healer | 8360cdd4cc92b30b1c646682af6e246cd73e0355a8419e3ea19a0f1fa3097ab9 | Triage

Sharing

General

Target

8360cdd4cc92b30b1c646682af6e246cd73e0355a8419e3ea19a0f1fa3097ab9
Size

1.1MB
Sample

231011-11j6aafc4s
MD5

840668e93b04fd8c860cb658d75cb13e
SHA1

d5dd213232ba02d85aa4b41e3cd6815af72d25b1
SHA256

8360cdd4cc92b30b1c646682af6e246cd73e0355a8419e3ea19a0f1fa3097ab9
SHA512

16462a61f7723b86c9cfef54a3b68fd3c91caf9fff63d31ba41366ab545634304efb43c049dc65d1f69f1374069392e2299c0dff1b42500d34c478969667d6e6
SSDEEP

24576:By38rkIeUmY/TTFIBNBiKHYoV3XCWZ/OGjqJo1O4DdVC8:0sQzY/TgI0ZMG1DdVC

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Targets

- Target
  
  8360cdd4cc92b30b1c646682af6e246cd73e0355a8419e3ea19a0f1fa3097ab9
- Size
  
  1.1MB
- MD5
  
  840668e93b04fd8c860cb658d75cb13e
- SHA1
  
  d5dd213232ba02d85aa4b41e3cd6815af72d25b1
- SHA256
  
  8360cdd4cc92b30b1c646682af6e246cd73e0355a8419e3ea19a0f1fa3097ab9
- SHA512
  
  16462a61f7723b86c9cfef54a3b68fd3c91caf9fff63d31ba41366ab545634304efb43c049dc65d1f69f1374069392e2299c0dff1b42500d34c478969667d6e6
- SSDEEP
  
  24576:By38rkIeUmY/TTFIBNBiKHYoV3XCWZ/OGjqJo1O4DdVC8:0sQzY/TgI0ZMG1DdVC
Score

10^/10

healer dropper evasion persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

healerdropperevasionpersistencetrojan

behavioral2

healerdropperevasionpersistencetrojan