healer | be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd

Resubmissions

05-11-2023 09:04

231105-k1q1tsde6w 10

08-06-2023 05:32

230608-f8rj4sdb51 10

Analysis

max time kernel
188s
max time network
257s
platform
windows10-1703_x64
resource
win10-20231025-en
resource tags

arch:x64arch:x86image:win10-20231025-enlocale:en-usos:windows10-1703-x64system
submitted
05-11-2023 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe
Size

13KB
MD5

a92baa47f1ec0001ed7256fc04b3f7ee
SHA1

7a81dcd22948b35804ded9f140036f59b6b4ca10
SHA256

be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd
SHA512

62785ed02a007a6a47dde108f18245c1d2512de9382e35db76d3483a1704e6519551fe73a7b2aa50c74f698e5c9f6e4f39b16e3fc7e1589169f014a4585da656
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

healer dropper evasion trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/604-0-0x0000000000B30000-0x0000000000B3A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
604	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe
604	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	604	be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe

C:\Users\Admin\AppData\Local\Temp\be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe
"C:\Users\Admin\AppData\Local\Temp\be21e1c43504edecde5c81ae46ea468a87f4b1962057be21a5ef26e33074e9cd.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-0-0x0000000000B30000-0x0000000000B3A000-memory.dmp

Filesize
40KB

Download
memory/604-1-0x00007FFC9B370000-0x00007FFC9BD5C000-memory.dmp

Filesize
9.9MB

Download
memory/604-3-0x00007FFC9B370000-0x00007FFC9BD5C000-memory.dmp

Filesize
9.9MB

Download