healer | 1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4

General

Target

1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4.exe
Size

707KB
MD5

6ca2831b683c39fb3f1462de6ebed375
SHA1

c2a443439727837d2e2468a96e31c70faa954903
SHA256

1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4
SHA512

290d64acd1d644782ed9fd484b471c68b6559c58fadbf83e1ddfda52b6236e9671f73e9b7d4cbe23ae78911ebb8e322fba4374c406babf77a07cda8438c4a78a
SSDEEP

12288:oMrSy90JuFGvab96Y/x8sYEvOgjK/LR3TapbenA1nCio:Ky/F3vKn3gERjaknA1CL

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral1/memory/4196-21-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Executes dropped EXE 3 IoCs

pid	Process
4224	v7768199.exe
3232	v8371262.exe
960	a8833494.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v7768199.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v8371262.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 4196	960	a8833494.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	960	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4196	AppLaunch.exe
4196	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	AppLaunch.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4224	4220	1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4.exe	69
PID 4220 wrote to memory of 4224	4220	1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4.exe	69
PID 4220 wrote to memory of 4224	4220	1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4.exe	69
PID 4224 wrote to memory of 3232	4224	v7768199.exe	70
PID 4224 wrote to memory of 3232	4224	v7768199.exe	70
PID 4224 wrote to memory of 3232	4224	v7768199.exe	70
PID 3232 wrote to memory of 960	3232	v8371262.exe	71
PID 3232 wrote to memory of 960	3232	v8371262.exe	71
PID 3232 wrote to memory of 960	3232	v8371262.exe	71
PID 960 wrote to memory of 4196	960	a8833494.exe	72
PID 960 wrote to memory of 4196	960	a8833494.exe	72
PID 960 wrote to memory of 4196	960	a8833494.exe	72
PID 960 wrote to memory of 4196	960	a8833494.exe	72
PID 960 wrote to memory of 4196	960	a8833494.exe	72
PID 960 wrote to memory of 4196	960	a8833494.exe	72
PID 960 wrote to memory of 4196	960	a8833494.exe	72
PID 960 wrote to memory of 4196	960	a8833494.exe	72

C:\Users\Admin\AppData\Local\Temp\1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4.exe
"C:\Users\Admin\AppData\Local\Temp\1b776869ca84f98f94b79cb5ee66939ba623791889bc0f91d0d41aeee7a9c9f4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7768199.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7768199.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8371262.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8371262.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8833494.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8833494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:960
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 552
        5⤵
        Program crash
        
        PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7768199.exe

Filesize
606KB

MD5
9501d54c966f6093b42288f760de11ce

SHA1
b088797e6f2c2336e86ffc3fb5ed06d0977bc344

SHA256
e58ed22b3bb19987c62b9a6a5acd2895c96f7104e43fa7ef3d272c0dda03d526

SHA512
bb77735ca935de3ea3f548b0150b5c75691b774837e91ff2f2195ad81c59df800bba7071c2f435ecbd31cb64cbeca5d64f9375d6517232fa091025b0e25703fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7768199.exe

Filesize
606KB

MD5
9501d54c966f6093b42288f760de11ce

SHA1
b088797e6f2c2336e86ffc3fb5ed06d0977bc344

SHA256
e58ed22b3bb19987c62b9a6a5acd2895c96f7104e43fa7ef3d272c0dda03d526

SHA512
bb77735ca935de3ea3f548b0150b5c75691b774837e91ff2f2195ad81c59df800bba7071c2f435ecbd31cb64cbeca5d64f9375d6517232fa091025b0e25703fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8371262.exe

Filesize
346KB

MD5
621f7e65e8f36836c6af1e68e56cc997

SHA1
983d07f30589fd1953225cdae231882682c0d855

SHA256
68c90fd06aa40ac3da4f53d6756392f44a2f9fa89fb763eadef8d950b6c1ee70

SHA512
481c61054f3dd5f1f002d51bde51b60b5ee9b025fc3bef920877cfea6d9c0b9970b28c884558d4b2c65fd1a22ee4e1cf2a25197823940683604fab098baf8a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8371262.exe

Filesize
346KB

MD5
621f7e65e8f36836c6af1e68e56cc997

SHA1
983d07f30589fd1953225cdae231882682c0d855

SHA256
68c90fd06aa40ac3da4f53d6756392f44a2f9fa89fb763eadef8d950b6c1ee70

SHA512
481c61054f3dd5f1f002d51bde51b60b5ee9b025fc3bef920877cfea6d9c0b9970b28c884558d4b2c65fd1a22ee4e1cf2a25197823940683604fab098baf8a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8833494.exe

Filesize
220KB

MD5
573ea30217beaf16641eeb0a8452cf5c

SHA1
5ece2281ea3de5570c7f7e230eebc2212495b983

SHA256
13c37c1cff9e6c1a7fc0b8bc613140461a008e0a12761aa03f69daad8058c727

SHA512
c711bd0548ea40d6d5a2a6759c499aeec1face001455c4557c91bba9bc8b94a211143527febdf77b092a2c6cbd72f650ea8c4db95b8bdc437835c561efdd7f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a8833494.exe

Filesize
220KB

MD5
573ea30217beaf16641eeb0a8452cf5c

SHA1
5ece2281ea3de5570c7f7e230eebc2212495b983

SHA256
13c37c1cff9e6c1a7fc0b8bc613140461a008e0a12761aa03f69daad8058c727

SHA512
c711bd0548ea40d6d5a2a6759c499aeec1face001455c4557c91bba9bc8b94a211143527febdf77b092a2c6cbd72f650ea8c4db95b8bdc437835c561efdd7f4c

Download Submit
memory/4196-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4196-25-0x00000000734A0000-0x0000000073B8E000-memory.dmp

Filesize
6.9MB

Download
memory/4196-34-0x00000000734A0000-0x0000000073B8E000-memory.dmp

Filesize
6.9MB

Download
memory/4196-49-0x00000000734A0000-0x0000000073B8E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads