healer | 00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7

General

Target

00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7.exe
Size

933KB
MD5

42ece5b93802f69e890e6ac85d7de746
SHA1

c5107b354b65e89105a75bf67bef22b9dc487bc0
SHA256

00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7
SHA512

5637bf4498c35e5c8b5c40458d7c2d3b0537c46a882b5e66e0afc1791822748a5e37cc458ab5d891bc415c746ed22e63c8b821e7d9d92e1c79bbcaf223c77350
SSDEEP

24576:PycQURopYKSICPIN2OLkdt7hPB+BLI7fmN:awOpnScJLkBPBkI

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral1/memory/1888-28-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Executes dropped EXE 4 IoCs

pid	Process
2624	v6849247.exe
820	v0327740.exe
4456	v9715151.exe
312	a6916503.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v0327740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9715151.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6849247.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 312 set thread context of 1888	312	a6916503.exe	74

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	312	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	AppLaunch.exe
1888	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	AppLaunch.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2624	3384	00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7.exe	70
PID 3384 wrote to memory of 2624	3384	00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7.exe	70
PID 3384 wrote to memory of 2624	3384	00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7.exe	70
PID 2624 wrote to memory of 820	2624	v6849247.exe	71
PID 2624 wrote to memory of 820	2624	v6849247.exe	71
PID 2624 wrote to memory of 820	2624	v6849247.exe	71
PID 820 wrote to memory of 4456	820	v0327740.exe	72
PID 820 wrote to memory of 4456	820	v0327740.exe	72
PID 820 wrote to memory of 4456	820	v0327740.exe	72
PID 4456 wrote to memory of 312	4456	v9715151.exe	73
PID 4456 wrote to memory of 312	4456	v9715151.exe	73
PID 4456 wrote to memory of 312	4456	v9715151.exe	73
PID 312 wrote to memory of 1888	312	a6916503.exe	74
PID 312 wrote to memory of 1888	312	a6916503.exe	74
PID 312 wrote to memory of 1888	312	a6916503.exe	74
PID 312 wrote to memory of 1888	312	a6916503.exe	74
PID 312 wrote to memory of 1888	312	a6916503.exe	74
PID 312 wrote to memory of 1888	312	a6916503.exe	74
PID 312 wrote to memory of 1888	312	a6916503.exe	74
PID 312 wrote to memory of 1888	312	a6916503.exe	74

C:\Users\Admin\AppData\Local\Temp\00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7.exe
"C:\Users\Admin\AppData\Local\Temp\00dc8c56d6eaf6b808c3e88e6180b7983ce63c8bed1da6aee6c686cc9af09cf7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6849247.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6849247.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0327740.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0327740.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9715151.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9715151.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6916503.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6916503.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:312
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 552
        6⤵
        Program crash
        
        PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6849247.exe

Filesize
832KB

MD5
fe6a308f0b7969da1cde65a5126c8d9b

SHA1
8254583706268361f2dd75f09c08cd0a62f955bf

SHA256
686d2244c7e3966aa78cf11034432e0c5e5afdd5c38c28aee9ba1fdc69ce4b0e

SHA512
375df1c09ece01738cc2cca022a44c1d5dfd3431ac58a5a92509bb8aa93c52655f8d5cdae4e2d65404db81327c63eca6e210db8403b5a72214d0f31083352f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6849247.exe

Filesize
832KB

MD5
fe6a308f0b7969da1cde65a5126c8d9b

SHA1
8254583706268361f2dd75f09c08cd0a62f955bf

SHA256
686d2244c7e3966aa78cf11034432e0c5e5afdd5c38c28aee9ba1fdc69ce4b0e

SHA512
375df1c09ece01738cc2cca022a44c1d5dfd3431ac58a5a92509bb8aa93c52655f8d5cdae4e2d65404db81327c63eca6e210db8403b5a72214d0f31083352f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0327740.exe

Filesize
604KB

MD5
9083c70358279247bd4f8b1acd9e4224

SHA1
cc0e89f50b441825030cab834ac3f6cac0578192

SHA256
a3f6cd7f4b2673349a0203e8cf2744e53eaba61116813bd5d083bbbcb5816db6

SHA512
b99a576a58b394d20251aec8ba044bdfa055dd02ae65bde2f6002e73525a80ae0e15cb48306526f38cb35a00b0e4a85c44a64a79f9577c0fb96288b064732aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0327740.exe

Filesize
604KB

MD5
9083c70358279247bd4f8b1acd9e4224

SHA1
cc0e89f50b441825030cab834ac3f6cac0578192

SHA256
a3f6cd7f4b2673349a0203e8cf2744e53eaba61116813bd5d083bbbcb5816db6

SHA512
b99a576a58b394d20251aec8ba044bdfa055dd02ae65bde2f6002e73525a80ae0e15cb48306526f38cb35a00b0e4a85c44a64a79f9577c0fb96288b064732aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9715151.exe

Filesize
344KB

MD5
90817fa55a93d960d64f6d92095cc9e2

SHA1
6136011e27bb093e13cd9e7759c59f0c4637b008

SHA256
ff10e5a8ccf44dcf5719df890e8f7ceaafd90588fb75665500171194d569cf7e

SHA512
e6e40541340580ad78b539cdd5bbc5fb69c851d4554740c4f7278cd7fb3f0262d2c2974f7a7dfc3ca3d271d8c6bfb1e4aaab3d6c372685206f22bcf4e0b46d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9715151.exe

Filesize
344KB

MD5
90817fa55a93d960d64f6d92095cc9e2

SHA1
6136011e27bb093e13cd9e7759c59f0c4637b008

SHA256
ff10e5a8ccf44dcf5719df890e8f7ceaafd90588fb75665500171194d569cf7e

SHA512
e6e40541340580ad78b539cdd5bbc5fb69c851d4554740c4f7278cd7fb3f0262d2c2974f7a7dfc3ca3d271d8c6bfb1e4aaab3d6c372685206f22bcf4e0b46d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6916503.exe

Filesize
220KB

MD5
d21aa90dbff046a7699db47c82bf1174

SHA1
2530d226d5619583342eb16d3a9e5a41c54dd390

SHA256
4bafbf182a231259f71c74a38d442830c73c953e5425438d33bc373948907e04

SHA512
22cb62fbe9832b9ec0e1d3e4acfd14ea74452bf7427025f63ca49359cbd217cba37b4c925610a0a13af691dffef298eb025b3eef0398a36d9f3742af9e753c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6916503.exe

Filesize
220KB

MD5
d21aa90dbff046a7699db47c82bf1174

SHA1
2530d226d5619583342eb16d3a9e5a41c54dd390

SHA256
4bafbf182a231259f71c74a38d442830c73c953e5425438d33bc373948907e04

SHA512
22cb62fbe9832b9ec0e1d3e4acfd14ea74452bf7427025f63ca49359cbd217cba37b4c925610a0a13af691dffef298eb025b3eef0398a36d9f3742af9e753c62

Download Submit
memory/1888-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1888-32-0x0000000072D90000-0x000000007347E000-memory.dmp

Filesize
6.9MB

Download
memory/1888-41-0x0000000072D90000-0x000000007347E000-memory.dmp

Filesize
6.9MB

Download
memory/1888-56-0x0000000072D90000-0x000000007347E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads