Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-1703_x64
  • resource
    win10-20230831-en
  • resource tags

    arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/10/2023, 12:17

General

  • Target

    dbce6bdd247474179db59137515436785eb03193f2ef51244d62b1d5762fd933.exe

  • Size

    1.4MB

  • MD5

    54c65e90d811108be950f37a489ea6fe

  • SHA1

    5e040f2eaa3e149e9e0e48ea83a96d1757b33fd2

  • SHA256

    dbce6bdd247474179db59137515436785eb03193f2ef51244d62b1d5762fd933

  • SHA512

    f5cdb7828b7efd20474fd459974d8760b4063b2b07258f07dd34a011672f0864a504165c07e5fbf5e377138335530bc79f04c23fae830978661e1854a6fb5ebd

  • SSDEEP

    24576:eypkM321g5jPOFwQ4Ts+NMztQMV05hKWGcN1aAID8yuRpPdq5JQPk/9w3Zqw+6Cy:tpki24GFwQcsdQU0TK5cN4nDQRpPdEM7

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbce6bdd247474179db59137515436785eb03193f2ef51244d62b1d5762fd933.exe
    "C:\Users\Admin\AppData\Local\Temp\dbce6bdd247474179db59137515436785eb03193f2ef51244d62b1d5762fd933.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qZ0oP60.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qZ0oP60.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yj1Cc63.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yj1Cc63.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zZ4Lp23.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zZ4Lp23.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hi22Qx2.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hi22Qx2.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:372
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vK2667.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vK2667.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2320
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:4416
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                  PID:4212
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 568
                    7⤵
                    • Program crash
                    PID:716
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 592
                  6⤵
                  • Program crash
                  PID:4272

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qZ0oP60.exe

              Filesize

              1.3MB

              MD5

              468473d6f1a2d1fbb8c07b307215108f

              SHA1

              520bb733551505f6020578a7584e74505f01cb49

              SHA256

              fff34c3f782bf2415ef118ce318ad4fc805c995b15eace0a7463341d5195ca58

              SHA512

              175b868fe33fc9600b5ba939c2e83ade7cc6eba038f473ce57875428a965090581797b1ac3eeac1a98db77b5d948904d49318bf8c2aabf2ef1d4c0c930379473

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qZ0oP60.exe

              Filesize

              1.3MB

              MD5

              468473d6f1a2d1fbb8c07b307215108f

              SHA1

              520bb733551505f6020578a7584e74505f01cb49

              SHA256

              fff34c3f782bf2415ef118ce318ad4fc805c995b15eace0a7463341d5195ca58

              SHA512

              175b868fe33fc9600b5ba939c2e83ade7cc6eba038f473ce57875428a965090581797b1ac3eeac1a98db77b5d948904d49318bf8c2aabf2ef1d4c0c930379473

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yj1Cc63.exe

              Filesize

              875KB

              MD5

              43163cc4a6a39df696c8d1c207c54ee5

              SHA1

              49d58dcda045fd084f02bfb257ef26671e0c049a

              SHA256

              baaea239b204bbbc3ad578082ec43226bb577f85f924bf3a68c1d6d452ff1e7f

              SHA512

              9c8d1318d7342a5303e70458cf131dc02740ba415759420f4516dca7b2906518cf4555d4d87ff278fb5e54d6ed2404ed29f81ced8e3b3da7535c16260d13762b

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yj1Cc63.exe

              Filesize

              875KB

              MD5

              43163cc4a6a39df696c8d1c207c54ee5

              SHA1

              49d58dcda045fd084f02bfb257ef26671e0c049a

              SHA256

              baaea239b204bbbc3ad578082ec43226bb577f85f924bf3a68c1d6d452ff1e7f

              SHA512

              9c8d1318d7342a5303e70458cf131dc02740ba415759420f4516dca7b2906518cf4555d4d87ff278fb5e54d6ed2404ed29f81ced8e3b3da7535c16260d13762b

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zZ4Lp23.exe

              Filesize

              489KB

              MD5

              64bca51ecff153f709b0cc24dd7c4b93

              SHA1

              2aa7c15f7026208977f7fb29eedc0d5545a0ff5c

              SHA256

              19ea671822598b6a024be776a8478072818957e2ce7a3b5d3de15b4096b5d30f

              SHA512

              4c12360966db4e8ecf51461df2d21022e51875f558e64944bbe64d0cdca5722a0e25fa36d02ea8b6fecdb9f60d99197eff98bcfb8bf05b85dff2389c6eb6c3a9

            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zZ4Lp23.exe

              Filesize

              489KB

              MD5

              64bca51ecff153f709b0cc24dd7c4b93

              SHA1

              2aa7c15f7026208977f7fb29eedc0d5545a0ff5c

              SHA256

              19ea671822598b6a024be776a8478072818957e2ce7a3b5d3de15b4096b5d30f

              SHA512

              4c12360966db4e8ecf51461df2d21022e51875f558e64944bbe64d0cdca5722a0e25fa36d02ea8b6fecdb9f60d99197eff98bcfb8bf05b85dff2389c6eb6c3a9

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hi22Qx2.exe

              Filesize

              21KB

              MD5

              e2c620e42d157ad9c02ec84dbae97201

              SHA1

              e30c848655af00953fdb31a4eafc3cfdcaaea064

              SHA256

              056b2870ff956c76d100ccf4a6d7ea1c9b7aed9ca7e993ec52b6e8f1f6eb03b7

              SHA512

              dd3be5c7320ec692f111b91622908a3cea601baf036684fe3251cddb9f9f7ed2977d6baef781beb4ff2570671ca1ce8b0031bc5a2f95a52858bdf19cc0383521

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hi22Qx2.exe

              Filesize

              21KB

              MD5

              e2c620e42d157ad9c02ec84dbae97201

              SHA1

              e30c848655af00953fdb31a4eafc3cfdcaaea064

              SHA256

              056b2870ff956c76d100ccf4a6d7ea1c9b7aed9ca7e993ec52b6e8f1f6eb03b7

              SHA512

              dd3be5c7320ec692f111b91622908a3cea601baf036684fe3251cddb9f9f7ed2977d6baef781beb4ff2570671ca1ce8b0031bc5a2f95a52858bdf19cc0383521

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vK2667.exe

              Filesize

              1.4MB

              MD5

              dc3ed8d7ff3799e6d004415d44ab9355

              SHA1

              650eed74c34700f96cdd1181023809c4020e9687

              SHA256

              d076ba245e680b4423222ebbbc65424c6f0119f5b428e89cd61030282683c276

              SHA512

              0dcefad4327b6eb04bba4e1ac6b29d4244463b7c1a1e104ef9f1a5f77e8ed18354787912c970e6dc02b7bdec3d9f7584bff5609066906312c2a540921032666e

            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2vK2667.exe

              Filesize

              1.4MB

              MD5

              dc3ed8d7ff3799e6d004415d44ab9355

              SHA1

              650eed74c34700f96cdd1181023809c4020e9687

              SHA256

              d076ba245e680b4423222ebbbc65424c6f0119f5b428e89cd61030282683c276

              SHA512

              0dcefad4327b6eb04bba4e1ac6b29d4244463b7c1a1e104ef9f1a5f77e8ed18354787912c970e6dc02b7bdec3d9f7584bff5609066906312c2a540921032666e

            • memory/372-31-0x00007FF9DB3D0000-0x00007FF9DBDBC000-memory.dmp

              Filesize

              9.9MB

            • memory/372-29-0x00007FF9DB3D0000-0x00007FF9DBDBC000-memory.dmp

              Filesize

              9.9MB

            • memory/372-28-0x0000000000010000-0x000000000001A000-memory.dmp

              Filesize

              40KB

            • memory/4212-35-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/4212-38-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/4212-39-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/4212-41-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB