healer | bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe
Size

373KB
MD5

54d2dcca449229bc210b853b0a52bdc5
SHA1

07b9e5e210c362612268757ea4b640a1120ede24
SHA256

bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387
SHA512

17b401edb54f5524630e9a5957b7b4141ed6638a9f1051be3d08e7b568e40a61f520280023ea2ef2aac2233858946ad47107fcc5e010800f13e16e48fa5faa8c
SSDEEP

6144:KJy+bnr+1p0yN90QEvuWi9trCxH4MTtIg/kDKb1CXnlH6ThA03uS1QUrT:7MrJy90INuYO5jAl+A031D

Score

10^/10

healer mystic redline rwan discovery dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rwan

77.91.124.73:19071

Attributes

auth_value
7c40eda5da4f888d6f61befbf947d9fe

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b9b-19.dat	mystic_family

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b9a-13.dat	healer
behavioral1/memory/2248-15-0x0000000000180000-0x000000000018A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a2661148.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a2661148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a2661148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a2661148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a2661148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a2661148.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Mystic family
mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b97-22.dat	family_redline
behavioral1/memory/4672-24-0x0000000000890000-0x00000000008C0000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
3676	v4917258.exe
2248	a2661148.exe
3712	b3848126.exe
4672	c5579974.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a2661148.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4917258.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v4917258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3848126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5579974.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	a2661148.exe
2248	a2661148.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	a2661148.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3676	4452	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe	85
PID 4452 wrote to memory of 3676	4452	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe	85
PID 4452 wrote to memory of 3676	4452	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe	85
PID 3676 wrote to memory of 2248	3676	v4917258.exe	86
PID 3676 wrote to memory of 2248	3676	v4917258.exe	86
PID 3676 wrote to memory of 3712	3676	v4917258.exe	94
PID 3676 wrote to memory of 3712	3676	v4917258.exe	94
PID 3676 wrote to memory of 3712	3676	v4917258.exe	94
PID 4452 wrote to memory of 4672	4452	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe	95
PID 4452 wrote to memory of 4672	4452	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe	95
PID 4452 wrote to memory of 4672	4452	bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe	95

C:\Users\Admin\AppData\Local\Temp\bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe
"C:\Users\Admin\AppData\Local\Temp\bc13fcc751c4f254fa91951804fe7dce4429b9a1e8bc51f4d102ff5b33bf2387.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4917258.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4917258.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2661148.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2661148.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3848126.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3848126.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3712
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5579974.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5579974.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5579974.exe

Filesize
174KB

MD5
659a82c498a17b151c9402ac467be7b8

SHA1
d4ccd301a7530046a3066b5f4a2fc6a24fa50fa7

SHA256
1cc4200ca39f891a36c3c98eda4aac27104e13431b040a0cad0cdf1b1660fc26

SHA512
eae26efa78b1612e7b1686cb927ad54a31342ebcafc6ccaffd2184c6a07a217df7e7b004fb8993ab7fd142770165ec0f2bbbbcc0e817b2e2eb84c7ead549bc64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4917258.exe

Filesize
216KB

MD5
833732216d23886a618f95677f2bc239

SHA1
3b360149cbe355483400d23f58aa8db5165d235a

SHA256
f610676df40977d3f777d5c1bbbac665f0d7810066bd6ba341c4e7655cc8c3bc

SHA512
dca025ea2278f60a1b2d9361f029965c0f91328b50875784aafb7ff0a20fbe71970502fd206052b03e1f11cae87ae91c5d3cb8dc3cea2e75e245515a244f2514

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2661148.exe

Filesize
12KB

MD5
af906d63692273262ae398e18361ce58

SHA1
cde7844d6a3f79e546dc34667e4b4486815ec0e6

SHA256
55fe927d001779f2c8fc74b953902586c384c0df07f102d6f00ecb15dc0e998d

SHA512
9b1fe61b231e98ea7f40f8b83c80460563f8d57c9577ecfd14f6bd1c7b8922108de284f8f4732bf9560e8c7bec429f9458ae79dfe77a2830d07cf401c21976b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3848126.exe

Filesize
140KB

MD5
a29845dcf0e02c8b1e3bb06fbde3cda2

SHA1
4ab2285f1ff8229f94bde577744664a3f63b88ee

SHA256
3b4230e32b3f96f7578f321b79e07932f373e4d73f94cfe4e21059a5ad00b39d

SHA512
d0d8bb33eba94f54c04d122ef7f2d523f2c7cbbc7902d15c479e34aedb3175f2015361417d6673b804a47166968d32264f15faba5790e11ea3d138c21b709871

Download Submit
memory/2248-15-0x0000000000180000-0x000000000018A000-memory.dmp

Filesize
40KB

Download
memory/2248-16-0x00007FFEEB2C3000-0x00007FFEEB2C5000-memory.dmp

Filesize
8KB

Download
memory/2248-14-0x00007FFEEB2C3000-0x00007FFEEB2C5000-memory.dmp

Filesize
8KB

Download
memory/4672-24-0x0000000000890000-0x00000000008C0000-memory.dmp

Filesize
192KB

Download
memory/4672-25-0x0000000002BB0000-0x0000000002BB6000-memory.dmp

Filesize
24KB

Download
memory/4672-26-0x000000000ADB0000-0x000000000B3C8000-memory.dmp

Filesize
6.1MB

Download
memory/4672-27-0x000000000A8A0000-0x000000000A9AA000-memory.dmp

Filesize
1.0MB

Download
memory/4672-28-0x000000000A790000-0x000000000A7A2000-memory.dmp

Filesize
72KB

Download
memory/4672-29-0x000000000A7F0000-0x000000000A82C000-memory.dmp

Filesize
240KB

Download
memory/4672-30-0x0000000002C00000-0x0000000002C4C000-memory.dmp

Filesize
304KB

Download