Analysis

  • max time kernel
    104s
  • max time network
    108s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19-09-2023 07:05

General

  • Target

    b2e9f1961068c7fa8e41dd3ae72f8cad15d68078a268f275cc634530c08f25a9.exe

  • Size

    1MB

  • MD5

    7b3f9e2b1568b23496a3536e7cb1749d

  • SHA1

    47e2caa7f62a2ce95193aee0b4b0b0c9b9bc973c

  • SHA256

    b2e9f1961068c7fa8e41dd3ae72f8cad15d68078a268f275cc634530c08f25a9

  • SHA512

    e7ff30c52733441691caaacf7c939e9a5802b1bc018ca553c03ce608e4306e9cf63e0df6344cda4efa600a91f12706c7c7c4d8b85c848e64721bd19a2effa3c6

  • SSDEEP

    24576:jiyM5edpbbLZ8gSNiKsFiNDh8h3xaf+Uhnc41B1lCjxHiQghxVB1XQWus:A5+vWoq8h3xI+cc04H4T31XQWus

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2e9f1961068c7fa8e41dd3ae72f8cad15d68078a268f275cc634530c08f25a9.exe
    "C:\Users\Admin\AppData\Local\Temp\b2e9f1961068c7fa8e41dd3ae72f8cad15d68078a268f275cc634530c08f25a9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2488715.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2488715.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3505875.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3505875.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4132
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3229346.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3229346.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:4400
            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6307251.exe
              C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6307251.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1852
              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6665607.exe
                C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6665607.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4644
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1876
              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0958118.exe
                C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0958118.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4140
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                    PID:2156
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 568
                      9⤵
                      • Program crash
                      PID:3692
              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5010576.exe
                C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5010576.exe
                6⤵
                • Executes dropped EXE
                PID:4452
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 568
                  7⤵
                  • Program crash
                  PID:2904

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Impair Defenses

    1
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2488715.exe
      Filesize

      1MB

      MD5

      95f8ad1275328580783701181d20e1f5

      SHA1

      2b46feae019eef0c449b69e2c87e98a2bedae26e

      SHA256

      506b67e7c5d1d0ea4c361140599b2e4aaaa3be4071699d38c055fac442ff444f

      SHA512

      9aea33c98a6f1b8f901e54b9eeb2fdc43b71a80ffc767ee2b328a8f353daf5d71d75b3724c08b48a56210d25673dc2ff31d36acd5596f842ba02b46cdc31be71

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2488715.exe
      Filesize

      1MB

      MD5

      95f8ad1275328580783701181d20e1f5

      SHA1

      2b46feae019eef0c449b69e2c87e98a2bedae26e

      SHA256

      506b67e7c5d1d0ea4c361140599b2e4aaaa3be4071699d38c055fac442ff444f

      SHA512

      9aea33c98a6f1b8f901e54b9eeb2fdc43b71a80ffc767ee2b328a8f353daf5d71d75b3724c08b48a56210d25673dc2ff31d36acd5596f842ba02b46cdc31be71

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3505875.exe
      Filesize

      792KB

      MD5

      0fd5fe48ecab0b6082154fd55dc0ddbf

      SHA1

      69718249d2130bbd92048817f899574d1faca8e3

      SHA256

      63ab3f8758f7d8b746cce0a2fdb93ddeae4593115fb25779c60763ff8c350ace

      SHA512

      42d944835eff314bc8418dc201abf1b742eafb79c23117e366bee6c6904433d74cdd76e469b6d3164231c5343320023502d272f8a7daa72e65f3c4bd762ed10f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3505875.exe
      Filesize

      792KB

      MD5

      0fd5fe48ecab0b6082154fd55dc0ddbf

      SHA1

      69718249d2130bbd92048817f899574d1faca8e3

      SHA256

      63ab3f8758f7d8b746cce0a2fdb93ddeae4593115fb25779c60763ff8c350ace

      SHA512

      42d944835eff314bc8418dc201abf1b742eafb79c23117e366bee6c6904433d74cdd76e469b6d3164231c5343320023502d272f8a7daa72e65f3c4bd762ed10f

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3229346.exe
      Filesize

      609KB

      MD5

      fc5e2339d9eeb199859053a8339e3631

      SHA1

      94f4595221507c9ef5f36a977acc907bd0fd1f23

      SHA256

      df9440f40f9befa5361765058718e958320c2d37572ef39a8fbd31b41caa7f70

      SHA512

      4315479e082f3c3dba88a2fefbdca58df2df5a4c61813e842bcc533129ea32871ed0a4ec53945da84f5b3f77ab672ada45fbf4aa323ffd4a40771c4255f6f622

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z3229346.exe
      Filesize

      609KB

      MD5

      fc5e2339d9eeb199859053a8339e3631

      SHA1

      94f4595221507c9ef5f36a977acc907bd0fd1f23

      SHA256

      df9440f40f9befa5361765058718e958320c2d37572ef39a8fbd31b41caa7f70

      SHA512

      4315479e082f3c3dba88a2fefbdca58df2df5a4c61813e842bcc533129ea32871ed0a4ec53945da84f5b3f77ab672ada45fbf4aa323ffd4a40771c4255f6f622

