healer | ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055

Analysis

max time kernel
127s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
30/09/2023, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055.exe
Size

994KB
MD5

38811cf5e537c92383faf8486ed93d63
SHA1

6218467d1bae0d3f14aba056b079af8aad6498bf
SHA256

ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055
SHA512

44b01b6d16d4621a9628538901596e7b620a50e4d86959feb974fc4437548c20dcee17a2d2229b15f78897c84a62293559e70e6cdb9d40d86a9bdc233900fe78
SSDEEP

24576:9ySH5Ylea068blc51PeqSMYLuRe4J3PHqORDBV:YciM5va51WaYiR3J/KqD

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001afce-33.dat	healer
behavioral1/files/0x000700000001afce-34.dat	healer
behavioral1/memory/4848-35-0x0000000000070000-0x000000000007A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q2657184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q2657184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q2657184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q2657184.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q2657184.exe

Executes dropped EXE 6 IoCs

pid	Process
4360	z7198415.exe
1680	z2220128.exe
2540	z0437025.exe
3104	z5368527.exe
4848	q2657184.exe
3408	r4130790.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q2657184.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z5368527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7198415.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2220128.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0437025.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 3264	3408	r4130790.exe	78

Program crash 2 IoCs

pid	pid_target	Process	procid_target
656	3408	WerFault.exe	75
3000	3264	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	q2657184.exe
4848	q2657184.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	q2657184.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 4360	3780	ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055.exe	70
PID 3780 wrote to memory of 4360	3780	ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055.exe	70
PID 3780 wrote to memory of 4360	3780	ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055.exe	70
PID 4360 wrote to memory of 1680	4360	z7198415.exe	71
PID 4360 wrote to memory of 1680	4360	z7198415.exe	71
PID 4360 wrote to memory of 1680	4360	z7198415.exe	71
PID 1680 wrote to memory of 2540	1680	z2220128.exe	72
PID 1680 wrote to memory of 2540	1680	z2220128.exe	72
PID 1680 wrote to memory of 2540	1680	z2220128.exe	72
PID 2540 wrote to memory of 3104	2540	z0437025.exe	73
PID 2540 wrote to memory of 3104	2540	z0437025.exe	73
PID 2540 wrote to memory of 3104	2540	z0437025.exe	73
PID 3104 wrote to memory of 4848	3104	z5368527.exe	74
PID 3104 wrote to memory of 4848	3104	z5368527.exe	74
PID 3104 wrote to memory of 3408	3104	z5368527.exe	75
PID 3104 wrote to memory of 3408	3104	z5368527.exe	75
PID 3104 wrote to memory of 3408	3104	z5368527.exe	75
PID 3408 wrote to memory of 2996	3408	r4130790.exe	77
PID 3408 wrote to memory of 2996	3408	r4130790.exe	77
PID 3408 wrote to memory of 2996	3408	r4130790.exe	77
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78
PID 3408 wrote to memory of 3264	3408	r4130790.exe	78

C:\Users\Admin\AppData\Local\Temp\ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055.exe
"C:\Users\Admin\AppData\Local\Temp\ec18155938e24b931dda95ec709003fac79ce3df837f09d07569f12bc5d00055.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7198415.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7198415.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220128.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220128.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0437025.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0437025.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5368527.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5368527.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2657184.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2657184.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4130790.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4130790.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2996
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 568
        8⤵
        Program crash
        
        PID:3000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 568
        7⤵
        Program crash
        
        PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7198415.exe

Filesize
892KB

MD5
b508d307ca046859a23700476b6af230

SHA1
41fc687ffa3d6f4446b5eed69808f3eb7d067960

SHA256
cf7a236c52da7e586de2e1e0a1843dc5db847f68c50a470f31ac45d5c0d7325b

SHA512
6b8b22bb125df21b98b649a1f5a7ed289a78f9c08e60f776bf96a53b365565cdeb4fb913ec11e567243172867f6922d9ec8d5401fccd6939edb71df8ba0c6229

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7198415.exe

Filesize
892KB

MD5
b508d307ca046859a23700476b6af230

SHA1
41fc687ffa3d6f4446b5eed69808f3eb7d067960

SHA256
cf7a236c52da7e586de2e1e0a1843dc5db847f68c50a470f31ac45d5c0d7325b

SHA512
6b8b22bb125df21b98b649a1f5a7ed289a78f9c08e60f776bf96a53b365565cdeb4fb913ec11e567243172867f6922d9ec8d5401fccd6939edb71df8ba0c6229

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220128.exe

Filesize
709KB

MD5
70c0ff5a6d4d23500b6667b1256170ba

SHA1
d587ad13e1c4a9355f91ed137728be40b592f79a

SHA256
8d4ef8a176ea8058e56396f2606a1d1e5de42dc613a04d3b8ef117167aa142e8

SHA512
a06339016b5abd4db75010b569a6e9db6d80985255eceb7fdc5c0e4cd3bba50db61384d5aaa66926665a38253dd322d4193e0ae73c069160ca5aaea7e7690284

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220128.exe

Filesize
709KB

MD5
70c0ff5a6d4d23500b6667b1256170ba

SHA1
d587ad13e1c4a9355f91ed137728be40b592f79a

SHA256
8d4ef8a176ea8058e56396f2606a1d1e5de42dc613a04d3b8ef117167aa142e8

SHA512
a06339016b5abd4db75010b569a6e9db6d80985255eceb7fdc5c0e4cd3bba50db61384d5aaa66926665a38253dd322d4193e0ae73c069160ca5aaea7e7690284

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0437025.exe

Filesize
527KB

MD5
d8a7795906f3588eeb7c0781326d7908

SHA1
f66c9ce2a565db818df17e1df17b4894b3dbc649

SHA256
1caeaef57464fb8a4884cbb6b1502605a89ff7b34991134604ce4dd9e521ca30

SHA512
81fb972968d7acc0dc65efd4e995c83bc1c58d8f589bf82c033a7dd52308cd83f8bb32830d16679fae3b909d1c362d8723e0a7731c5eed7b244c213c36be925d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0437025.exe

Filesize
527KB

MD5
d8a7795906f3588eeb7c0781326d7908

SHA1
f66c9ce2a565db818df17e1df17b4894b3dbc649

SHA256
1caeaef57464fb8a4884cbb6b1502605a89ff7b34991134604ce4dd9e521ca30

SHA512
81fb972968d7acc0dc65efd4e995c83bc1c58d8f589bf82c033a7dd52308cd83f8bb32830d16679fae3b909d1c362d8723e0a7731c5eed7b244c213c36be925d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5368527.exe

Filesize
296KB

MD5
44a3fb0b6d5e4bc57af821eca04f4156

SHA1
8061bbd8297de470acf37d1a84a1c5e8830edb63

SHA256
874df4688aead755a29c45109550c51edeb71eadd8844f06df2fe76134cfc797

SHA512
afe5c3ee2e39c2898c06f8a24843915c176a948e1eaabe167b6893ac3052e457b5d86fa5bdc7c4abedc674ef418872b110cdbebcab34850fc60e17bdf63865df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5368527.exe

Filesize
296KB

MD5
44a3fb0b6d5e4bc57af821eca04f4156

SHA1
8061bbd8297de470acf37d1a84a1c5e8830edb63

SHA256
874df4688aead755a29c45109550c51edeb71eadd8844f06df2fe76134cfc797

SHA512
afe5c3ee2e39c2898c06f8a24843915c176a948e1eaabe167b6893ac3052e457b5d86fa5bdc7c4abedc674ef418872b110cdbebcab34850fc60e17bdf63865df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2657184.exe

Filesize
11KB

MD5
34333e4911241cc8f21112c4df118ca4

SHA1
7ae4b34b6e1d23e3bb9fbe541b702659d1f67cf6

SHA256
1fa7f44dd06c26a236d3dcd4bd49ed9636c49f4ab7f66236fb6cea16e3e8d0d5

SHA512
8dd8ac04dd25296e99401ba1a55073711dcc2a59d3a88241cba7521d1ec736ece79ce62b6fee8ba0a365c7061504a689a21dad80bc268099389b3ecd86afc72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2657184.exe

Filesize
11KB

MD5
34333e4911241cc8f21112c4df118ca4

SHA1
7ae4b34b6e1d23e3bb9fbe541b702659d1f67cf6

SHA256
1fa7f44dd06c26a236d3dcd4bd49ed9636c49f4ab7f66236fb6cea16e3e8d0d5

SHA512
8dd8ac04dd25296e99401ba1a55073711dcc2a59d3a88241cba7521d1ec736ece79ce62b6fee8ba0a365c7061504a689a21dad80bc268099389b3ecd86afc72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4130790.exe

Filesize
276KB

MD5
357b1466c8c7a8fa815625bfb60c3145

SHA1
013da9a2061be247b545b60d8926fb8c471fadfd

SHA256
eba1fa3d1f1cf952e9f713ea95deed0e90c6a27ef90479222caf1006dbf5ab22

SHA512
3b20cc47fcb1ba6eb8aba6c27dcae52d6da9e8d709400a25a678421ddb5976e5a53fe9a7391c8f012e148f4a2dbd4178ed4fc9b931e228631b9a2832be80ef64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4130790.exe

Filesize
276KB

MD5
357b1466c8c7a8fa815625bfb60c3145

SHA1
013da9a2061be247b545b60d8926fb8c471fadfd

SHA256
eba1fa3d1f1cf952e9f713ea95deed0e90c6a27ef90479222caf1006dbf5ab22

SHA512
3b20cc47fcb1ba6eb8aba6c27dcae52d6da9e8d709400a25a678421ddb5976e5a53fe9a7391c8f012e148f4a2dbd4178ed4fc9b931e228631b9a2832be80ef64

Download Submit
memory/3264-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3264-46-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3264-45-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3264-48-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4848-35-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download
memory/4848-36-0x00007FFBDD1A0000-0x00007FFBDDB8C000-memory.dmp

Filesize
9.9MB

Download
memory/4848-38-0x00007FFBDD1A0000-0x00007FFBDDB8C000-memory.dmp

Filesize
9.9MB

Download