Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2023, 02:13

General

  • Target

    file.exe

  • Size

    877KB

  • MD5

    9b49cf8b9e480a542f92f31006c2d61a

  • SHA1

    3e2f373b790dce0536c285064b98d15c2e6969b4

  • SHA256

    4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6

  • SHA512

    a240dc3cf90f2795c1fda4a23ec86686eb289f4103ba017120474cf1b8006dd76da88c68dccc47edf802d695c9aaa09baa19ba50f6ce7b4a7d67ac4c0aff5817

  • SSDEEP

    24576:uyORQtsdF5FILP1ft8wo8+Tv5HN/8qTp+tl9bZ:9Ri1QWJ5NUGGb

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 4 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bw1Vp89.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bw1Vp89.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2840
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qj66VM8.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qj66VM8.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2836
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2940
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2468
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 268
                7⤵
                • Program crash
                PID:3068
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2916

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe

          Filesize

          737KB

          MD5

          e9de7c1ed23f83aac308a82fe21266b1

          SHA1

          6afa0916092f7f0013a7b75c6dd7394ec411b3bf

          SHA256

          cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361

          SHA512

          a793ba52f282d2552c8b55c7fbfdfd8ed48d7c6340325d73416b0172e7e383d9864871d376b6152c90790f66a21bdeca1fc6c4c449be5e267a42bc3878a2e6f1

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe

          Filesize

          737KB

          MD5

          e9de7c1ed23f83aac308a82fe21266b1

          SHA1

          6afa0916092f7f0013a7b75c6dd7394ec411b3bf

          SHA256

          cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361

          SHA512

          a793ba52f282d2552c8b55c7fbfdfd8ed48d7c6340325d73416b0172e7e383d9864871d376b6152c90790f66a21bdeca1fc6c4c449be5e267a42bc3878a2e6f1

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe

          Filesize

          490KB

          MD5

          fb3e3b41fe0ff262d86383e427d467e9

          SHA1

          15bf8db9b30a6fcfac22bc41ac3e6df14bd207eb

          SHA256

          c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d

          SHA512

          f1a789862ae668cc8fc7ac7bcd658ec0b0a36f0ab5992adde481c586253188daf3830e8deea1edc5b56b962175862518c36f9c58eb0dd8f3d365fe103e8b1ee0

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe

          Filesize

          490KB

          MD5

          fb3e3b41fe0ff262d86383e427d467e9

          SHA1

          15bf8db9b30a6fcfac22bc41ac3e6df14bd207eb

          SHA256

          c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d

          SHA512

          f1a789862ae668cc8fc7ac7bcd658ec0b0a36f0ab5992adde481c586253188daf3830e8deea1edc5b56b962175862518c36f9c58eb0dd8f3d365fe103e8b1ee0

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bw1Vp89.exe

          Filesize

          293KB

          MD5

          84686a6a53962be5e0c5b2cc4250ae18

          SHA1

          b4e5084aa9d8905ee16644416791f63b24865551

          SHA256

          f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04

          SHA512

          e82567fa15444bee27237394909ecc99bfbff7392732517e4088fb02bacf6327e208689f6961bcc71e4b9e4314aa96cf3470e3ee1ff1262b78fb7cff37d3fc86

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Bw1Vp89.exe

          Filesize

          293KB

          MD5

          84686a6a53962be5e0c5b2cc4250ae18

          SHA1

          b4e5084aa9d8905ee16644416791f63b24865551

          SHA256

          f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04

          SHA512

          e82567fa15444bee27237394909ecc99bfbff7392732517e4088fb02bacf6327e208689f6961bcc71e4b9e4314aa96cf3470e3ee1ff1262b78fb7cff37d3fc86

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qj66VM8.exe

          Filesize

          12KB

          MD5

          4a752f97d75f29669c54bf062925047c

          SHA1

          56693f407d8daaef473dc405d40818267e08e939

          SHA256

          0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18

          SHA512

          a6c3d95ff02f2c75a94df75bfc970f5455cdc226dfbb2e42a9352e845f0c03bfd388769b90dbf64bf4e905116f27d9ea9443bd334a4a09d343cc28b7a3cbd458

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qj66VM8.exe

          Filesize

          12KB

          MD5

          4a752f97d75f29669c54bf062925047c

          SHA1

          56693f407d8daaef473dc405d40818267e08e939

          SHA256

          0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18

          SHA512

          a6c3d95ff02f2c75a94df75bfc970f5455cdc226dfbb2e42a9352e845f0c03bfd388769b90dbf64bf4e905116f27d9ea9443bd334a4a09d343cc28b7a3cbd458

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe

          Filesize

          737KB

          MD5

          e9de7c1ed23f83aac308a82fe21266b1

          SHA1

          6afa0916092f7f0013a7b75c6dd7394ec411b3bf

          SHA256

          cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361

          SHA512

          a793ba52f282d2552c8b55c7fbfdfd8ed48d7c6340325d73416b0172e7e383d9864871d376b6152c90790f66a21bdeca1fc6c4c449be5e267a42bc3878a2e6f1

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ei4JY63.exe

          Filesize

          737KB

          MD5

          e9de7c1ed23f83aac308a82fe21266b1

          SHA1

          6afa0916092f7f0013a7b75c6dd7394ec411b3bf

          SHA256

          cfebc287dd09c37454dc8ef07248ea19bcda285e1d8b56fa6b362079bb707361

          SHA512

          a793ba52f282d2552c8b55c7fbfdfd8ed48d7c6340325d73416b0172e7e383d9864871d376b6152c90790f66a21bdeca1fc6c4c449be5e267a42bc3878a2e6f1

        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe

          Filesize

          490KB

          MD5

          fb3e3b41fe0ff262d86383e427d467e9

          SHA1

          15bf8db9b30a6fcfac22bc41ac3e6df14bd207eb

          SHA256

          c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d

          SHA512

          f1a789862ae668cc8fc7ac7bcd658ec0b0a36f0ab5992adde481c586253188daf3830e8deea1edc5b56b962175862518c36f9c58eb0dd8f3d365fe103e8b1ee0

        • \Users\Admin\AppData\Local\Temp\IXP001.TMP\BC6EJ61.exe

          Filesize

          490KB

          MD5

          fb3e3b41fe0ff262d86383e427d467e9

          SHA1

          15bf8db9b30a6fcfac22bc41ac3e6df14bd207eb

          SHA256

          c021f998077b73bdbf8588ff4135c64c286e9e9827ff9944e24b7f974f45f38d

          SHA512

          f1a789862ae668cc8fc7ac7bcd658ec0b0a36f0ab5992adde481c586253188daf3830e8deea1edc5b56b962175862518c36f9c58eb0dd8f3d365fe103e8b1ee0

        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Bw1Vp89.exe

          Filesize

          293KB

          MD5

          84686a6a53962be5e0c5b2cc4250ae18

          SHA1

          b4e5084aa9d8905ee16644416791f63b24865551

          SHA256

          f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04

          SHA512

          e82567fa15444bee27237394909ecc99bfbff7392732517e4088fb02bacf6327e208689f6961bcc71e4b9e4314aa96cf3470e3ee1ff1262b78fb7cff37d3fc86

        • \Users\Admin\AppData\Local\Temp\IXP002.TMP\Bw1Vp89.exe

          Filesize

          293KB

          MD5

          84686a6a53962be5e0c5b2cc4250ae18

          SHA1

          b4e5084aa9d8905ee16644416791f63b24865551

          SHA256

          f3279f6bc69ed3e8803d117fe1321cb5b3220b33c2cf0b8635f85d721f01fa04

          SHA512

          e82567fa15444bee27237394909ecc99bfbff7392732517e4088fb02bacf6327e208689f6961bcc71e4b9e4314aa96cf3470e3ee1ff1262b78fb7cff37d3fc86

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1Qj66VM8.exe

          Filesize

          12KB

          MD5

          4a752f97d75f29669c54bf062925047c

          SHA1

          56693f407d8daaef473dc405d40818267e08e939

          SHA256

          0f4d1a073bc226a68cab0d85d13bd40d5b914afb4b22f5b02fbf059cbede1d18

          SHA512

          a6c3d95ff02f2c75a94df75bfc970f5455cdc226dfbb2e42a9352e845f0c03bfd388769b90dbf64bf4e905116f27d9ea9443bd334a4a09d343cc28b7a3cbd458

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ix4962.exe

          Filesize

          285KB

          MD5

          f27c15e48f36181b4d16d9188bcd6d65

          SHA1

          3655a14775e7574f8fdefa4ab260b7efb267b5be

          SHA256

          bc51a7ca6c7de7c274743b0babc5308c6ff75d42b5fa53a6ddfd15e8dd08819d

          SHA512

          62a47929d8acc4102b9dd80b63a3c506fe6af7a20d16577113f83b947919651e063054d57f313565bfd36a11a701095a85440ad7c28d8b2ce812ef1593fef71c

        • memory/2468-52-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-49-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-50-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-51-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-48-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-53-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-54-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

        • memory/2468-55-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-57-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2468-59-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2836-41-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

          Filesize

          9.9MB

        • memory/2836-40-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

          Filesize

          9.9MB

        • memory/2836-39-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

          Filesize

          9.9MB

        • memory/2836-38-0x0000000000D90000-0x0000000000D9A000-memory.dmp

          Filesize

          40KB