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5010576.exe
      Filesize

      255KB

      MD5

      bf68f162e4af637b0fdd1952c3dd3c50

      SHA1

      1fa8d606b928ee225b57c7768526ee72595a4cc5

      SHA256

      62d4860303c4d7be6805b069da68826f435e61721e94a48eeec426fd167ad51e

      SHA512

      d373ad4b331dc05b3da9101da0950742ce47722f7e68924f5b94d644746c5b89c99c0c68b3f7891efbb46f5d22644d7326d21dc3acc4f0726b04eb7a032ba6d9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5010576.exe
      Filesize

      255KB

      MD5

      bf68f162e4af637b0fdd1952c3dd3c50

      SHA1

      1fa8d606b928ee225b57c7768526ee72595a4cc5

      SHA256

      62d4860303c4d7be6805b069da68826f435e61721e94a48eeec426fd167ad51e

      SHA512

      d373ad4b331dc05b3da9101da0950742ce47722f7e68924f5b94d644746c5b89c99c0c68b3f7891efbb46f5d22644d7326d21dc3acc4f0726b04eb7a032ba6d9

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6307251.exe
      Filesize

      370KB

      MD5

      e13e70153715727e71d4de74fd7490f6

      SHA1

      b1708669c25dd1f93602a0b135c1a25cc5bce8c6

      SHA256

      aa53f826e850fc5e63a5465b33b676c06fdd7b87de7f16037ae6d3449ab0a34e

      SHA512

      e6e827f1cb51106f9829460ffd411b0e57fbf8164a4427443c5410a75fb06047aad43167cbfcd6aae6c4cc3f523567e75bbb95ed663e595688e7e2b1df46830a

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6307251.exe
      Filesize

      370KB

      MD5

      e13e70153715727e71d4de74fd7490f6

      SHA1

      b1708669c25dd1f93602a0b135c1a25cc5bce8c6

      SHA256

      aa53f826e850fc5e63a5465b33b676c06fdd7b87de7f16037ae6d3449ab0a34e

      SHA512

      e6e827f1cb51106f9829460ffd411b0e57fbf8164a4427443c5410a75fb06047aad43167cbfcd6aae6c4cc3f523567e75bbb95ed663e595688e7e2b1df46830a

    • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6665607.exe
      Filesize

      236KB

      MD5

      b64ae11bc5fa9c865208a436d95ce740

      SHA1

      4277db6258c24d8b56eef4783c6595908255ec4d

      SHA256

      e2e2de3520bdd60f8d05c74737aa2569536797e0caf96d27e353d1d24ca05ccb

      SHA512

      964d359355301e560569a88f7de89e1142c615ee1954c05f6c8c16625384972ea3f11ae1689f4ce7f5b520b5d395a1fcb3692585cd9c91774eb687828ec0568e

    • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6665607.exe
      Filesize

      236KB

      MD5

      b64ae11bc5fa9c865208a436d95ce740

      SHA1

      4277db6258c24d8b56eef4783c6595908255ec4d

      SHA256

      e2e2de3520bdd60f8d05c74737aa2569536797e0caf96d27e353d1d24ca05ccb

      SHA512

      964d359355301e560569a88f7de89e1142c615ee1954c05f6c8c16625384972ea3f11ae1689f4ce7f5b520b5d395a1fcb3692585cd9c91774eb687828ec0568e

    • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0958118.exe
      Filesize

      393KB

      MD5

      6aaaae134cb6780b5f88c036ef9a7058

      SHA1

      b73d8b31baeef8d99659b745b7d0082786c05325

      SHA256

      a98c6f2264bd7f666afbd0ed16076f58c884bb5e3b5aff9c5567c38192ab7e7a

      SHA512

      3827aa47525091ba75e5c2309e5475bb3601f0fa4054c9394ce189825b0a609c90662c80d8070990bca92a29eb29123c88124cb0f1d8087ae36f903234e1fb48

    • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0958118.exe
      Filesize

      393KB

      MD5

      6aaaae134cb6780b5f88c036ef9a7058

      SHA1

      b73d8b31baeef8d99659b745b7d0082786c05325

      SHA256

      a98c6f2264bd7f666afbd0ed16076f58c884bb5e3b5aff9c5567c38192ab7e7a

      SHA512

      3827aa47525091ba75e5c2309e5475bb3601f0fa4054c9394ce189825b0a609c90662c80d8070990bca92a29eb29123c88124cb0f1d8087ae36f903234e1fb48

    • memory/1876-83-0x0000000073980000-0x000000007406E000-memory.dmp
      Filesize

      6MB

    • memory/1876-68-0x0000000073980000-0x000000007406E000-memory.dmp
      Filesize

      6MB

    • memory/1876-41-0x0000000000400000-0x000000000040A000-memory.dmp
      Filesize

      40KB

    • memory/1876-48-0x0000000073980000-0x000000007406E000-memory.dmp
      Filesize

      6MB

    • memory/2156-55-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/2156-49-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/2156-57-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/2156-54-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/3052-2-0x0000000000400000-0x000000000053C000-memory.dmp
      Filesize

      1MB

    • memory/3052-9-0x0000000000400000-0x000000000053C000-memory.dmp
      Filesize

      1MB

    • memory/3052-1-0x0000000000400000-0x000000000053C000-memory.dmp
      Filesize

      1MB

    • memory/3052-67-0x0000000000400000-0x000000000053C000-memory.dmp
      Filesize

      1MB

    • memory/3052-0-0x0000000000400000-0x000000000053C000-memory.dmp
      Filesize

      1MB

    • memory/3052-4-0x0000000000400000-0x000000000053C000-memory.dmp
      Filesize

      1MB