healer | 31a0f98c37f0acc09888796e5a3829ee1478723d2005a67d531c13c9d419937a

General

Target

811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe
Size

217KB
MD5

811f66fa14f932f74f348ec0471cf030
SHA1

45e99adf9a858d66bc4f9711664f554c7645e965
SHA256

31a0f98c37f0acc09888796e5a3829ee1478723d2005a67d531c13c9d419937a
SHA512

064808e14a1ed0878b8fca3002f458716b32c45706d128e6f3c5af78b299341b0b8ceded00a5be91d40af977adb08d648d03a8f8c540bc64ec3e447e371f76fd
SSDEEP

6144:KSy+bnr+Op0yN90QEzsUl1Xs93Le+Ixlh7:uMryy90ZsUc93LylB

Score

10^/10

healer mystic dropper evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000233f4-11.dat	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x00090000000233f0-6.dat	healer
behavioral1/memory/1800-8-0x0000000000260000-0x000000000026A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3320313.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3320313.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
1800	a3320313.exe
4552	b1949194.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3320313.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1800	a3320313.exe
1800	a3320313.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	a3320313.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1800	748	811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe	82
PID 748 wrote to memory of 1800	748	811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe	82
PID 748 wrote to memory of 4552	748	811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe	90
PID 748 wrote to memory of 4552	748	811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe	90
PID 748 wrote to memory of 4552	748	811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\811f66fa14f932f74f348ec0471cf030_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3320313.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3320313.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1949194.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1949194.exe
  2⤵
  - Executes dropped EXE
  PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3320313.exe

Filesize
19KB

MD5
6780bb773720356614708151debfb753

SHA1
00149b9531555bcbecbe28a0169d7ad1a2558121

SHA256
8b401bd46fa294627f5252d03edb27770cd0c5009f25e9dd5b66d6e547fed355

SHA512
2caa8f54e7b8f294d302ef79df250e6651e0ad0325b09cc5e06c0cf13865e3b45a1720dee2a159b745ff7fb48944b36d2fdc59d99d9e51042a4172abbf01e859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1949194.exe

Filesize
140KB

MD5
712b02c03591a245e6ab488de6244708

SHA1
5d59cebe9fd0c3baa29250af0a6c2de9369f022e

SHA256
03b4a0027f08caf78d560dc8141a09f9c289d025d1607cb9faa2ff3f7a5cb6b9

SHA512
2a187f40dc693eb0a70c51c1b862bf24130546d154e8e0d0dcf899ab3a94a48bf2f8d035074379068bd5281a1b57443387f5e34be3600cc99cc59bbb1cb4c742

Download Submit
memory/1800-8-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1800-7-0x00007FF883393000-0x00007FF883395000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads