healer | bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c

General

Target

WEXTRACT.exe
Size

497KB
MD5

b86c688c83ea1a7fd4f3c0030ea16dd0
SHA1

f3f0c529bff95b9d8eab4b3b34255d056cac6952
SHA256

bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c
SHA512

a140ce40462f355d721543e02a44cc759c9ae095b6b2f002046633dfa9fdeb48373d0cf945049379f5bcfe3df5ae04e2acd1ed36d68f6a28db3c66713fe79a30
SSDEEP

12288:3MrZy90oLn5mW+xggEhkbXsbF8QqVUbx3KE:+yL5mRxgGzKynVex3B

Score

10^/10

healer mystic redline stas dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes

auth_value
db6d96c4eade05afc28c31d9ad73a73c

Signatures

Detect Mystic stealer payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321f-26.dat	mystic_family
behavioral2/files/0x000600000002321f-27.dat	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321e-20.dat	healer
behavioral2/memory/2152-21-0x0000000000FE0000-0x0000000000FEA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7991102.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
4848	v8044467.exe
4984	v3607374.exe
2152	a7991102.exe
3264	b4104776.exe
1652	c5027616.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7991102.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEXTRACT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8044467.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3607374.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2152	a7991102.exe
2152	a7991102.exe
2152	a7991102.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	a7991102.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4848	4732	WEXTRACT.exe	90
PID 4732 wrote to memory of 4848	4732	WEXTRACT.exe	90
PID 4732 wrote to memory of 4848	4732	WEXTRACT.exe	90
PID 4848 wrote to memory of 4984	4848	v8044467.exe	91
PID 4848 wrote to memory of 4984	4848	v8044467.exe	91
PID 4848 wrote to memory of 4984	4848	v8044467.exe	91
PID 4984 wrote to memory of 2152	4984	v3607374.exe	92
PID 4984 wrote to memory of 2152	4984	v3607374.exe	92
PID 4984 wrote to memory of 3264	4984	v3607374.exe	100
PID 4984 wrote to memory of 3264	4984	v3607374.exe	100
PID 4984 wrote to memory of 3264	4984	v3607374.exe	100
PID 4848 wrote to memory of 1652	4848	v8044467.exe	101
PID 4848 wrote to memory of 1652	4848	v8044467.exe	101
PID 4848 wrote to memory of 1652	4848	v8044467.exe	101

C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe
"C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
      4⤵
      Executes dropped EXE
      PID:3264
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
    3⤵
    - Executes dropped EXE
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe

Filesize
373KB

MD5
41b0ae85720b22815a78d8f306a6def9

SHA1
cb7397815748e01ba678568f60acc3fed3a31f23

SHA256
387d7ccbbd446c53df5e0f73642cf3f42e373c2f2c53c31541746e15531d584f

SHA512
0f54dbd3b8303aa5db209c2e8729a735e9685134731cc8c282d531101779dfe97d969d01544cd91409c36c5479c8c91b3cc15010f6cbf65eed0c343bdbbcbea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe

Filesize
113KB

MD5
eff286497cd1001146fa881fcef77ff8

SHA1
eaae0c1d6ba179c5d0091c2d2e8320bc49c87df6

SHA256
34ba5f21eff58eeef74aca874495dfc5de95e6fda88fa3ea06daa3ca1d1029a4

SHA512
21451f0f3044196b755bd81e8838d66b163daad3c5e3b6805e69adc81d5bfce2e904f062533a3ad6902b8ac991129642aa84e147142414608a4b122b3794b5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe

Filesize
99KB

MD5
be3cf131e58f8613c968438a077ebc8b

SHA1
019361a84a1da97fd3f534c24c98a1a8ccd1c5b9

SHA256
c0cd013171138ce4dff36e384a80e0488a3682d2686d0f0d7c3fdb13ce55e9e4

SHA512
4452d9c9e9bb075efb4dfefdc6e0a9f16d2971cb2f9aef66eb71d46db2e661f98c6d609de362ee483d9f119435a142a4da59b69a9f3e8eeb4ae61e3aedf748e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe

Filesize
217KB

MD5
cb9e393499f6a2be165acb39d6cdd655

SHA1
646c1f3e3fb41a943d3b0d1f83f10b4b92f2148b

SHA256
1ee6b212fc0013dfcc99ff6db48b76f107205683f14bcfc903b5d3b399af7f8f

SHA512
3869ab9ea0ca0e498dbe085db9977b96e583445802de446d3271078eba48ffcb29d6dbd2adbac8ae6b1d0bc76c490fdf071b708bf4c4ed6bf64f5205f97e723b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe

Filesize
16KB

MD5
273287a944e3d95b524db8680d58beb4

SHA1
bbc13ee2bb7b9eb8c1d77d62f92387fb6879b9d8

SHA256
3136a980a76778a44d0df30706738c6b031cec3f581f46d10a94f42eb43beb64

SHA512
0677ac63ba8524bb9564da8dfc80c08b24f47f51161a5a56a236f85ad65670e3abd17d103a2bc278b5a0f36640552eb36298161597094f627e8d3c6cb02bbe23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe

Filesize
105KB

MD5
5b72b2e88b44f3f4691857e3af25d8cb

SHA1
846c227a50d264f2ac80a8602cad12383006f40a

SHA256
9dddd9077f3eb9850986400615ebc519820ea9f8da2b8c0e8b3717bf3d05af3b

SHA512
6e0e438bfd15821032aedfea10a443a394811fa352c20208728eae114dbecd4b421fd662844eb6f4b5367eacacd14410d61011ab38709e300257802636b415c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe

Filesize
98KB

MD5
4541c4803bf0aaa61ae64d7a9a693a6a

SHA1
d947fa08089985a6a1c3d5e567434978b53a4340

SHA256
abf1da0b488397bc3e5ee9a53695d3f8ee6d5ec2ed234ec781e796d4a465a84a

SHA512
693c0b5f96f61036d643a559912574573f95689441533737e3456da970cab4eb4d21990d409f55414837052e3121f2c70c34e81f3f600bf3bae907040540ae78

Download Submit
memory/1652-37-0x0000000009F00000-0x0000000009F12000-memory.dmp

Filesize
72KB

Download
memory/1652-35-0x0000000009FC0000-0x000000000A0CA000-memory.dmp

Filesize
1.0MB

Download
memory/1652-41-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/1652-32-0x0000000074060000-0x0000000074810000-memory.dmp

Filesize
7.7MB

Download
memory/1652-31-0x0000000000010000-0x0000000000040000-memory.dmp

Filesize
192KB

Download
memory/1652-33-0x0000000004A70000-0x0000000004A76000-memory.dmp

Filesize
24KB

Download
memory/1652-34-0x000000000A4A0000-0x000000000AAB8000-memory.dmp

Filesize
6.1MB

Download
memory/1652-40-0x0000000074060000-0x0000000074810000-memory.dmp

Filesize
7.7MB

Download
memory/1652-39-0x000000000A0D0000-0x000000000A11C000-memory.dmp

Filesize
304KB

Download
memory/1652-36-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/1652-38-0x0000000009F60000-0x0000000009F9C000-memory.dmp

Filesize
240KB

Download
memory/2152-21-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

Filesize
40KB

Download
memory/2152-24-0x00007FFDEEB20000-0x00007FFDEF5E1000-memory.dmp

Filesize
10.8MB

Download
memory/2152-22-0x00007FFDEEB20000-0x00007FFDEF5E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads