healer | bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c

General

Target

WEXTRACT.EXE.exe
Size

497KB
MD5

b86c688c83ea1a7fd4f3c0030ea16dd0
SHA1

f3f0c529bff95b9d8eab4b3b34255d056cac6952
SHA256

bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c
SHA512

a140ce40462f355d721543e02a44cc759c9ae095b6b2f002046633dfa9fdeb48373d0cf945049379f5bcfe3df5ae04e2acd1ed36d68f6a28db3c66713fe79a30
SSDEEP

12288:3MrZy90oLn5mW+xggEhkbXsbF8QqVUbx3KE:+yL5mRxgGzKynVex3B

Score

10^/10

healer mystic redline stas dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes

auth_value
db6d96c4eade05afc28c31d9ad73a73c

Signatures

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe	healer
behavioral2/memory/4808-21-0x0000000000A00000-0x0000000000A0A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a7991102.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7991102.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7991102.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 5 IoCs

Processes:

v8044467.exev3607374.exea7991102.exeb4104776.exec5027616.exe

pid process

772 v8044467.exe
5096 v3607374.exe
4808 a7991102.exe
3060 b4104776.exe
912 c5027616.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a7991102.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7991102.exe

pid	process
772	v8044467.exe
5096	v3607374.exe
4808	a7991102.exe
3060	b4104776.exe
912	c5027616.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7991102.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

v8044467.exev3607374.exeWEXTRACT.EXE.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8044467.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3607374.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEXTRACT.EXE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a7991102.exe

pid process

4808 a7991102.exe
4808 a7991102.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a7991102.exe

description pid process

Token: SeDebugPrivilege 4808 a7991102.exe

pid	process
4808	a7991102.exe
4808	a7991102.exe

description	pid	process
Token: SeDebugPrivilege	4808	a7991102.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

WEXTRACT.EXE.exev8044467.exev3607374.exe

description	pid	process	target process
PID 2016 wrote to memory of 772	2016	WEXTRACT.EXE.exe	v8044467.exe
PID 2016 wrote to memory of 772	2016	WEXTRACT.EXE.exe	v8044467.exe
PID 2016 wrote to memory of 772	2016	WEXTRACT.EXE.exe	v8044467.exe
PID 772 wrote to memory of 5096	772	v8044467.exe	v3607374.exe
PID 772 wrote to memory of 5096	772	v8044467.exe	v3607374.exe
PID 772 wrote to memory of 5096	772	v8044467.exe	v3607374.exe
PID 5096 wrote to memory of 4808	5096	v3607374.exe	a7991102.exe
PID 5096 wrote to memory of 4808	5096	v3607374.exe	a7991102.exe
PID 5096 wrote to memory of 3060	5096	v3607374.exe	b4104776.exe
PID 5096 wrote to memory of 3060	5096	v3607374.exe	b4104776.exe
PID 5096 wrote to memory of 3060	5096	v3607374.exe	b4104776.exe
PID 772 wrote to memory of 912	772	v8044467.exe	c5027616.exe
PID 772 wrote to memory of 912	772	v8044467.exe	c5027616.exe
PID 772 wrote to memory of 912	772	v8044467.exe	c5027616.exe

C:\Users\Admin\AppData\Local\Temp\WEXTRACT.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\WEXTRACT.EXE.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:772

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5096

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
4⤵
- Executes dropped EXE
PID:3060

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
3⤵
- Executes dropped EXE
PID:912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Impair Defenses

2

T1562

Disable or Modify Tools

2

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
Filesize
373KB

MD5
41b0ae85720b22815a78d8f306a6def9

SHA1
cb7397815748e01ba678568f60acc3fed3a31f23

SHA256
387d7ccbbd446c53df5e0f73642cf3f42e373c2f2c53c31541746e15531d584f

SHA512
0f54dbd3b8303aa5db209c2e8729a735e9685134731cc8c282d531101779dfe97d969d01544cd91409c36c5479c8c91b3cc15010f6cbf65eed0c343bdbbcbea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
Filesize
175KB

MD5
c5c98861bd594722b1de2fe1c7cbb000

SHA1
3578cb1e411e0c33586366c4a82081b1fe99c581

SHA256
bd6bca395f568930b82e96af64290b94fd553cd8c0c111c44502ff104a5ea36f

SHA512
2fe36578dc8bed202c75646413bf2bc0c7858b3fa21b59e5bd80cc201147e9ccd2b55edce76c80f31a18130f91c069b7e442feb8bb1099974dc740b5bbe68cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
Filesize
217KB

MD5
cb9e393499f6a2be165acb39d6cdd655

SHA1
646c1f3e3fb41a943d3b0d1f83f10b4b92f2148b

SHA256
1ee6b212fc0013dfcc99ff6db48b76f107205683f14bcfc903b5d3b399af7f8f

SHA512
3869ab9ea0ca0e498dbe085db9977b96e583445802de446d3271078eba48ffcb29d6dbd2adbac8ae6b1d0bc76c490fdf071b708bf4c4ed6bf64f5205f97e723b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
Filesize
16KB

MD5
273287a944e3d95b524db8680d58beb4

SHA1
bbc13ee2bb7b9eb8c1d77d62f92387fb6879b9d8

SHA256
3136a980a76778a44d0df30706738c6b031cec3f581f46d10a94f42eb43beb64

SHA512
0677ac63ba8524bb9564da8dfc80c08b24f47f51161a5a56a236f85ad65670e3abd17d103a2bc278b5a0f36640552eb36298161597094f627e8d3c6cb02bbe23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
Filesize
141KB

MD5
279a30572ebf3acb076a15d3daaa1df6

SHA1
9421f40fefcc18ff6b30369195d0899eb268de58

SHA256
f5f82282696a6265a4c3f535f5e3e20ea6d459bff3ca77937ec7f6391634eb5c

SHA512
4547c697597397ebbe3e5c2e064b87b6605c71651f2e1affec8f19042dc0738a8791c9ad7bb8a00322b8c1023069df8887e376a548c6166b6b3f1110abe8889e

Download Submit
memory/912-35-0x000000000B390000-0x000000000B9A8000-memory.dmp

Filesize
6.1MB

Download
memory/912-38-0x0000000005720000-0x0000000005732000-memory.dmp

Filesize
72KB

Download
memory/912-41-0x00000000013B0000-0x00000000013FC000-memory.dmp

Filesize
304KB

Download
memory/912-31-0x0000000073C10000-0x00000000743C0000-memory.dmp

Filesize
7.7MB

Download
memory/912-32-0x0000000000CF0000-0x0000000000D20000-memory.dmp

Filesize
192KB

Download
memory/912-33-0x0000000005610000-0x0000000005616000-memory.dmp

Filesize
24KB

Download
memory/912-34-0x0000000073C10000-0x00000000743C0000-memory.dmp

Filesize
7.7MB

Download
memory/912-40-0x0000000005620000-0x0000000005630000-memory.dmp

Filesize
64KB

Download
memory/912-36-0x000000000AE80000-0x000000000AF8A000-memory.dmp

Filesize
1.0MB

Download
memory/912-37-0x0000000005620000-0x0000000005630000-memory.dmp

Filesize
64KB

Download
memory/912-39-0x000000000ADF0000-0x000000000AE2C000-memory.dmp

Filesize
240KB

Download
memory/4808-24-0x00007FF910F90000-0x00007FF911A51000-memory.dmp

Filesize
10.8MB

Download
memory/4808-21-0x0000000000A00000-0x0000000000A0A000-memory.dmp

Filesize
40KB

Download
memory/4808-22-0x00007FF910F90000-0x00007FF911A51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads