healer | 31a0f98c37f0acc09888796e5a3829ee1478723d2005a67d531c13c9d419937a

General

Target

811f66fa14f932f74f348ec0471cf030.exe
Size

217KB
MD5

811f66fa14f932f74f348ec0471cf030
SHA1

45e99adf9a858d66bc4f9711664f554c7645e965
SHA256

31a0f98c37f0acc09888796e5a3829ee1478723d2005a67d531c13c9d419937a
SHA512

064808e14a1ed0878b8fca3002f458716b32c45706d128e6f3c5af78b299341b0b8ceded00a5be91d40af977adb08d648d03a8f8c540bc64ec3e447e371f76fd
SSDEEP

6144:KSy+bnr+Op0yN90QEzsUl1Xs93Le+Ixlh7:uMryy90ZsUc93LylB

Score

10^/10

healer mystic dropper evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023415-11.dat	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000a00000002340b-5.dat	healer
behavioral1/memory/3700-8-0x0000000000250000-0x000000000025A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a3320313.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a3320313.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
3700	a3320313.exe
5036	b1949194.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a3320313.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	811f66fa14f932f74f348ec0471cf030.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	a3320313.exe
3700	a3320313.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	a3320313.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3700	4104	811f66fa14f932f74f348ec0471cf030.exe	81
PID 4104 wrote to memory of 3700	4104	811f66fa14f932f74f348ec0471cf030.exe	81
PID 4104 wrote to memory of 5036	4104	811f66fa14f932f74f348ec0471cf030.exe	90
PID 4104 wrote to memory of 5036	4104	811f66fa14f932f74f348ec0471cf030.exe	90
PID 4104 wrote to memory of 5036	4104	811f66fa14f932f74f348ec0471cf030.exe	90

C:\Users\Admin\AppData\Local\Temp\811f66fa14f932f74f348ec0471cf030.exe
"C:\Users\Admin\AppData\Local\Temp\811f66fa14f932f74f348ec0471cf030.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3320313.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3320313.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1949194.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1949194.exe
  2⤵
  - Executes dropped EXE
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\a3320313.exe

Filesize
19KB

MD5
6780bb773720356614708151debfb753

SHA1
00149b9531555bcbecbe28a0169d7ad1a2558121

SHA256
8b401bd46fa294627f5252d03edb27770cd0c5009f25e9dd5b66d6e547fed355

SHA512
2caa8f54e7b8f294d302ef79df250e6651e0ad0325b09cc5e06c0cf13865e3b45a1720dee2a159b745ff7fb48944b36d2fdc59d99d9e51042a4172abbf01e859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b1949194.exe

Filesize
140KB

MD5
712b02c03591a245e6ab488de6244708

SHA1
5d59cebe9fd0c3baa29250af0a6c2de9369f022e

SHA256
03b4a0027f08caf78d560dc8141a09f9c289d025d1607cb9faa2ff3f7a5cb6b9

SHA512
2a187f40dc693eb0a70c51c1b862bf24130546d154e8e0d0dcf899ab3a94a48bf2f8d035074379068bd5281a1b57443387f5e34be3600cc99cc59bbb1cb4c742

Download Submit
memory/3700-7-0x00007FF933113000-0x00007FF933115000-memory.dmp

Filesize
8KB

Download
memory/3700-8-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads