/1736-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1736-20-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1736-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1736-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3956-15-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/3956-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3956-38-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/3956-36-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/4348-30-0x0000000005E00000-0x0000000006418000-memory.dmp

Filesize
6.1MB

Download
memory/4348-29-0x0000000005690000-0x0000000005696000-memory.dmp

Filesize
24KB

Download
memory/4348-31-0x0000000005900000-0x0000000005A0A000-memory.dmp

Filesize
1.0MB

Download
memory/4348-33-0x0000000005830000-0x0000000005842000-memory.dmp

Filesize
72KB

Download
memory/4348-32-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download
memory/4348-34-0x0000000005890000-0x00000000058CC000-memory.dmp

Filesize
240KB

Download
memory/4348-35-0x0000000005A10000-0x0000000005A5C000-memory.dmp

Filesize
304KB

Download
memory/4348-28-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/4348-27-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4348-39-0x0000000074220000-0x00000000749D0000-memory.dmp

Filesize
7.7MB

Download
memory/4348-40-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download