Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
18/07/2023, 13:21
General
- Target cbdbaee0061786a6213eba254a81dd88.exe
- Size 146KB
- Sample230718-qlm9aaaf62
- SHA256 445b083048cd2e7ced4e622e8aff246544938f9ebe20da317a2e755fe0663985
Score
10/10
Malware Config
Signatures
- Detects Healer an antivirus disabler dropper 1 IoCs
- Healer
Healer an antivirus disabler dropper.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbdbaee0061786a6213eba254a81dd88.exe"C:\Users\Admin\AppData\Local\Temp\cbdbaee0061786a6213eba254a81dd88.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2928-133-0x00000000001C0000-0x00000000001CA000-memory.dmp
memory/2928-137-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/2928-138-0x0000000074D70000-0x0000000075520000-memory.dmp
memory/2928-141-0x0000000074D70000-0x0000000075520000-memory.dmp