healer | 7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02

Analysis

max time kernel
72s
max time network
78s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
03/10/2023, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02.exe
Size 1.4MB
Sample231003-ptvsnace86
SHA256 7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02
MD5 18bc3ba45ec11889768792c968fc45e3
SHA1 00b2d1c2095808ce268d63e28786d1bdfb9302de
SHA512 2f2e3c5b66c4955c1b98dc8abef3b8607ce3b523a034f060a69ba398396dbde92f337ccb1fd67d2194f2b916f76a3b8e4741d6c227ac31d61ff96d4912bd4011
SSDEEP 24576:TyUSQVGAla68kvUaXGcMnnmhQyAI0qgmOAU8fA0bFMibNjv57O:mUVl7iTcMnnmh7lzgmub0bBNLp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001afb4-33.dat	healer
behavioral1/files/0x000700000001afb4-34.dat	healer
behavioral1/memory/4424-35-0x0000000000460000-0x000000000046A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q7183733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q7183733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q7183733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q7183733.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q7183733.exe

Executes dropped EXE 6 IoCs

pid	Process
4596	z2243415.exe
4436	z5463278.exe
220	z8150193.exe
4804	z7334069.exe
4424	q7183733.exe
4440	r0124453.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q7183733.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z5463278.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z8150193.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z7334069.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2243415.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4440 set thread context of 3492	4440	r0124453.exe	78

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4504	4440	WerFault.exe	75
756	3492	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4424	q7183733.exe
4424	q7183733.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	q7183733.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4596	2600	7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02.exe	70
PID 2600 wrote to memory of 4596	2600	7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02.exe	70
PID 2600 wrote to memory of 4596	2600	7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02.exe	70
PID 4596 wrote to memory of 4436	4596	z2243415.exe	71
PID 4596 wrote to memory of 4436	4596	z2243415.exe	71
PID 4596 wrote to memory of 4436	4596	z2243415.exe	71
PID 4436 wrote to memory of 220	4436	z5463278.exe	72
PID 4436 wrote to memory of 220	4436	z5463278.exe	72
PID 4436 wrote to memory of 220	4436	z5463278.exe	72
PID 220 wrote to memory of 4804	220	z8150193.exe	73
PID 220 wrote to memory of 4804	220	z8150193.exe	73
PID 220 wrote to memory of 4804	220	z8150193.exe	73
PID 4804 wrote to memory of 4424	4804	z7334069.exe	74
PID 4804 wrote to memory of 4424	4804	z7334069.exe	74
PID 4804 wrote to memory of 4440	4804	z7334069.exe	75
PID 4804 wrote to memory of 4440	4804	z7334069.exe	75
PID 4804 wrote to memory of 4440	4804	z7334069.exe	75
PID 4440 wrote to memory of 3720	4440	r0124453.exe	77
PID 4440 wrote to memory of 3720	4440	r0124453.exe	77
PID 4440 wrote to memory of 3720	4440	r0124453.exe	77
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78
PID 4440 wrote to memory of 3492	4440	r0124453.exe	78

C:\Users\Admin\AppData\Local\Temp\7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02.exe
"C:\Users\Admin\AppData\Local\Temp\7d3967cf6f8f9f8012e668d341ebba1f2d820ecc6c1c81daca2e80ef6721bf02.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2243415.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2243415.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5463278.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5463278.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8150193.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8150193.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7334069.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7334069.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7183733.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7183733.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0124453.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0124453.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3720
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 196
        8⤵
        Program crash
        
        PID:756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 576
        7⤵
        Program crash
        
        PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

z2243415.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2243415.exe
Size 1.3MB
SHA256 31e5777373b31b8cbfd48fff46be8008edfba78b7e16eb9c99687139fb8a10ba
MD5 735daa38a0547aeb0144d0e980ff4a1c
SHA1 a7e23edd8ccefd7287bb407661c192eb4b320ba5
SHA512 aa8600455c767024fb982d9d2f4bfe0306c4f33b8c45d561ab52bdfaeab648efaf50ba02ad1a8d420c688189e000328f9b04084d0b3e6dff6ca64f51abb4d258
SSDEEP 24576:FyjrVR7olsG4kvPVXGaanr2hQuYXakgtoHAM8jAQbm2i3vrWnG:gj7yTdYaanr2hM/N/QbkvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

z2243415.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2243415.exe
Size 1.3MB
SHA256 31e5777373b31b8cbfd48fff46be8008edfba78b7e16eb9c99687139fb8a10ba
MD5 735daa38a0547aeb0144d0e980ff4a1c
SHA1 a7e23edd8ccefd7287bb407661c192eb4b320ba5
SHA512 aa8600455c767024fb982d9d2f4bfe0306c4f33b8c45d561ab52bdfaeab648efaf50ba02ad1a8d420c688189e000328f9b04084d0b3e6dff6ca64f51abb4d258
SSDEEP 24576:FyjrVR7olsG4kvPVXGaanr2hQuYXakgtoHAM8jAQbm2i3vrWnG:gj7yTdYaanr2hM/N/QbkvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5463278.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5463278.exe
Size 1.1MB
SHA256 63619b6e181dfb0a8c501450bba6321f6f23f74b93803d1e258702c2fed6052d
MD5 3e8625ba10de1ab0757a0e266cc22ee5
SHA1 bac5a462ea2fc9940a02d0138e1eb92d8f6da618
SHA512 abf9a5d97e3340765371a6fb0573c4bab2a10385a38a862b07221bf3677410009e1be0604d4b30b11cfb6de00622756351343cb60616c42beeb971c0c7f744ef
SSDEEP 24576:Nyjcu6KdJkvtMXG+bnCKhQIYXajOWFSdMy1U5bTJitc:ojculdsJ+bnCKh1xpN5be
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5463278.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5463278.exe
Size 1.1MB
SHA256 63619b6e181dfb0a8c501450bba6321f6f23f74b93803d1e258702c2fed6052d
MD5 3e8625ba10de1ab0757a0e266cc22ee5
SHA1 bac5a462ea2fc9940a02d0138e1eb92d8f6da618
SHA512 abf9a5d97e3340765371a6fb0573c4bab2a10385a38a862b07221bf3677410009e1be0604d4b30b11cfb6de00622756351343cb60616c42beeb971c0c7f744ef
SSDEEP 24576:Nyjcu6KdJkvtMXG+bnCKhQIYXajOWFSdMy1U5bTJitc:ojculdsJ+bnCKh1xpN5be
MD5 SHA1 SHA512 SSDEEP

Submit Download

z8150193.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8150193.exe
Size 927KB
SHA256 5b6425bacef2056da11e13977984ba230f3880d4541585cb876640a7f5d8fbb7
MD5 5d5f5bae8c41d147f408a18c1b44f727
SHA1 cd8fb18a7d758e958ef67bdebc8e0e7441dc8cef
SHA512 c913cb30a89f97084928f4cf535f4c0cc51dfd9c4f33e5c26b4873169a8434227a851bd3ecee4fcbff5fe61851fca47663045689d9f117e607f741c4fc75fc7e
SSDEEP 24576:Oy+EgmkvhcX4rengahZKYgas/dbq83BvajLM:dvg9vrengahsB9u
MD5 SHA1 SHA512 SSDEEP

Submit Download

z8150193.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8150193.exe
Size 927KB
SHA256 5b6425bacef2056da11e13977984ba230f3880d4541585cb876640a7f5d8fbb7
MD5 5d5f5bae8c41d147f408a18c1b44f727
SHA1 cd8fb18a7d758e958ef67bdebc8e0e7441dc8cef
SHA512 c913cb30a89f97084928f4cf535f4c0cc51dfd9c4f33e5c26b4873169a8434227a851bd3ecee4fcbff5fe61851fca47663045689d9f117e607f741c4fc75fc7e
SSDEEP 24576:Oy+EgmkvhcX4rengahZKYgas/dbq83BvajLM:dvg9vrengahsB9u
MD5 SHA1 SHA512 SSDEEP

Submit Download

z7334069.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7334069.exe
Size 489KB
SHA256 f985f1d5f70cd99a4d69ca1cba926c0cec8308ac7b1395532e128ba96be0d8d9
MD5 aad043ecb03c12451090975542912278
SHA1 ff809abf2227700bc74a124cb4bf6fd0b23e43d0
SHA512 30ba5a5b23832d6dfc014fdee545bb54ca39d8064aa20c83db62f3c86744126882381865507fd1cf0ea8ee988a4173c569316e36118839fad502e94aa9b55979
SSDEEP 12288:gMrCy90eH8qLuloDPCyEhxHRjnCjhpAAZJWYFDzp:yy/Lulo7XErJnCMAZ0YFD1
MD5 SHA1 SHA512 SSDEEP

Submit Download

z7334069.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7334069.exe
Size 489KB
SHA256 f985f1d5f70cd99a4d69ca1cba926c0cec8308ac7b1395532e128ba96be0d8d9
MD5 aad043ecb03c12451090975542912278
SHA1 ff809abf2227700bc74a124cb4bf6fd0b23e43d0
SHA512 30ba5a5b23832d6dfc014fdee545bb54ca39d8064aa20c83db62f3c86744126882381865507fd1cf0ea8ee988a4173c569316e36118839fad502e94aa9b55979
SSDEEP 12288:gMrCy90eH8qLuloDPCyEhxHRjnCjhpAAZJWYFDzp:yy/Lulo7XErJnCMAZ0YFD1
MD5 SHA1 SHA512 SSDEEP

Submit Download

q7183733.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7183733.exe
Size 21KB
SHA256 2a1e8603b54e5db721f07ac5db26dd3301ab861ee1e818ec5cd8e26b1a4019ba
MD5 aecc1e5a1501cd2354b7e3032fa4c1d1
SHA1 398980e643fe196c1083c1bbb4eba50272ab0ead
SHA512 b8d26b07cc8daf39e478b9830c67e1a2344740cf018947a8ea69039fdd3c7dbef3dd97d3e2ec7bc689ff479fdac8a953c5e58bea83c6cf7035b65c5874af10b7
SSDEEP 384:Ww+1WA2Ni64rzGfZvTx1uHFGi4i/8E9VFf:Ww+gU64rQQzeE
MD5 SHA1 SHA512 SSDEEP

Submit Download

q7183733.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7183733.exe
Size 21KB
SHA256 2a1e8603b54e5db721f07ac5db26dd3301ab861ee1e818ec5cd8e26b1a4019ba
MD5 aecc1e5a1501cd2354b7e3032fa4c1d1
SHA1 398980e643fe196c1083c1bbb4eba50272ab0ead
SHA512 b8d26b07cc8daf39e478b9830c67e1a2344740cf018947a8ea69039fdd3c7dbef3dd97d3e2ec7bc689ff479fdac8a953c5e58bea83c6cf7035b65c5874af10b7
SSDEEP 384:Ww+1WA2Ni64rzGfZvTx1uHFGi4i/8E9VFf:Ww+gU64rQQzeE
MD5 SHA1 SHA512 SSDEEP

Submit Download

r0124453.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0124453.exe
Size 1.4MB
SHA256 a53e45d194adc621e759fffd6bf608507a1201c1aba5836817d696f84bbdb627
MD5 0bd9b79a0014a8b4dc489d69d8a9f4ff
SHA1 4a5695dd6dc7a3f017ac1e1101856106490c263f
SHA512 6436f1cb7f0aafe3be82b0452ff0d504c00fb2054cf32f09054333a2c65c6bb8f0e0ae9b85282884941292ae91b9c9ad1bd88575a01cf3912bbf629809aa6545
SSDEEP 12288:jiOU3sJoAMErCuOVb9X6a9DhvhN3MRTdYMzwqznTbj:jusJo8g6a9DhvhWTd9zwqznT
MD5 SHA1 SHA512 SSDEEP

Submit Download

r0124453.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0124453.exe
Size 1.4MB
SHA256 a53e45d194adc621e759fffd6bf608507a1201c1aba5836817d696f84bbdb627
MD5 0bd9b79a0014a8b4dc489d69d8a9f4ff
SHA1 4a5695dd6dc7a3f017ac1e1101856106490c263f
SHA512 6436f1cb7f0aafe3be82b0452ff0d504c00fb2054cf32f09054333a2c65c6bb8f0e0ae9b85282884941292ae91b9c9ad1bd88575a01cf3912bbf629809aa6545
SSDEEP 12288:jiOU3sJoAMErCuOVb9X6a9DhvhN3MRTdYMzwqznTbj:jusJo8g6a9DhvhWTd9zwqznT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3492-42-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3492-45-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3492-46-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3492-48-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4424-35-0x0000000000460000-0x000000000046A000-memory.dmp

Download

memory/4424-36-0x00007FFD3ED50000-0x00007FFD3F73C000-memory.dmp

Download

memory/4424-38-0x00007FFD3ED50000-0x00007FFD3F73C000-memory.dmp

Download