resource	yara_rule
behavioral1/memory/2068-103-0x0000000000020000-0x000000000002A000-memory.dmp	healer
behavioral1/files/0x0006000000014a52-108.dat	healer
behavioral1/files/0x0006000000014a52-110.dat	healer
behavioral1/files/0x0006000000014a52-111.dat	healer
behavioral1/memory/2128-112-0x00000000003C0000-0x00000000003CA000-memory.dmp	healer

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b3232627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b3232627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b3232627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a8127655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a8127655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a8127655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a8127655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a8127655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a8127655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b3232627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b3232627.exe

pid	Process
2312	v5337196.exe
2824	v1528549.exe
2088	v8504945.exe
2068	a8127655.exe
2128	b3232627.exe
2956	c6110944.exe

pid	Process
2320	829cadee0d03495a0fb24c959.exe
2312	v5337196.exe
2312	v5337196.exe
2824	v1528549.exe
2824	v1528549.exe
2088	v8504945.exe
2088	v8504945.exe
2088	v8504945.exe
2068	a8127655.exe
2088	v8504945.exe
2824	v1528549.exe
2824	v1528549.exe
2956	c6110944.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	a8127655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a8127655.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	b3232627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b3232627.exe

description	pid	Process
Token: SeDebugPrivilege	2068	a8127655.exe
Token: SeDebugPrivilege	2128	b3232627.exe

description	pid	Process	procid_target
PID 2320 wrote to memory of 2312	2320	829cadee0d03495a0fb24c959.exe	30
PID 2320 wrote to memory of 2312	2320	829cadee0d03495a0fb24c959.exe	30
PID 2320 wrote to memory of 2312	2320	829cadee0d03495a0fb24c959.exe	30
PID 2320 wrote to memory of 2312	2320	829cadee0d03495a0fb24c959.exe	30
PID 2320 wrote to memory of 2312	2320	829cadee0d03495a0fb24c959.exe	30
PID 2320 wrote to memory of 2312	2320	829cadee0d03495a0fb24c959.exe	30
PID 2320 wrote to memory of 2312	2320	829cadee0d03495a0fb24c959.exe	30
PID 2312 wrote to memory of 2824	2312	v5337196.exe	31
PID 2312 wrote to memory of 2824	2312	v5337196.exe	31
PID 2312 wrote to memory of 2824	2312	v5337196.exe	31
PID 2312 wrote to memory of 2824	2312	v5337196.exe	31
PID 2312 wrote to memory of 2824	2312	v5337196.exe	31
PID 2312 wrote to memory of 2824	2312	v5337196.exe	31
PID 2312 wrote to memory of 2824	2312	v5337196.exe	31
PID 2824 wrote to memory of 2088	2824	v1528549.exe	32
PID 2824 wrote to memory of 2088	2824	v1528549.exe	32
PID 2824 wrote to memory of 2088	2824	v1528549.exe	32
PID 2824 wrote to memory of 2088	2824	v1528549.exe	32
PID 2824 wrote to memory of 2088	2824	v1528549.exe	32
PID 2824 wrote to memory of 2088	2824	v1528549.exe	32
PID 2824 wrote to memory of 2088	2824	v1528549.exe	32
PID 2088 wrote to memory of 2068	2088	v8504945.exe	33
PID 2088 wrote to memory of 2068	2088	v8504945.exe	33
PID 2088 wrote to memory of 2068	2088	v8504945.exe	33
PID 2088 wrote to memory of 2068	2088	v8504945.exe	33
PID 2088 wrote to memory of 2068	2088	v8504945.exe	33
PID 2088 wrote to memory of 2068	2088	v8504945.exe	33
PID 2088 wrote to memory of 2068	2088	v8504945.exe	33
PID 2088 wrote to memory of 2128	2088	v8504945.exe	35
PID 2088 wrote to memory of 2128	2088	v8504945.exe	35
PID 2088 wrote to memory of 2128	2088	v8504945.exe	35
PID 2088 wrote to memory of 2128	2088	v8504945.exe	35
PID 2088 wrote to memory of 2128	2088	v8504945.exe	35
PID 2088 wrote to memory of 2128	2088	v8504945.exe	35
PID 2088 wrote to memory of 2128	2088	v8504945.exe	35
PID 2824 wrote to memory of 2956	2824	v1528549.exe	36
PID 2824 wrote to memory of 2956	2824	v1528549.exe	36
PID 2824 wrote to memory of 2956	2824	v1528549.exe	36
PID 2824 wrote to memory of 2956	2824	v1528549.exe	36
PID 2824 wrote to memory of 2956	2824	v1528549.exe	36
PID 2824 wrote to memory of 2956	2824	v1528549.exe	36
PID 2824 wrote to memory of 2956	2824	v1528549.exe	36

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.