healer | 130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff

Analysis

max time kernel
125s
max time network
130s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
03/10/2023, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff.exe
Size 877KB
Sample231003-mbst8sbf73
SHA256 130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff
MD5 f6f9288bd8453907fac8d027d4416fe7
SHA1 f4e27190564cebbba03505e71ecfb96b12f925d8
SHA512 9d4492a04c7170852706b43b81cc88c1e0f3d38e91899cb12870bbf543edcb86d1a31896e47cc5ef055b144df1c957438b951dd22eb83515029b93937ea891b9
SSDEEP 12288:LMr0y90q0BId7pmR36IyeeudyqvPfaaZlCI4GL2/M8onN7Goyd6e2k2IgEVYubZI:3y9Y31cgLlCBGL2/5EG1se2YYubZI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001aff2-26.dat	healer
behavioral1/files/0x000700000001aff2-27.dat	healer
behavioral1/memory/1872-28-0x0000000000660000-0x000000000066A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Gg07Wt4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Gg07Wt4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Gg07Wt4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Gg07Wt4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Gg07Wt4.exe

Executes dropped EXE 5 IoCs

pid	Process
4992	iC9sb83.exe
3680	kQ1mu52.exe
2096	si3zv25.exe
1872	1Gg07Wt4.exe
3172	2Xv8143.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Gg07Wt4.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	si3zv25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	iC9sb83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kQ1mu52.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3172 set thread context of 3988	3172	2Xv8143.exe	78

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3832	3172	WerFault.exe	74
3348	3988	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1872	1Gg07Wt4.exe
1872	1Gg07Wt4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	1Gg07Wt4.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4992	3740	130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff.exe	70
PID 3740 wrote to memory of 4992	3740	130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff.exe	70
PID 3740 wrote to memory of 4992	3740	130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff.exe	70
PID 4992 wrote to memory of 3680	4992	iC9sb83.exe	71
PID 4992 wrote to memory of 3680	4992	iC9sb83.exe	71
PID 4992 wrote to memory of 3680	4992	iC9sb83.exe	71
PID 3680 wrote to memory of 2096	3680	kQ1mu52.exe	72
PID 3680 wrote to memory of 2096	3680	kQ1mu52.exe	72
PID 3680 wrote to memory of 2096	3680	kQ1mu52.exe	72
PID 2096 wrote to memory of 1872	2096	si3zv25.exe	73
PID 2096 wrote to memory of 1872	2096	si3zv25.exe	73
PID 2096 wrote to memory of 3172	2096	si3zv25.exe	74
PID 2096 wrote to memory of 3172	2096	si3zv25.exe	74
PID 2096 wrote to memory of 3172	2096	si3zv25.exe	74
PID 3172 wrote to memory of 3652	3172	2Xv8143.exe	76
PID 3172 wrote to memory of 3652	3172	2Xv8143.exe	76
PID 3172 wrote to memory of 3652	3172	2Xv8143.exe	76
PID 3172 wrote to memory of 2844	3172	2Xv8143.exe	77
PID 3172 wrote to memory of 2844	3172	2Xv8143.exe	77
PID 3172 wrote to memory of 2844	3172	2Xv8143.exe	77
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78
PID 3172 wrote to memory of 3988	3172	2Xv8143.exe	78

C:\Users\Admin\AppData\Local\Temp\130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff.exe
"C:\Users\Admin\AppData\Local\Temp\130e47b82560dca1740dd7aa4949540b9d7cd1f1cc6b4f3bfba9d109f75425ff.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iC9sb83.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iC9sb83.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kQ1mu52.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kQ1mu52.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\si3zv25.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\si3zv25.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gg07Wt4.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gg07Wt4.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xv8143.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xv8143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3652
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2844
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 592
        7⤵
        Program crash
        
        PID:3348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 152
        6⤵
        Program crash
        
        PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iC9sb83.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iC9sb83.exe
Size 737KB
SHA256 353d83d37ee04d38270f24d26c69d34304b6a19b9adc55b99dd9ba13de6bbb7e
MD5 1b2c50ceeb53dbf981f79d276bb214cf
SHA1 612c5195ab5dec39605583be8d05cf6eee7ecd43
SHA512 bf73b3b50876313ef964941abbdffc7dea7c85aa98a490c5152ceeb03819f21fa829976ca9f49e3f3b53580570462c557352a0b9374f14923337d233c1455a63
SSDEEP 12288:yMrby90C6IyteFDyqQPfM3VNCC4GS2AM8onSnBdyd6eJXhIgHFYQ:hy/dOTiNC3GS2A5PBQseJ3YQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

iC9sb83.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iC9sb83.exe
Size 737KB
SHA256 353d83d37ee04d38270f24d26c69d34304b6a19b9adc55b99dd9ba13de6bbb7e
MD5 1b2c50ceeb53dbf981f79d276bb214cf
SHA1 612c5195ab5dec39605583be8d05cf6eee7ecd43
SHA512 bf73b3b50876313ef964941abbdffc7dea7c85aa98a490c5152ceeb03819f21fa829976ca9f49e3f3b53580570462c557352a0b9374f14923337d233c1455a63
SSDEEP 12288:yMrby90C6IyteFDyqQPfM3VNCC4GS2AM8onSnBdyd6eJXhIgHFYQ:hy/dOTiNC3GS2A5PBQseJ3YQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

kQ1mu52.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kQ1mu52.exe
Size 490KB
SHA256 5b4e336874e6728d713b60579083ecb0512284a435a55c4056a8f642706f555e
MD5 c760be30c9df2c6a0efd20661419b5fe
SHA1 0d4b90e3ec4d0a87c0551257637f66fcdb9c771a
SHA512 305e84caf097c017c24c5841966e5ce6c3e5eb7826fb3fc768638fc51c62459741b8906420e18a568398a3cbcdfac83723909e8ad134a4d2a74d026acca6fe68
SSDEEP 12288:JMrvy908OMXENCunGpxAX8onhnuWyw6el:myONCUGpxAs8u7Vel
MD5 SHA1 SHA512 SSDEEP

Submit Download

kQ1mu52.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kQ1mu52.exe
Size 490KB
SHA256 5b4e336874e6728d713b60579083ecb0512284a435a55c4056a8f642706f555e
MD5 c760be30c9df2c6a0efd20661419b5fe
SHA1 0d4b90e3ec4d0a87c0551257637f66fcdb9c771a
SHA512 305e84caf097c017c24c5841966e5ce6c3e5eb7826fb3fc768638fc51c62459741b8906420e18a568398a3cbcdfac83723909e8ad134a4d2a74d026acca6fe68
SSDEEP 12288:JMrvy908OMXENCunGpxAX8onhnuWyw6el:myONCUGpxAs8u7Vel
MD5 SHA1 SHA512 SSDEEP

Submit Download

si3zv25.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\si3zv25.exe
Size 293KB
SHA256 834307b868bbf947575351ebe9a1029b95d864134f85790739a38c9bc86806bd
MD5 2786fb5ab586c53d888d0eedbe34f012
SHA1 1a42a35fa6cb1840032baa6948cdfd2f53165594
SHA512 b5698635ca712d9b8bcc2de5319fe9da332dc0a8a9db1b72edd4a19f9686eebdcfaf62062ecf4989702fc2ce8e36cbb0883242ed8bfc96c86312964349f8f8ed
SSDEEP 6144:KKy+bnr+Jp0yN90QEBDmI3izwjokyaNHg5mdX8xYbnoUtc3:OMrFy90SUswj97HcAX80nTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

si3zv25.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\si3zv25.exe
Size 293KB
SHA256 834307b868bbf947575351ebe9a1029b95d864134f85790739a38c9bc86806bd
MD5 2786fb5ab586c53d888d0eedbe34f012
SHA1 1a42a35fa6cb1840032baa6948cdfd2f53165594
SHA512 b5698635ca712d9b8bcc2de5319fe9da332dc0a8a9db1b72edd4a19f9686eebdcfaf62062ecf4989702fc2ce8e36cbb0883242ed8bfc96c86312964349f8f8ed
SSDEEP 6144:KKy+bnr+Jp0yN90QEBDmI3izwjokyaNHg5mdX8xYbnoUtc3:OMrFy90SUswj97HcAX80nTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Gg07Wt4.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gg07Wt4.exe
Size 12KB
SHA256 a9ce2e2ef24fc09c6a2c47110408aae46f3b1976acca50c6e383f5961847f137
MD5 55198ea36c0e8dff11b4798582711f0c
SHA1 f85d9737836e6a965f0dfa1efce530655e5cd5b6
SHA512 72351c37ccbc222b7876c5f797c6efe805232406058a6cd40b14bf97c6fb6fe0e541fc56f4aa2679c83a59f5a565a69810be91e6a5b75dbfc3c488aed9128a3e
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Gg07Wt4.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Gg07Wt4.exe
Size 12KB
SHA256 a9ce2e2ef24fc09c6a2c47110408aae46f3b1976acca50c6e383f5961847f137
MD5 55198ea36c0e8dff11b4798582711f0c
SHA1 f85d9737836e6a965f0dfa1efce530655e5cd5b6
SHA512 72351c37ccbc222b7876c5f797c6efe805232406058a6cd40b14bf97c6fb6fe0e541fc56f4aa2679c83a59f5a565a69810be91e6a5b75dbfc3c488aed9128a3e
SSDEEP 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

2Xv8143.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xv8143.exe
Size 285KB
SHA256 6ad8d018004af70ac3fb8807ed8bafc6161c7e35e9950ed208c7fd81853f8cc8
MD5 979f9947b0c46341098288ee3af621c7
SHA1 5a2c7869422d96b688513ec5111887dd1e181fa5
SHA512 beb88bbe8d9937ff0f6428f391898179063d9a6808b72287fd70e0801ac3badcb2a2fec715f5f4e524bfcf0748d1ef970e5f7cacc623964845f846c56cb43ae3
SSDEEP 6144:rU+Elo4WGFw16HcqgGm04SafaazC0I/geox:rU+ElodKHcqgf0ES1wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

2Xv8143.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xv8143.exe
Size 285KB
SHA256 6ad8d018004af70ac3fb8807ed8bafc6161c7e35e9950ed208c7fd81853f8cc8
MD5 979f9947b0c46341098288ee3af621c7
SHA1 5a2c7869422d96b688513ec5111887dd1e181fa5
SHA512 beb88bbe8d9937ff0f6428f391898179063d9a6808b72287fd70e0801ac3badcb2a2fec715f5f4e524bfcf0748d1ef970e5f7cacc623964845f846c56cb43ae3
SSDEEP 6144:rU+Elo4WGFw16HcqgGm04SafaazC0I/geox:rU+ElodKHcqgf0ES1wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1872-31-0x00007FFF93F50000-0x00007FFF9493C000-memory.dmp

Download

memory/1872-29-0x00007FFF93F50000-0x00007FFF9493C000-memory.dmp

Download

memory/1872-28-0x0000000000660000-0x000000000066A000-memory.dmp

Download

memory/3988-35-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3988-38-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3988-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3988-41-0x0000000000400000-0x0000000000428000-memory.dmp

Download