healer | 55fea65117efeb4fabcf7caf4ff6c2277ba0cf0d8fac8468d1cc3e4e317bfec2

Analysis

max time kernel
127s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd7b6ff355488e6ccaf36c43e9ab1dea.exe
Size 93KB
Sample230706-2ese7see59
SHA256 55fea65117efeb4fabcf7caf4ff6c2277ba0cf0d8fac8468d1cc3e4e317bfec2
MD5 bd7b6ff355488e6ccaf36c43e9ab1dea
SHA1 146f3b203316be225ba9921da419308c2a8a25d6
SHA512 4e98c2ded283b5830b6086c2fd32038fb687ea68bb81e94515969b65190477b38b4a3f593bd89d68ed612f8dcde0d49f96bef408513ad889e7b7881dad46ec61
SSDEEP 1536:+vPI/CI7W3vWOZsn/tkYN21pYu5GpydopBaX7qQwH7Pxs:uIaIyBs/Vmmu5Gpy6BaXejxs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer dropper evasion trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/1724-133-0x0000000000030000-0x000000000003A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bd7b6ff355488e6ccaf36c43e9ab1dea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bd7b6ff355488e6ccaf36c43e9ab1dea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bd7b6ff355488e6ccaf36c43e9ab1dea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bd7b6ff355488e6ccaf36c43e9ab1dea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bd7b6ff355488e6ccaf36c43e9ab1dea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	bd7b6ff355488e6ccaf36c43e9ab1dea.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	bd7b6ff355488e6ccaf36c43e9ab1dea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	bd7b6ff355488e6ccaf36c43e9ab1dea.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	bd7b6ff355488e6ccaf36c43e9ab1dea.exe
1724	bd7b6ff355488e6ccaf36c43e9ab1dea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	bd7b6ff355488e6ccaf36c43e9ab1dea.exe

C:\Users\Admin\AppData\Local\Temp\bd7b6ff355488e6ccaf36c43e9ab1dea.exe
"C:\Users\Admin\AppData\Local\Temp\bd7b6ff355488e6ccaf36c43e9ab1dea.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-133-0x0000000000030000-0x000000000003A000-memory.dmp

Download