healer | bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c

General

Target

WEXTRACT.exe
Size

497KB
MD5

b86c688c83ea1a7fd4f3c0030ea16dd0
SHA1

f3f0c529bff95b9d8eab4b3b34255d056cac6952
SHA256

bdc94c688a45edd35d57b114679ba844194daf1026f3abf5b8f1223c8d6ff47c
SHA512

a140ce40462f355d721543e02a44cc759c9ae095b6b2f002046633dfa9fdeb48373d0cf945049379f5bcfe3df5ae04e2acd1ed36d68f6a28db3c66713fe79a30
SSDEEP

12288:3MrZy90oLn5mW+xggEhkbXsbF8QqVUbx3KE:+yL5mRxgGzKynVex3B

Score

10^/10

healer mystic redline stas dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes

auth_value
db6d96c4eade05afc28c31d9ad73a73c

Signatures

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe	healer
behavioral2/memory/1492-21-0x00000000006A0000-0x00000000006AA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a7991102.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a7991102.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a7991102.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a7991102.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 5 IoCs

Processes:

v8044467.exev3607374.exea7991102.exeb4104776.exec5027616.exe

pid process

1892 v8044467.exe
4688 v3607374.exe
1492 a7991102.exe
2156 b4104776.exe
5096 c5027616.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a7991102.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a7991102.exe

pid	process
1892	v8044467.exe
4688	v3607374.exe
1492	a7991102.exe
2156	b4104776.exe
5096	c5027616.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a7991102.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WEXTRACT.exev8044467.exev3607374.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEXTRACT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8044467.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v3607374.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a7991102.exe

pid process

1492 a7991102.exe
1492 a7991102.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a7991102.exe

description pid process

Token: SeDebugPrivilege 1492 a7991102.exe

pid	process
1492	a7991102.exe
1492	a7991102.exe

description	pid	process
Token: SeDebugPrivilege	1492	a7991102.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

WEXTRACT.exev8044467.exev3607374.exe

description	pid	process	target process
PID 2948 wrote to memory of 1892	2948	WEXTRACT.exe	v8044467.exe
PID 2948 wrote to memory of 1892	2948	WEXTRACT.exe	v8044467.exe
PID 2948 wrote to memory of 1892	2948	WEXTRACT.exe	v8044467.exe
PID 1892 wrote to memory of 4688	1892	v8044467.exe	v3607374.exe
PID 1892 wrote to memory of 4688	1892	v8044467.exe	v3607374.exe
PID 1892 wrote to memory of 4688	1892	v8044467.exe	v3607374.exe
PID 4688 wrote to memory of 1492	4688	v3607374.exe	a7991102.exe
PID 4688 wrote to memory of 1492	4688	v3607374.exe	a7991102.exe
PID 4688 wrote to memory of 2156	4688	v3607374.exe	b4104776.exe
PID 4688 wrote to memory of 2156	4688	v3607374.exe	b4104776.exe
PID 4688 wrote to memory of 2156	4688	v3607374.exe	b4104776.exe
PID 1892 wrote to memory of 5096	1892	v8044467.exe	c5027616.exe
PID 1892 wrote to memory of 5096	1892	v8044467.exe	c5027616.exe
PID 1892 wrote to memory of 5096	1892	v8044467.exe	c5027616.exe

C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe
"C:\Users\Admin\AppData\Local\Temp\WEXTRACT.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe
      4⤵
      Executes dropped EXE
      PID:2156
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe
    3⤵
    - Executes dropped EXE
    PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8044467.exe

Filesize
373KB

MD5
41b0ae85720b22815a78d8f306a6def9

SHA1
cb7397815748e01ba678568f60acc3fed3a31f23

SHA256
387d7ccbbd446c53df5e0f73642cf3f42e373c2f2c53c31541746e15531d584f

SHA512
0f54dbd3b8303aa5db209c2e8729a735e9685134731cc8c282d531101779dfe97d969d01544cd91409c36c5479c8c91b3cc15010f6cbf65eed0c343bdbbcbea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5027616.exe

Filesize
175KB

MD5
c5c98861bd594722b1de2fe1c7cbb000

SHA1
3578cb1e411e0c33586366c4a82081b1fe99c581

SHA256
bd6bca395f568930b82e96af64290b94fd553cd8c0c111c44502ff104a5ea36f

SHA512
2fe36578dc8bed202c75646413bf2bc0c7858b3fa21b59e5bd80cc201147e9ccd2b55edce76c80f31a18130f91c069b7e442feb8bb1099974dc740b5bbe68cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3607374.exe

Filesize
217KB

MD5
cb9e393499f6a2be165acb39d6cdd655

SHA1
646c1f3e3fb41a943d3b0d1f83f10b4b92f2148b

SHA256
1ee6b212fc0013dfcc99ff6db48b76f107205683f14bcfc903b5d3b399af7f8f

SHA512
3869ab9ea0ca0e498dbe085db9977b96e583445802de446d3271078eba48ffcb29d6dbd2adbac8ae6b1d0bc76c490fdf071b708bf4c4ed6bf64f5205f97e723b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a7991102.exe

Filesize
16KB

MD5
273287a944e3d95b524db8680d58beb4

SHA1
bbc13ee2bb7b9eb8c1d77d62f92387fb6879b9d8

SHA256
3136a980a76778a44d0df30706738c6b031cec3f581f46d10a94f42eb43beb64

SHA512
0677ac63ba8524bb9564da8dfc80c08b24f47f51161a5a56a236f85ad65670e3abd17d103a2bc278b5a0f36640552eb36298161597094f627e8d3c6cb02bbe23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b4104776.exe

Filesize
141KB

MD5
279a30572ebf3acb076a15d3daaa1df6

SHA1
9421f40fefcc18ff6b30369195d0899eb268de58

SHA256
f5f82282696a6265a4c3f535f5e3e20ea6d459bff3ca77937ec7f6391634eb5c

SHA512
4547c697597397ebbe3e5c2e064b87b6605c71651f2e1affec8f19042dc0738a8791c9ad7bb8a00322b8c1023069df8887e376a548c6166b6b3f1110abe8889e

Download Submit
memory/1492-21-0x00000000006A0000-0x00000000006AA000-memory.dmp

Filesize
40KB

Download
memory/1492-22-0x00007FFD5BE40000-0x00007FFD5C901000-memory.dmp

Filesize
10.8MB

Download
memory/1492-24-0x00007FFD5BE40000-0x00007FFD5C901000-memory.dmp

Filesize
10.8MB

Download
memory/5096-31-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/5096-32-0x0000000000D50000-0x0000000000D80000-memory.dmp

Filesize
192KB

Download
memory/5096-33-0x0000000005530000-0x0000000005536000-memory.dmp

Filesize
24KB

Download
memory/5096-34-0x000000000B040000-0x000000000B658000-memory.dmp

Filesize
6.1MB

Download
memory/5096-35-0x000000000ABC0000-0x000000000ACCA000-memory.dmp

Filesize
1.0MB

Download
memory/5096-36-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/5096-37-0x000000000AB00000-0x000000000AB12000-memory.dmp

Filesize
72KB

Download
memory/5096-38-0x000000000AB60000-0x000000000AB9C000-memory.dmp

Filesize
240KB

Download
memory/5096-39-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/5096-40-0x000000000ACD0000-0x000000000AD1C000-memory.dmp

Filesize
304KB

Download
memory/5096-41-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads