healer | 205ae779babd66a06edef8f4549388af61dbb854e06c82a7f291317f4dbe780e

Analysis

max time kernel
0s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:13

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
Size

863KB
MD5

2a6e1fb8b08aaa808c7fb58476b6e43a
SHA1

7ad750caf7fae9d5a84a40ceaa6b717687c8f8c0
SHA256

6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8
SHA512

e1ebc658f348be796144da8d64139e1736e028448e15e922663202fbb9234ae5eff82fe5323cd3b0b192f238eaa4dcbe91364fe0a46385726f91ec0afc892db8
SSDEEP

24576:zybHwr+znBAxCLaz/qplMPNYrlWCn+QCh2:GbQr+jBQL+M2R+Qq

Score

10^/10

healer dropper persistence

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral12/memory/1228-15-0x00000000004F0000-0x00000000004FA000-memory.dmp	healer
behavioral12/memory/1228-19-0x0000000000400000-0x0000000000412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Executes dropped EXE 2 IoCs

pid	Process
1476	y2308083.exe
1228	k0140419.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y2308083.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1476	3556	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	83
PID 3556 wrote to memory of 1476	3556	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	83
PID 3556 wrote to memory of 1476	3556	6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe	83
PID 1476 wrote to memory of 1228	1476	y2308083.exe	84
PID 1476 wrote to memory of 1228	1476	y2308083.exe	84
PID 1476 wrote to memory of 1228	1476	y2308083.exe	84

C:\Users\Admin\AppData\Local\Temp\6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
"C:\Users\Admin\AppData\Local\Temp\6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe
    3⤵
    - Executes dropped EXE
    PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2308083.exe

Filesize
680KB

MD5
9c6164d041c24db6736a51008707f2a6

SHA1
c11101f7b72a3a0249f3e873bdd3735c1d8267fe

SHA256
bf73429ee52f9270d33a8197ee4e52727f33a67083eb1ae40adfbc8b2dbe2075

SHA512
847f56104d115c6b8e59a02fd5252a6e52a8511faf01b59d86fb3abbef1fab226cc5abce2c8921777c0db88e616b6f14028cdfcbd09fc6b6bfc06c5e4aaca2b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k0140419.exe

Filesize
530KB

MD5
5663b528b5976a2873c447dbcb05b6af

SHA1
c4e5c3993293c0441f80d4434d177708962bb78f

SHA256
082e8efad9dc970b2395071b67565558033a397e71cb304fea335ae18b739edf

SHA512
1c352c1c48faa071b627b152c0898ac7e0e5c685478a79561d388a9a2563ce27c221b05b1e9572b62788dbca008da5858a2d33889b086f254d633f725e3600e2

Download Submit
memory/1228-15-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/1228-14-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1228-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads