healer | 0305d2b6c0e5a97563a4c1099f4e6af9452bc102c37b5c9418f88da8991c5f64

General

Target

a1e5b6abdfff86723f005da754eef040N.exe
Size

722KB
MD5

a1e5b6abdfff86723f005da754eef040
SHA1

3e011e66fc70160342ec11cb33228965cb6463b1
SHA256

0305d2b6c0e5a97563a4c1099f4e6af9452bc102c37b5c9418f88da8991c5f64
SHA512

b3f069c1716f0480ccf3e20f14dd9fdeca629c630a5de75f91de29f5a9b7068937a8fe8dd7dae6ad78ab7029507a2b4687291b448554a9114079972cd06aeec3
SSDEEP

12288:6MrVy90RmQZAZq88kMXB03V+t0mU9aseTa8ADQoVO4s0e9t5VItDvHQcQawuKWBV:3yDbLMR2cRsUrore75yNvHVHBV

Score

10^/10

healer mystic redline rota discovery dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rota

C2

77.91.124.73:19071

Attributes

auth_value
320c7daa59eb9b82e20a15162392a756

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023455-31.dat	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023454-26.dat	healer
behavioral1/memory/1468-28-0x00000000008F0000-0x00000000008FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8790443.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8790443.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8790443.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8790443.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8790443.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8790443.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023452-34.dat	family_redline
behavioral1/memory/1852-36-0x0000000000A00000-0x0000000000A30000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
2944	v7804363.exe
1180	v4696654.exe
3600	v8661683.exe
1468	a8790443.exe
5116	b5770102.exe
1852	c7982580.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8790443.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v8661683.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a1e5b6abdfff86723f005da754eef040N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7804363.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v4696654.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7982580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1e5b6abdfff86723f005da754eef040N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7804363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4696654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v8661683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5770102.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	a8790443.exe
1468	a8790443.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	a8790443.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2944	4296	a1e5b6abdfff86723f005da754eef040N.exe	84
PID 4296 wrote to memory of 2944	4296	a1e5b6abdfff86723f005da754eef040N.exe	84
PID 4296 wrote to memory of 2944	4296	a1e5b6abdfff86723f005da754eef040N.exe	84
PID 2944 wrote to memory of 1180	2944	v7804363.exe	85
PID 2944 wrote to memory of 1180	2944	v7804363.exe	85
PID 2944 wrote to memory of 1180	2944	v7804363.exe	85
PID 1180 wrote to memory of 3600	1180	v4696654.exe	86
PID 1180 wrote to memory of 3600	1180	v4696654.exe	86
PID 1180 wrote to memory of 3600	1180	v4696654.exe	86
PID 3600 wrote to memory of 1468	3600	v8661683.exe	87
PID 3600 wrote to memory of 1468	3600	v8661683.exe	87
PID 3600 wrote to memory of 5116	3600	v8661683.exe	96
PID 3600 wrote to memory of 5116	3600	v8661683.exe	96
PID 3600 wrote to memory of 5116	3600	v8661683.exe	96
PID 1180 wrote to memory of 1852	1180	v4696654.exe	97
PID 1180 wrote to memory of 1852	1180	v4696654.exe	97
PID 1180 wrote to memory of 1852	1180	v4696654.exe	97

C:\Users\Admin\AppData\Local\Temp\a1e5b6abdfff86723f005da754eef040N.exe
"C:\Users\Admin\AppData\Local\Temp\a1e5b6abdfff86723f005da754eef040N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7804363.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7804363.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4696654.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4696654.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8661683.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8661683.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8790443.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8790443.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5770102.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5770102.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7982580.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7982580.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7804363.exe

Filesize
496KB

MD5
5c55825d204671d894dab7212e6b1288

SHA1
2d01b5597436465e40f3815d3a19aaee5246fc0a

SHA256
1b338265a1532c07d3f445afe0f4fc507116afe3740d7322e61dfd4cf3ec4e0a

SHA512
1fa4dccda60fbad260d9c82db2a5ef0d0862c140dd4acc9bfa4e7795c365e432b00d75024a60870a5703a79614fdddab2e62926b032ec1d050023a28043a3d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4696654.exe

Filesize
372KB

MD5
b35d6095193e86900770caa4186653dc

SHA1
dca2023dea0d4a8e0091c3561ed8cb3274f8ab65

SHA256
0fa3f28e5ba7bfb98c8b0c7147d9571ce5c5aa00ef502d0a08e0a91ab48b3a51

SHA512
b5eb68e98fe8bf434d3307ca3077cc7455bd6e5137cb16f3f4de23384674e04ee088a812f3307793c1c37f090336a66924ee34797ac2a096b91991cc9fa889ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c7982580.exe

Filesize
174KB

MD5
130e19cca78b821d410a4985c3b1d417

SHA1
6925476d93dd4db88e4272d632e1cfe2f76bccf6

SHA256
ebef9948acf9181dbd49c6be9b6d60b6b8fffc6b6f9e6a7a0440fd0a321884cd

SHA512
f62e7c7d9fb13ee673118e79688a26d1d0a2ebcac225937d57b23928cc40db51a04d565cfc891afde9ce893937c853fdda34b0b99437faf8a7d8b72a92682bf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8661683.exe

Filesize
217KB

MD5
7482fc5fb45083a0d70bcf9ce53e3340

SHA1
2d3c0807403848bc4d061ab2e5c176bc2d218f7b

SHA256
912eef92f243e311a628d62bfaaa98c0cbeec83fb2dd943590dc33e3a46deb85

SHA512
f2c5235f6935ccd30b2869990566a6c609dc7a8e8d60d610b38e9a84cf7e9360e1adfb1aba7edf53b14c49296687ee11b6658a95356a3462502fc45f0d2c69ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a8790443.exe

Filesize
12KB

MD5
3c8680d176e553231b3aa1456e551723

SHA1
3872cde2a32e6c9a28010e665dd0ea560bb2bbad

SHA256
55d55a8fe96acff4290721503a14379da8485f205280c848b92a43210af1d127

SHA512
48ad5a81909f46c059f3ad0348b051e4b5572575884d6303e8b27052c171f013e1597cd0fbe0d264c25b2dbe067fa83f25970762f6c0a7e3fd8dd6cbaa0c6aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b5770102.exe

Filesize
140KB

MD5
b64a87e4a3be21ce357ae931675212c4

SHA1
01f4209e3bd93a9dd0abc630d1ea37f6e67ee0fb

SHA256
4eb1f5a15815611fbd8318ae253bbcd384ffb233f9523082c0f76ca616b69165

SHA512
710f4b355dda97612def624808499b575272bc1c6e367a70b9dc485634a08f1a6145afcbba4962eb4db245f95c8e3a4e375a2c9782b3fbdd2efcf7f7b255adb5

Download Submit
memory/1468-28-0x00000000008F0000-0x00000000008FA000-memory.dmp

Filesize
40KB

Download
memory/1852-36-0x0000000000A00000-0x0000000000A30000-memory.dmp

Filesize
192KB

Download
memory/1852-37-0x00000000052E0000-0x00000000052E6000-memory.dmp

Filesize
24KB

Download
memory/1852-38-0x000000000AE30000-0x000000000B448000-memory.dmp

Filesize
6.1MB

Download
memory/1852-39-0x000000000A9B0000-0x000000000AABA000-memory.dmp

Filesize
1.0MB

Download
memory/1852-40-0x000000000A8F0000-0x000000000A902000-memory.dmp

Filesize
72KB

Download
memory/1852-41-0x000000000A950000-0x000000000A98C000-memory.dmp

Filesize
240KB

Download
memory/1852-42-0x0000000004C90000-0x0000000004CDC000-memory.dmp

Filesize
304KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads