healer | f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c

Analysis

max time kernel
126s
max time network
131s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
03/10/2023, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c.exe
Size

1.4MB
MD5

f763c34a2681920ba522c88c3e983b6f
SHA1

96fb2fb7718bad220e9905b36a055befc21bcd5d
SHA256

f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c
SHA512

56997e3779715562b942df9dc36d37a7da5b55f83b6517ad456a7459be63d3f6380e30ae1315190120816732f3edadabda1210a931acdbab7f67d29a76854ad3
SSDEEP

24576:Cyr2dGBW85JZlgAT0Tcb0MVibedjYYr5YkwnyVOBOBZPNz6dim6tBq5512:pGGBWMJvLTscoMVibepr5Y3yVO0rPN5C

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001af60-27.dat	healer
behavioral1/files/0x000700000001af60-26.dat	healer
behavioral1/memory/4932-28-0x0000000000C80000-0x0000000000C8A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1gr82lu4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1gr82lu4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1gr82lu4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1gr82lu4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1gr82lu4.exe

Executes dropped EXE 5 IoCs

pid	Process
2036	tQ3yM46.exe
428	BV6ld49.exe
536	uy8mc31.exe
4932	1gr82lu4.exe
4684	2vo7175.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1gr82lu4.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	uy8mc31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tQ3yM46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	BV6ld49.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 4960	4684	2vo7175.exe	76

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3336	4684	WerFault.exe	73
2700	4960	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4932	1gr82lu4.exe
4932	1gr82lu4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	1gr82lu4.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 2036	3612	f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c.exe	69
PID 3612 wrote to memory of 2036	3612	f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c.exe	69
PID 3612 wrote to memory of 2036	3612	f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c.exe	69
PID 2036 wrote to memory of 428	2036	tQ3yM46.exe	70
PID 2036 wrote to memory of 428	2036	tQ3yM46.exe	70
PID 2036 wrote to memory of 428	2036	tQ3yM46.exe	70
PID 428 wrote to memory of 536	428	BV6ld49.exe	71
PID 428 wrote to memory of 536	428	BV6ld49.exe	71
PID 428 wrote to memory of 536	428	BV6ld49.exe	71
PID 536 wrote to memory of 4932	536	uy8mc31.exe	72
PID 536 wrote to memory of 4932	536	uy8mc31.exe	72
PID 536 wrote to memory of 4684	536	uy8mc31.exe	73
PID 536 wrote to memory of 4684	536	uy8mc31.exe	73
PID 536 wrote to memory of 4684	536	uy8mc31.exe	73
PID 4684 wrote to memory of 3920	4684	2vo7175.exe	75
PID 4684 wrote to memory of 3920	4684	2vo7175.exe	75
PID 4684 wrote to memory of 3920	4684	2vo7175.exe	75
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76
PID 4684 wrote to memory of 4960	4684	2vo7175.exe	76

C:\Users\Admin\AppData\Local\Temp\f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c.exe
"C:\Users\Admin\AppData\Local\Temp\f533d32642996431aa47d2b811b9bd246f1c268c102c1a29f7bed939a2d23a3c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ3yM46.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ3yM46.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BV6ld49.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BV6ld49.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uy8mc31.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uy8mc31.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gr82lu4.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gr82lu4.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vo7175.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vo7175.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4684
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3920
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 568
        7⤵
        Program crash
        
        PID:2700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 608
        6⤵
        Program crash
        
        PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ3yM46.exe

Filesize
1.3MB

MD5
eafc4bd9f4442cec98ccf13ad637b878

SHA1
10a702c0df3f93405238dc62890fd1b567b62551

SHA256
4d5f9665c7d918d23b08d70874cd9d7c440d008453ac34a966dd0f30ab46554a

SHA512
ff79db57b1ae758446718493645760fa0f8a33f4c0ff9d82e08f00b9a402bae6c608d5943c347511d7f3e4022cb1db8d6760f0af65970de86969b71e8dc66ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ3yM46.exe

Filesize
1.3MB

MD5
eafc4bd9f4442cec98ccf13ad637b878

SHA1
10a702c0df3f93405238dc62890fd1b567b62551

SHA256
4d5f9665c7d918d23b08d70874cd9d7c440d008453ac34a966dd0f30ab46554a

SHA512
ff79db57b1ae758446718493645760fa0f8a33f4c0ff9d82e08f00b9a402bae6c608d5943c347511d7f3e4022cb1db8d6760f0af65970de86969b71e8dc66ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BV6ld49.exe

Filesize
876KB

MD5
2de90d8b2d64ffd37891690a2703cf99

SHA1
36e2e8c953f83d5dd4097855957b43309b445f34

SHA256
eb7caefb0039576055f6f4477dcb0ee83e26f9c623db8f7237bf2b41bfe75097

SHA512
91fbd3324ed043f3741169de53de577e79aaf4d6e6487da844d27c3033efec77a78f2d642d6a12c8f9abf4cac61160127373a140141792dd55099d97b8f75d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BV6ld49.exe

Filesize
876KB

MD5
2de90d8b2d64ffd37891690a2703cf99

SHA1
36e2e8c953f83d5dd4097855957b43309b445f34

SHA256
eb7caefb0039576055f6f4477dcb0ee83e26f9c623db8f7237bf2b41bfe75097

SHA512
91fbd3324ed043f3741169de53de577e79aaf4d6e6487da844d27c3033efec77a78f2d642d6a12c8f9abf4cac61160127373a140141792dd55099d97b8f75d0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uy8mc31.exe

Filesize
489KB

MD5
99b3626ee58c200bbcf2f83c71760cd2

SHA1
c2e655b7c8ddb4ba6342a252739dde47de97b5c3

SHA256
ea69c3459a8784f407bb9a6fa7e8dcbb40e376c1031788f04697c8bfeee36faf

SHA512
630d0d4783a28aa5d8302661e946838a51ea6b72ea5feeca8baa1f5afbe6e23d336763bae61ec26fa8b210e97df0c9d5efef5ad0a30dd99eb3da08e211196e85

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uy8mc31.exe

Filesize
489KB

MD5
99b3626ee58c200bbcf2f83c71760cd2

SHA1
c2e655b7c8ddb4ba6342a252739dde47de97b5c3

SHA256
ea69c3459a8784f407bb9a6fa7e8dcbb40e376c1031788f04697c8bfeee36faf

SHA512
630d0d4783a28aa5d8302661e946838a51ea6b72ea5feeca8baa1f5afbe6e23d336763bae61ec26fa8b210e97df0c9d5efef5ad0a30dd99eb3da08e211196e85

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gr82lu4.exe

Filesize
19KB

MD5
c7dec1ca749501dd85a2bc37cb5069ee

SHA1
482c4a8d87d71332f1abfc291611ea8f14f35d59

SHA256
2929171ec360ff3748dab424ed4b503cf8c1f5b24f468e0f4ab01d1bf76d5178

SHA512
a06fea976ea5f4738d55802da6fa5d7a4f3b19cb378115d3f87951ecc9eae75c999a33cf8bfbe79d6657f1963e22c341a94aac23005c1e3c5d3f01ee2ed3eec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gr82lu4.exe

Filesize
19KB

MD5
c7dec1ca749501dd85a2bc37cb5069ee

SHA1
482c4a8d87d71332f1abfc291611ea8f14f35d59

SHA256
2929171ec360ff3748dab424ed4b503cf8c1f5b24f468e0f4ab01d1bf76d5178

SHA512
a06fea976ea5f4738d55802da6fa5d7a4f3b19cb378115d3f87951ecc9eae75c999a33cf8bfbe79d6657f1963e22c341a94aac23005c1e3c5d3f01ee2ed3eec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vo7175.exe

Filesize
1.4MB

MD5
fe4daf73dc8107c5976368b660396cb9

SHA1
28971e2e26deccbd6fd01d30d84649217d39b692

SHA256
9240a4a9a735b31824b35ba65ad5f90d780b6d56e2394fd666ab1bb52362efe3

SHA512
5491bce628019d999d3ae266f424d5137ceb02c349183f6fed758390f24305f91efe1f2709573d2ff9093b0e510e238a19e49caf7cbb64b0397d30ba439485c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vo7175.exe

Filesize
1.4MB

MD5
fe4daf73dc8107c5976368b660396cb9

SHA1
28971e2e26deccbd6fd01d30d84649217d39b692

SHA256
9240a4a9a735b31824b35ba65ad5f90d780b6d56e2394fd666ab1bb52362efe3

SHA512
5491bce628019d999d3ae266f424d5137ceb02c349183f6fed758390f24305f91efe1f2709573d2ff9093b0e510e238a19e49caf7cbb64b0397d30ba439485c9

Download Submit
memory/4932-31-0x00007FFA936E0000-0x00007FFA940CC000-memory.dmp

Filesize
9.9MB

Download
memory/4932-29-0x00007FFA936E0000-0x00007FFA940CC000-memory.dmp

Filesize
9.9MB

Download
memory/4932-28-0x0000000000C80000-0x0000000000C8A000-memory.dmp

Filesize
40KB

Download
memory/4960-35-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4960-39-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4960-38-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4960-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download