healer | 51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9

Analysis

max time kernel
128s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
03/10/2023, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9.exe
Size 876KB
Sample231003-d8ty5agb2x
SHA256 51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9
MD5 27d012565a7414044cda7bf9e9dc0b41
SHA1 76d6be1182b641f7c5bec6ae0d61e6b8be6e66e2
SHA512 02024f885f7b9c9a909e72f5120c3052213068901127c499f97ecd60c76042045058b58176a6458b7a2b327196e19691b039b933b299e30fe64e9f97face4515
SSDEEP 12288:fMrQy90TRKP5mAeE8P0+D+hfuQl8pQdpnQC7pInt+UV8Dz5zsTsx4XIczpHCjg:PyoRKP5538c+ULsQdy0Jz5gNYccE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001af66-26.dat	healer
behavioral1/files/0x000700000001af66-27.dat	healer
behavioral1/memory/2468-28-0x0000000000450000-0x000000000045A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1HB90uU3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1HB90uU3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1HB90uU3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1HB90uU3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1HB90uU3.exe

Executes dropped EXE 5 IoCs

pid	Process
4140	gt3RT47.exe
4660	Lt3vK55.exe
4436	cZ7BF91.exe
2468	1HB90uU3.exe
2272	2Vu8870.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1HB90uU3.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	gt3RT47.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Lt3vK55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	cZ7BF91.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 356	2272	2Vu8870.exe	75

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2088	2272	WerFault.exe	73
1900	356	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	1HB90uU3.exe
2468	1HB90uU3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	1HB90uU3.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4140	1344	51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9.exe	69
PID 1344 wrote to memory of 4140	1344	51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9.exe	69
PID 1344 wrote to memory of 4140	1344	51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9.exe	69
PID 4140 wrote to memory of 4660	4140	gt3RT47.exe	70
PID 4140 wrote to memory of 4660	4140	gt3RT47.exe	70
PID 4140 wrote to memory of 4660	4140	gt3RT47.exe	70
PID 4660 wrote to memory of 4436	4660	Lt3vK55.exe	71
PID 4660 wrote to memory of 4436	4660	Lt3vK55.exe	71
PID 4660 wrote to memory of 4436	4660	Lt3vK55.exe	71
PID 4436 wrote to memory of 2468	4436	cZ7BF91.exe	72
PID 4436 wrote to memory of 2468	4436	cZ7BF91.exe	72
PID 4436 wrote to memory of 2272	4436	cZ7BF91.exe	73
PID 4436 wrote to memory of 2272	4436	cZ7BF91.exe	73
PID 4436 wrote to memory of 2272	4436	cZ7BF91.exe	73
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75
PID 2272 wrote to memory of 356	2272	2Vu8870.exe	75

C:\Users\Admin\AppData\Local\Temp\51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9.exe
"C:\Users\Admin\AppData\Local\Temp\51d09f6a439e061c80d5f3f04129f77189683c24fbaa13dd556659db007c8bd9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gt3RT47.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gt3RT47.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lt3vK55.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lt3vK55.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cZ7BF91.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cZ7BF91.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1HB90uU3.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1HB90uU3.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Vu8870.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Vu8870.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 568
        7⤵
        Program crash
        
        PID:1900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 144
        6⤵
        Program crash
        
        PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gt3RT47.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gt3RT47.exe
Size 737KB
SHA256 9dbc7af08660cd50835f8c5444f61fa48442c970823571773290212147149db8
MD5 6ede21201a6763725d83c8915536a36d
SHA1 e1e4ada5a3a8d65ed16263d765ed1147736c02b9
SHA512 8f31118528681abb08bd8fd55d31c3c59695b28d2d08db56e093cc5ac085cb5801c127b00342329dfb0726e1f1c9d58b72b086b34c4e1c710e669f8b40a92cd3
SSDEEP 12288:kMr+y90Ete68zDQh+hvuQYJQdTnCC7pIQk+xVGDz5zsTkxByLYQpG:Kyjf8XQmmJQdpdkz5g0SY/
MD5 SHA1 SHA512 SSDEEP

Submit Download

gt3RT47.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gt3RT47.exe
Size 737KB
SHA256 9dbc7af08660cd50835f8c5444f61fa48442c970823571773290212147149db8
MD5 6ede21201a6763725d83c8915536a36d
SHA1 e1e4ada5a3a8d65ed16263d765ed1147736c02b9
SHA512 8f31118528681abb08bd8fd55d31c3c59695b28d2d08db56e093cc5ac085cb5801c127b00342329dfb0726e1f1c9d58b72b086b34c4e1c710e669f8b40a92cd3
SSDEEP 12288:kMr+y90Ete68zDQh+hvuQYJQdTnCC7pIQk+xVGDz5zsTkxByLYQpG:Kyjf8XQmmJQdpdkz5g0SY/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lt3vK55.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lt3vK55.exe
Size 490KB
SHA256 409333da6dd8df41ac401cbc0be8333832ef606a6f90017838d4d075705d77ed
MD5 524c5fd9f5f5c5c99278352bb0cca900
SHA1 d1273110b214cfdedb372d12589f0bfb827e0953
SHA512 f38e3375c86b9cd38265648a23d5abbba2b13191180082afa224c7c7d3993a0a00d07f92ac50b8843ac667cbb17f139770ff788405c4d9d8341d9e9e2ac06971
SSDEEP 12288:HMrvy908xAVHh+hDuB2dQdenzK7pI34B5:IyvxWHmJdQdMS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lt3vK55.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lt3vK55.exe
Size 490KB
SHA256 409333da6dd8df41ac401cbc0be8333832ef606a6f90017838d4d075705d77ed
MD5 524c5fd9f5f5c5c99278352bb0cca900
SHA1 d1273110b214cfdedb372d12589f0bfb827e0953
SHA512 f38e3375c86b9cd38265648a23d5abbba2b13191180082afa224c7c7d3993a0a00d07f92ac50b8843ac667cbb17f139770ff788405c4d9d8341d9e9e2ac06971
SSDEEP 12288:HMrvy908xAVHh+hDuB2dQdenzK7pI34B5:IyvxWHmJdQdMS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cZ7BF91.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cZ7BF91.exe
Size 293KB
SHA256 bd103f252df9e20f02e86870944e14cd9d34746aec8457b9792ca37ff5301bd5
MD5 a3bb4944fa2c87aacf63e62ad914b1f9
SHA1 3e15ae3e4180b04d359f02427c55212658be1ee0
SHA512 fc15ca9f95542ee8a8c7b68cd0ad7116ba596457964d977728e35c7ed75f6ace7bb5f8004147242c7ce90c7ec0a22a7ca0e588f7d2ad9308e338f7c43f6b9acc
SSDEEP 6144:KNy+bnr+Vp0yN90QEMRrqntSUX2MLnpHn4+Vudj75d4ae:LMrly90+CsU7LnpHfQd5Te
MD5 SHA1 SHA512 SSDEEP

Submit Download

cZ7BF91.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cZ7BF91.exe
Size 293KB
SHA256 bd103f252df9e20f02e86870944e14cd9d34746aec8457b9792ca37ff5301bd5
MD5 a3bb4944fa2c87aacf63e62ad914b1f9
SHA1 3e15ae3e4180b04d359f02427c55212658be1ee0
SHA512 fc15ca9f95542ee8a8c7b68cd0ad7116ba596457964d977728e35c7ed75f6ace7bb5f8004147242c7ce90c7ec0a22a7ca0e588f7d2ad9308e338f7c43f6b9acc
SSDEEP 6144:KNy+bnr+Vp0yN90QEMRrqntSUX2MLnpHn4+Vudj75d4ae:LMrly90+CsU7LnpHfQd5Te
MD5 SHA1 SHA512 SSDEEP

Submit Download

1HB90uU3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1HB90uU3.exe
Size 12KB
SHA256 6b166c8da1cec29cdcd0033736ad315411e1c08b5369c8119f38f7348a654489
MD5 d409e4094d97cd6acbaefd973da1719a
SHA1 4c1f80b4a5c8443c64ac5930e742bca5a872a38b
SHA512 0dc7571bb0ca191a07250b5d24293548db4a7747196f83b03d83ae57359417229e285041ae7c4e887f40d3b7df0e50cfcd5ad14260fb27f06ec32646548b43ca
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

1HB90uU3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1HB90uU3.exe
Size 12KB
SHA256 6b166c8da1cec29cdcd0033736ad315411e1c08b5369c8119f38f7348a654489
MD5 d409e4094d97cd6acbaefd973da1719a
SHA1 4c1f80b4a5c8443c64ac5930e742bca5a872a38b
SHA512 0dc7571bb0ca191a07250b5d24293548db4a7747196f83b03d83ae57359417229e285041ae7c4e887f40d3b7df0e50cfcd5ad14260fb27f06ec32646548b43ca
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

2Vu8870.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Vu8870.exe
Size 285KB
SHA256 e87b85cd5b354a6b0cc6511a36c5c878720f0ec6167cd36326b920c37bd05b91
MD5 640b61d906f54f5b2e17570a3930a635
SHA1 4f68f4b04d887c0dfb88400ada2c16d0615686a4
SHA512 ac8e7a9dd9d1dc04623cf553fa85a774388089d09f0195cbfe10792372ff7d2013d97559c53b5028d7a77ef7c28f53be92e9daaad7efa375072a47bd91bed3f0
SSDEEP 6144:rU+Elo4WGFw16HcznZ6LGOsPaIDE7Rox:rU+ElodKHcznZ6LGLirSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

2Vu8870.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Vu8870.exe
Size 285KB
SHA256 e87b85cd5b354a6b0cc6511a36c5c878720f0ec6167cd36326b920c37bd05b91
MD5 640b61d906f54f5b2e17570a3930a635
SHA1 4f68f4b04d887c0dfb88400ada2c16d0615686a4
SHA512 ac8e7a9dd9d1dc04623cf553fa85a774388089d09f0195cbfe10792372ff7d2013d97559c53b5028d7a77ef7c28f53be92e9daaad7efa375072a47bd91bed3f0
SSDEEP 6144:rU+Elo4WGFw16HcznZ6LGOsPaIDE7Rox:rU+ElodKHcznZ6LGLirSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/356-35-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/356-38-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/356-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/356-41-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2468-31-0x00007FFAF6FA0000-0x00007FFAF798C000-memory.dmp

Download

memory/2468-29-0x00007FFAF6FA0000-0x00007FFAF798C000-memory.dmp

Download

memory/2468-28-0x0000000000450000-0x000000000045A000-memory.dmp

Download