healer | 3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01-10-2023 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe
Size

1.0MB
MD5

dc062986a0acf016b2fb5edc0d9c3a4e
SHA1

187cc01b5d1525b53e4a2b0608a90b413244a388
SHA256

3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428
SHA512

b1ff44fea8a6b0abfac8240c0e77e33386a58022946cdd750fb67145cb1c033a526977c307ee776c5f5935b2530d86ec70c4a1365c94b64aa7066bafc091e5f5
SSDEEP

24576:MyAApfcUUWSF8bGQFVmrw54J4Mw1C7r8LHveC2bGekz:7rRcU48bGQXxMwArAHmCUx

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe	healer
behavioral1/memory/2664-48-0x0000000000A50000-0x0000000000A5A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

q7553627.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q7553627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q7553627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q7553627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q7553627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q7553627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q7553627.exe

Executes dropped EXE 6 IoCs

Processes:

z0923342.exez4449250.exez6363428.exez6417688.exeq7553627.exer6200092.exe

pid process

2080 z0923342.exe
2200 z4449250.exe
2692 z6363428.exe
2660 z6417688.exe
2664 q7553627.exe
2156 r6200092.exe

pid	process
2080	z0923342.exe
2200	z4449250.exe
2692	z6363428.exe
2660	z6417688.exe
2664	q7553627.exe
2156	r6200092.exe

Loads dropped DLL 16 IoCs

Processes:

3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exez0923342.exez4449250.exez6363428.exez6417688.exer6200092.exeWerFault.exe

pid	process
2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe
2080	z0923342.exe
2080	z0923342.exe
2200	z4449250.exe
2200	z4449250.exe
2692	z6363428.exe
2692	z6363428.exe
2660	z6417688.exe
2660	z6417688.exe
2660	z6417688.exe
2660	z6417688.exe
2156	r6200092.exe
2504	WerFault.exe
2504	WerFault.exe
2504	WerFault.exe
2504	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

q7553627.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	q7553627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q7553627.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z0923342.exez4449250.exez6363428.exez6417688.exe3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0923342.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z4449250.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6363428.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z6417688.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

r6200092.exe

description pid process target process

PID 2156 set thread context of 2716 2156 r6200092.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2504 2156 WerFault.exe r6200092.exe
2560 2716 WerFault.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

q7553627.exe

pid process

2664 q7553627.exe
2664 q7553627.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

q7553627.exe

description pid process

Token: SeDebugPrivilege 2664 q7553627.exe

description	pid	process	target process
PID 2156 set thread context of 2716	2156	r6200092.exe	AppLaunch.exe

pid	pid_target	process	target process
2504	2156	WerFault.exe	r6200092.exe
2560	2716	WerFault.exe	AppLaunch.exe

pid	process
2664	q7553627.exe
2664	q7553627.exe

description	pid	process
Token: SeDebugPrivilege	2664	q7553627.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exez0923342.exez4449250.exez6363428.exez6417688.exer6200092.exeAppLaunch.exe

description	pid	process	target process
PID 2108 wrote to memory of 2080	2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe	z0923342.exe
PID 2108 wrote to memory of 2080	2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe	z0923342.exe
PID 2108 wrote to memory of 2080	2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe	z0923342.exe
PID 2108 wrote to memory of 2080	2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe	z0923342.exe
PID 2108 wrote to memory of 2080	2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe	z0923342.exe
PID 2108 wrote to memory of 2080	2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe	z0923342.exe
PID 2108 wrote to memory of 2080	2108	3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe	z0923342.exe
PID 2080 wrote to memory of 2200	2080	z0923342.exe	z4449250.exe
PID 2080 wrote to memory of 2200	2080	z0923342.exe	z4449250.exe
PID 2080 wrote to memory of 2200	2080	z0923342.exe	z4449250.exe
PID 2080 wrote to memory of 2200	2080	z0923342.exe	z4449250.exe
PID 2080 wrote to memory of 2200	2080	z0923342.exe	z4449250.exe
PID 2080 wrote to memory of 2200	2080	z0923342.exe	z4449250.exe
PID 2080 wrote to memory of 2200	2080	z0923342.exe	z4449250.exe
PID 2200 wrote to memory of 2692	2200	z4449250.exe	z6363428.exe
PID 2200 wrote to memory of 2692	2200	z4449250.exe	z6363428.exe
PID 2200 wrote to memory of 2692	2200	z4449250.exe	z6363428.exe
PID 2200 wrote to memory of 2692	2200	z4449250.exe	z6363428.exe
PID 2200 wrote to memory of 2692	2200	z4449250.exe	z6363428.exe
PID 2200 wrote to memory of 2692	2200	z4449250.exe	z6363428.exe
PID 2200 wrote to memory of 2692	2200	z4449250.exe	z6363428.exe
PID 2692 wrote to memory of 2660	2692	z6363428.exe	z6417688.exe
PID 2692 wrote to memory of 2660	2692	z6363428.exe	z6417688.exe
PID 2692 wrote to memory of 2660	2692	z6363428.exe	z6417688.exe
PID 2692 wrote to memory of 2660	2692	z6363428.exe	z6417688.exe
PID 2692 wrote to memory of 2660	2692	z6363428.exe	z6417688.exe
PID 2692 wrote to memory of 2660	2692	z6363428.exe	z6417688.exe
PID 2692 wrote to memory of 2660	2692	z6363428.exe	z6417688.exe
PID 2660 wrote to memory of 2664	2660	z6417688.exe	q7553627.exe
PID 2660 wrote to memory of 2664	2660	z6417688.exe	q7553627.exe
PID 2660 wrote to memory of 2664	2660	z6417688.exe	q7553627.exe
PID 2660 wrote to memory of 2664	2660	z6417688.exe	q7553627.exe
PID 2660 wrote to memory of 2664	2660	z6417688.exe	q7553627.exe
PID 2660 wrote to memory of 2664	2660	z6417688.exe	q7553627.exe
PID 2660 wrote to memory of 2664	2660	z6417688.exe	q7553627.exe
PID 2660 wrote to memory of 2156	2660	z6417688.exe	r6200092.exe
PID 2660 wrote to memory of 2156	2660	z6417688.exe	r6200092.exe
PID 2660 wrote to memory of 2156	2660	z6417688.exe	r6200092.exe
PID 2660 wrote to memory of 2156	2660	z6417688.exe	r6200092.exe
PID 2660 wrote to memory of 2156	2660	z6417688.exe	r6200092.exe
PID 2660 wrote to memory of 2156	2660	z6417688.exe	r6200092.exe
PID 2660 wrote to memory of 2156	2660	z6417688.exe	r6200092.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2716	2156	r6200092.exe	AppLaunch.exe
PID 2156 wrote to memory of 2504	2156	r6200092.exe	WerFault.exe
PID 2156 wrote to memory of 2504	2156	r6200092.exe	WerFault.exe
PID 2156 wrote to memory of 2504	2156	r6200092.exe	WerFault.exe
PID 2156 wrote to memory of 2504	2156	r6200092.exe	WerFault.exe
PID 2156 wrote to memory of 2504	2156	r6200092.exe	WerFault.exe
PID 2156 wrote to memory of 2504	2156	r6200092.exe	WerFault.exe
PID 2156 wrote to memory of 2504	2156	r6200092.exe	WerFault.exe
PID 2716 wrote to memory of 2560	2716	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2108

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0923342.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0923342.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2080

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4449250.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4449250.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2200

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6363428.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6363428.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6417688.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6417688.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2660

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe
6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 268
8⤵
- Program crash
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 276
7⤵
- Loads dropped DLL
- Program crash
PID:2504

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0923342.exe
Filesize
972KB

MD5
85a7008f4d4b9cab05c2b04fbc31ad05

SHA1
c4b562ded0e81b4e38231f081e88bf70ed0404fb

SHA256
3989382da62ab9aaee35d880f8e92c91d401f511b082d53bbbc1cc1d966a3bee

SHA512
171d7fb168a1784d8ff5add19f2f435c3a0d3d20e20ca522a0d7643d28e01ef35abd111f7699b3c3fad4a282b359ad331e09a7e0125770ff24d99244a7ff9c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0923342.exe
Filesize
972KB

MD5
85a7008f4d4b9cab05c2b04fbc31ad05

SHA1
c4b562ded0e81b4e38231f081e88bf70ed0404fb

SHA256
3989382da62ab9aaee35d880f8e92c91d401f511b082d53bbbc1cc1d966a3bee

SHA512
171d7fb168a1784d8ff5add19f2f435c3a0d3d20e20ca522a0d7643d28e01ef35abd111f7699b3c3fad4a282b359ad331e09a7e0125770ff24d99244a7ff9c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4449250.exe
Filesize
789KB

MD5
5f1ab4d5e0f97902418487aea7709077

SHA1
91dc26174d12b967c3c925c908a6a0973a9cb453

SHA256
6f44cdc3d9d28d76b86c42546897abcd488cd2f1e42ad326ac352ab040b1e6e7

SHA512
727d88dd08b89ac39b6177a2e66a780cc5ca21b6b2ceafb2fcef780497974546b448d5a6183b36e17b448827d7badfb633fe0f124abf0f3c33b29c5c62f122d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4449250.exe
Filesize
789KB

MD5
5f1ab4d5e0f97902418487aea7709077

SHA1
91dc26174d12b967c3c925c908a6a0973a9cb453

SHA256
6f44cdc3d9d28d76b86c42546897abcd488cd2f1e42ad326ac352ab040b1e6e7

SHA512
727d88dd08b89ac39b6177a2e66a780cc5ca21b6b2ceafb2fcef780497974546b448d5a6183b36e17b448827d7badfb633fe0f124abf0f3c33b29c5c62f122d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6363428.exe
Filesize
606KB

MD5
fb14dc2b317a0606e03c69889c1dd9d0

SHA1
98798ee8d3c79d23a5a25c328c31f11d725ad2a3

SHA256
bdcc2db4100bc8274314d7a0451764af86ef000cddb9e6b646ca7c5baf2298a6

SHA512
0cf01ad1e38a06e34f0b91fbce66a651df9cfd247ef2345db1626f644c71cf906b71808b341214eb403044b8a25ed87875c0d6a233be2b1cef94491a2bd12eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6363428.exe
Filesize
606KB

MD5
fb14dc2b317a0606e03c69889c1dd9d0

SHA1
98798ee8d3c79d23a5a25c328c31f11d725ad2a3

SHA256
bdcc2db4100bc8274314d7a0451764af86ef000cddb9e6b646ca7c5baf2298a6

SHA512
0cf01ad1e38a06e34f0b91fbce66a651df9cfd247ef2345db1626f644c71cf906b71808b341214eb403044b8a25ed87875c0d6a233be2b1cef94491a2bd12eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6417688.exe
Filesize
335KB

MD5
123211f586f2e7e7d8729d982517c0e1

SHA1
bbf2502418896ad439ba7ba1f56662303c9f0b26

SHA256
3c53378e9cee418fe73a5c74947882dffe79ddc536e67c7387db634b16793825

SHA512
97c0c114b891740653d16bbd90724a7a915fed3ba625a71f0ec49d2d2e81bd513cb7ff86d0c0a67b4949f464e4c67e48e07fc5ae84b3ab311a8dbe9394b559ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6417688.exe
Filesize
335KB

MD5
123211f586f2e7e7d8729d982517c0e1

SHA1
bbf2502418896ad439ba7ba1f56662303c9f0b26

SHA256
3c53378e9cee418fe73a5c74947882dffe79ddc536e67c7387db634b16793825

SHA512
97c0c114b891740653d16bbd90724a7a915fed3ba625a71f0ec49d2d2e81bd513cb7ff86d0c0a67b4949f464e4c67e48e07fc5ae84b3ab311a8dbe9394b559ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe
Filesize
11KB

MD5
f30d06fd5f5aff12cf50f850bd7aeaf2

SHA1
048dd0d1f82fd02edd858d722f51255e7b6a93ac

SHA256
166fff7e2ac9ca6040feb8699ce165b0701046ce3f43be90d1a12e48c6434358

SHA512
1f692964f390b3735011b336ec061e432156a76cab0128988e7ec48afae03af09bf1e2a42ad84d9316cb773837505ef4250c80f2480e86b66a01e6b18853b37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe
Filesize
11KB

MD5
f30d06fd5f5aff12cf50f850bd7aeaf2

SHA1
048dd0d1f82fd02edd858d722f51255e7b6a93ac

SHA256
166fff7e2ac9ca6040feb8699ce165b0701046ce3f43be90d1a12e48c6434358

SHA512
1f692964f390b3735011b336ec061e432156a76cab0128988e7ec48afae03af09bf1e2a42ad84d9316cb773837505ef4250c80f2480e86b66a01e6b18853b37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0923342.exe
Filesize
972KB

MD5
85a7008f4d4b9cab05c2b04fbc31ad05

SHA1
c4b562ded0e81b4e38231f081e88bf70ed0404fb

SHA256
3989382da62ab9aaee35d880f8e92c91d401f511b082d53bbbc1cc1d966a3bee

SHA512
171d7fb168a1784d8ff5add19f2f435c3a0d3d20e20ca522a0d7643d28e01ef35abd111f7699b3c3fad4a282b359ad331e09a7e0125770ff24d99244a7ff9c97

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0923342.exe
Filesize
972KB

MD5
85a7008f4d4b9cab05c2b04fbc31ad05

SHA1
c4b562ded0e81b4e38231f081e88bf70ed0404fb

SHA256
3989382da62ab9aaee35d880f8e92c91d401f511b082d53bbbc1cc1d966a3bee

SHA512
171d7fb168a1784d8ff5add19f2f435c3a0d3d20e20ca522a0d7643d28e01ef35abd111f7699b3c3fad4a282b359ad331e09a7e0125770ff24d99244a7ff9c97

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4449250.exe
Filesize
789KB

MD5
5f1ab4d5e0f97902418487aea7709077

SHA1
91dc26174d12b967c3c925c908a6a0973a9cb453

SHA256
6f44cdc3d9d28d76b86c42546897abcd488cd2f1e42ad326ac352ab040b1e6e7

SHA512
727d88dd08b89ac39b6177a2e66a780cc5ca21b6b2ceafb2fcef780497974546b448d5a6183b36e17b448827d7badfb633fe0f124abf0f3c33b29c5c62f122d8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4449250.exe
Filesize
789KB

MD5
5f1ab4d5e0f97902418487aea7709077

SHA1
91dc26174d12b967c3c925c908a6a0973a9cb453

SHA256
6f44cdc3d9d28d76b86c42546897abcd488cd2f1e42ad326ac352ab040b1e6e7

SHA512
727d88dd08b89ac39b6177a2e66a780cc5ca21b6b2ceafb2fcef780497974546b448d5a6183b36e17b448827d7badfb633fe0f124abf0f3c33b29c5c62f122d8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6363428.exe
Filesize
606KB

MD5
fb14dc2b317a0606e03c69889c1dd9d0

SHA1
98798ee8d3c79d23a5a25c328c31f11d725ad2a3

SHA256
bdcc2db4100bc8274314d7a0451764af86ef000cddb9e6b646ca7c5baf2298a6

SHA512
0cf01ad1e38a06e34f0b91fbce66a651df9cfd247ef2345db1626f644c71cf906b71808b341214eb403044b8a25ed87875c0d6a233be2b1cef94491a2bd12eec

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6363428.exe
Filesize
606KB

MD5
fb14dc2b317a0606e03c69889c1dd9d0

SHA1
98798ee8d3c79d23a5a25c328c31f11d725ad2a3

SHA256
bdcc2db4100bc8274314d7a0451764af86ef000cddb9e6b646ca7c5baf2298a6

SHA512
0cf01ad1e38a06e34f0b91fbce66a651df9cfd247ef2345db1626f644c71cf906b71808b341214eb403044b8a25ed87875c0d6a233be2b1cef94491a2bd12eec

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6417688.exe
Filesize
335KB

MD5
123211f586f2e7e7d8729d982517c0e1

SHA1
bbf2502418896ad439ba7ba1f56662303c9f0b26

SHA256
3c53378e9cee418fe73a5c74947882dffe79ddc536e67c7387db634b16793825

SHA512
97c0c114b891740653d16bbd90724a7a915fed3ba625a71f0ec49d2d2e81bd513cb7ff86d0c0a67b4949f464e4c67e48e07fc5ae84b3ab311a8dbe9394b559ee

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6417688.exe
Filesize
335KB

MD5
123211f586f2e7e7d8729d982517c0e1

SHA1
bbf2502418896ad439ba7ba1f56662303c9f0b26

SHA256
3c53378e9cee418fe73a5c74947882dffe79ddc536e67c7387db634b16793825

SHA512
97c0c114b891740653d16bbd90724a7a915fed3ba625a71f0ec49d2d2e81bd513cb7ff86d0c0a67b4949f464e4c67e48e07fc5ae84b3ab311a8dbe9394b559ee

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7553627.exe
Filesize
11KB

MD5
f30d06fd5f5aff12cf50f850bd7aeaf2

SHA1
048dd0d1f82fd02edd858d722f51255e7b6a93ac

SHA256
166fff7e2ac9ca6040feb8699ce165b0701046ce3f43be90d1a12e48c6434358

SHA512
1f692964f390b3735011b336ec061e432156a76cab0128988e7ec48afae03af09bf1e2a42ad84d9316cb773837505ef4250c80f2480e86b66a01e6b18853b37a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6200092.exe
Filesize
356KB

MD5
2e26324e6bc278a965bc4c9bb90d340c

SHA1
51b40440965c1de24f6aac349221ee6ba9612601

SHA256
44b7868fe3a50c7a63c14fafaac27a7bd1abc27bd28698c11b02ef2533050150

SHA512
bc50e3b15f108b0ae948c1b5f5b6d2c14a39747063ecd0531824894363acf2b6257b6925c95b3151629092531183e032fa76f76eced0ceaec09c43f52c786b7a

Download Submit
memory/2664-49-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-51-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-48-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/2664-50-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2716-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-70-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-72-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2716-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads