healer | 4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a

Analysis

max time kernel
191s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe
Size

1.0MB
MD5

57d3c4401d3486b76c0ecb4c2ad1082d
SHA1

b60692c701b95bce619cdd9ae868cd46e37a2268
SHA256

4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a
SHA512

1da09f62f4ad6a4449e451cee34788361a156990972ef6764c2ca080ef8c7fe07f0ce5d710c47c687d10d365b7d6ecb099f0e3dc628ee546654070cbab347bac
SSDEEP

24576:XyZjdiK4Qis65bdkqXsqiDs7/vpmzpz7koLgGfqli:i67Qis0baqXsqp7/vp27PgGil

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023212-34.dat	healer
behavioral2/files/0x0007000000023212-33.dat	healer
behavioral2/memory/1064-35-0x0000000000530000-0x000000000053A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q9762594.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q9762594.exe

Executes dropped EXE 6 IoCs

pid	Process
3376	z6602534.exe
2276	z0336532.exe
832	z6772417.exe
3472	z1832639.exe
1064	q9762594.exe
4320	r2114704.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q9762594.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0336532.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6772417.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z1832639.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6602534.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4320 set thread context of 1608	4320	r2114704.exe	99

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2448	1608	WerFault.exe	99
4024	1608	WerFault.exe	99
3236	4320	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1064	q9762594.exe
1064	q9762594.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	q9762594.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3376	4812	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	90
PID 4812 wrote to memory of 3376	4812	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	90
PID 4812 wrote to memory of 3376	4812	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	90
PID 3376 wrote to memory of 2276	3376	z6602534.exe	91
PID 3376 wrote to memory of 2276	3376	z6602534.exe	91
PID 3376 wrote to memory of 2276	3376	z6602534.exe	91
PID 2276 wrote to memory of 832	2276	z0336532.exe	92
PID 2276 wrote to memory of 832	2276	z0336532.exe	92
PID 2276 wrote to memory of 832	2276	z0336532.exe	92
PID 832 wrote to memory of 3472	832	z6772417.exe	93
PID 832 wrote to memory of 3472	832	z6772417.exe	93
PID 832 wrote to memory of 3472	832	z6772417.exe	93
PID 3472 wrote to memory of 1064	3472	z1832639.exe	94
PID 3472 wrote to memory of 1064	3472	z1832639.exe	94
PID 3472 wrote to memory of 4320	3472	z1832639.exe	97
PID 3472 wrote to memory of 4320	3472	z1832639.exe	97
PID 3472 wrote to memory of 4320	3472	z1832639.exe	97
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 4320 wrote to memory of 1608	4320	r2114704.exe	99
PID 1608 wrote to memory of 2448	1608	AppLaunch.exe	103
PID 1608 wrote to memory of 2448	1608	AppLaunch.exe	103
PID 1608 wrote to memory of 2448	1608	AppLaunch.exe	103

C:\Users\Admin\AppData\Local\Temp\4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe
"C:\Users\Admin\AppData\Local\Temp\4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 200
        8⤵
        Program crash
        
        PID:2448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 200
        8⤵
        Program crash
        
        PID:4024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 184
        7⤵
        Program crash
        
        PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4320 -ip 4320
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1608 -ip 1608
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe

Filesize
969KB

MD5
f8fafc12abae08f77efbb7b44194763a

SHA1
a60fbf3e0032a0d5dc483922e3e634b9ca877544

SHA256
0bbc32ced2ede7e7b207133be36e21798874e1595ba05dd29d5e53935d98cadb

SHA512
b22183285fb1a33449cb3f5e7f9755bc9f1590889b7d53621b19603025932f6f438534e84a4d38d6a0beab63caa09d047a9817545245c87a9a13d62d8f39c264

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe

Filesize
969KB

MD5
f8fafc12abae08f77efbb7b44194763a

SHA1
a60fbf3e0032a0d5dc483922e3e634b9ca877544

SHA256
0bbc32ced2ede7e7b207133be36e21798874e1595ba05dd29d5e53935d98cadb

SHA512
b22183285fb1a33449cb3f5e7f9755bc9f1590889b7d53621b19603025932f6f438534e84a4d38d6a0beab63caa09d047a9817545245c87a9a13d62d8f39c264

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe

Filesize
786KB

MD5
1650f1b5f5443269b5bf96cda9cc6dc6

SHA1
c6751c661ea68b9176d07f0a79f0cb04b47c088c

SHA256
485b9c1c5e28e2d80df34cf4dd62831fc861d3365a07e24cb2c85906b192f60b

SHA512
3600159bc8ea748a9af23f2ae67aa42fbfbe6b445b1753a6cda694633ef01b67cb06c2d05899205938fcfe4744a54a8ec2c258d5407d2097e0ee2416c31e2273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe

Filesize
786KB

MD5
1650f1b5f5443269b5bf96cda9cc6dc6

SHA1
c6751c661ea68b9176d07f0a79f0cb04b47c088c

SHA256
485b9c1c5e28e2d80df34cf4dd62831fc861d3365a07e24cb2c85906b192f60b

SHA512
3600159bc8ea748a9af23f2ae67aa42fbfbe6b445b1753a6cda694633ef01b67cb06c2d05899205938fcfe4744a54a8ec2c258d5407d2097e0ee2416c31e2273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe

Filesize
604KB

MD5
b2a3faebd7a5110fbfa3373d567c87ca

SHA1
8e43f4b0d741a0ee7ce3fca52c16074d0d36e4c7

SHA256
498efb686ef48ee328ba059515ca57afb9721cdcc8bca1d22c9fb9c5857d06f3

SHA512
86372066eb8258f74ae1707cc0ae69a5af158965e7233156134c2ec17d04e64e4d00d619064fba3e5e8b9969881de09d5a3646fc75599f7514f22fb9e3f76d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe

Filesize
604KB

MD5
b2a3faebd7a5110fbfa3373d567c87ca

SHA1
8e43f4b0d741a0ee7ce3fca52c16074d0d36e4c7

SHA256
498efb686ef48ee328ba059515ca57afb9721cdcc8bca1d22c9fb9c5857d06f3

SHA512
86372066eb8258f74ae1707cc0ae69a5af158965e7233156134c2ec17d04e64e4d00d619064fba3e5e8b9969881de09d5a3646fc75599f7514f22fb9e3f76d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe

Filesize
339KB

MD5
f0ac139fe1cb3fdca7f9609ba517c42a

SHA1
cd5bc6191ed2cab2d484cc7944b7c40ac1bd36be

SHA256
9c2403ff56933c6405d975b88fb664b4a79128eb8137a9279626ee51d998a34f

SHA512
5a166c50aec04d2050e5c06d83f62545802ef8a2ed6a2b4126bdef06ab3b36c07e7195b55bad848f5d99a5ebaa53e1919733937745dd951f63429a356858642e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe

Filesize
339KB

MD5
f0ac139fe1cb3fdca7f9609ba517c42a

SHA1
cd5bc6191ed2cab2d484cc7944b7c40ac1bd36be

SHA256
9c2403ff56933c6405d975b88fb664b4a79128eb8137a9279626ee51d998a34f

SHA512
5a166c50aec04d2050e5c06d83f62545802ef8a2ed6a2b4126bdef06ab3b36c07e7195b55bad848f5d99a5ebaa53e1919733937745dd951f63429a356858642e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe

Filesize
12KB

MD5
f8ef23e84fadf742be674dab9addfe9d

SHA1
6490a0f9e0050ada3bb4ef42c63899ab1295850c

SHA256
fc58f7aa025869f34b4ad7a9b976b0742a784a6aecb258a4c207b0f842bc7004

SHA512
e549bbe7e9993e95f490c6420f61ccf6faba0ebe30663563797d4413bf06b7f37252d9d9c602c25205b5e35d5f8bc4e6d22df361f5bddea92af24c83455ff33c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe

Filesize
12KB

MD5
f8ef23e84fadf742be674dab9addfe9d

SHA1
6490a0f9e0050ada3bb4ef42c63899ab1295850c

SHA256
fc58f7aa025869f34b4ad7a9b976b0742a784a6aecb258a4c207b0f842bc7004

SHA512
e549bbe7e9993e95f490c6420f61ccf6faba0ebe30663563797d4413bf06b7f37252d9d9c602c25205b5e35d5f8bc4e6d22df361f5bddea92af24c83455ff33c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
memory/1064-37-0x00007FFC63280000-0x00007FFC63D41000-memory.dmp

Filesize
10.8MB

Download
memory/1064-39-0x00007FFC63280000-0x00007FFC63D41000-memory.dmp

Filesize
10.8MB

Download
memory/1064-36-0x00007FFC63280000-0x00007FFC63D41000-memory.dmp

Filesize
10.8MB

Download
memory/1064-35-0x0000000000530000-0x000000000053A000-memory.dmp

Filesize
40KB

Download
memory/1608-43-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1608-44-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1608-45-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1608-47-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download