Analysis

  • max time kernel
    122s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2023 05:10

General

  • Target

    3f5cb0eeac53c01f4258f91f34a7e84e27e3d6aa9d56be8bbe781dff8aff63f0.exe

  • Size

    1.1MB

  • MD5

    6fe47cdf23978732c9edebe55a137fdc

  • SHA1

    2393ab0f73ee6c80d79a17675e77e11c11e12365

  • SHA256

    3f5cb0eeac53c01f4258f91f34a7e84e27e3d6aa9d56be8bbe781dff8aff63f0

  • SHA512

    1b84a5719892d3527e20481dcac97a70991d2b631938790fef0ef0bc714a80b03741b31a234b1b1416da9c794ea5be0293c4d14a2c6f6a854ff8e2af2fe1c8ad

  • SSDEEP

    24576:NyeunRKftl42pw7uuzE0jCl+jG7Hz01ef1/CwNr6yP6/:ojnof342pw79EuCUjkI1AhCwNeyP6

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f5cb0eeac53c01f4258f91f34a7e84e27e3d6aa9d56be8bbe781dff8aff63f0.exe
    "C:\Users\Admin\AppData\Local\Temp\3f5cb0eeac53c01f4258f91f34a7e84e27e3d6aa9d56be8bbe781dff8aff63f0.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4103137.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4103137.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2478712.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2478712.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2948128.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2948128.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9188688.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9188688.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2516
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1700
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2500
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 276
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4103137.exe

    Filesize

    983KB

    MD5

    cb088bfae36547132cfd6cbd4f766ed0

    SHA1

    02b12c50a060a0dc452a6c3c27b0cfd3983d52e0

    SHA256

    c7a48c9add10d606d5459f4eb7f3dfc80a7fa368c2a8b19fe27c158cf842e13c

    SHA512

    339520b194bebb424f2ffd26e83dcee56c11f7cf21c5c9dbf2246de2fe3a9a825c45cda1928bebd3827ad52d764e7af705f22f72c523e0ca35903a605bdc627c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4103137.exe

    Filesize

    983KB

    MD5

    cb088bfae36547132cfd6cbd4f766ed0

    SHA1

    02b12c50a060a0dc452a6c3c27b0cfd3983d52e0

    SHA256

    c7a48c9add10d606d5459f4eb7f3dfc80a7fa368c2a8b19fe27c158cf842e13c

    SHA512

    339520b194bebb424f2ffd26e83dcee56c11f7cf21c5c9dbf2246de2fe3a9a825c45cda1928bebd3827ad52d764e7af705f22f72c523e0ca35903a605bdc627c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2478712.exe

    Filesize

    800KB

    MD5

    c68e5dca1bb79060be344490b304eb52

    SHA1

    22c043bfc1436ac8f0cdcb5fc585b9dad88fa8a0

    SHA256

    53ec63d8642dee463b3891343b490075b94f40c5e5c908d10f6d019e24fe11ce

    SHA512

    d717fe845cbb85701442048d2188b086695af52a25a21ceec2ff334f09a8f65ea8f23e36b4d977acb4e87963cc18b8bbed1591cad79ee840636c280c9b587f9a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2478712.exe

    Filesize

    800KB

    MD5

    c68e5dca1bb79060be344490b304eb52

    SHA1

    22c043bfc1436ac8f0cdcb5fc585b9dad88fa8a0

    SHA256

    53ec63d8642dee463b3891343b490075b94f40c5e5c908d10f6d019e24fe11ce

    SHA512

    d717fe845cbb85701442048d2188b086695af52a25a21ceec2ff334f09a8f65ea8f23e36b4d977acb4e87963cc18b8bbed1591cad79ee840636c280c9b587f9a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2948128.exe

    Filesize

    617KB

    MD5

    9295c8ed09486582257dd5aac337d01a

    SHA1

    5205e92edf8c7be3eb1b9f6c201ef9cf8d152e35

    SHA256

    d47a0e74439686157c5df59bebdca1191610cef8512a51b6cb7afd39378cdfa4

    SHA512

    2cf36d98347dd98204143a484200199fe8d09df90084867532536c76e47d1b4a6b29bf6dba7c0611fff56e9a0c266480e83c7ae4b229f02e276a9ef6dbb1a535

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2948128.exe

    Filesize

    617KB

    MD5

    9295c8ed09486582257dd5aac337d01a

    SHA1

    5205e92edf8c7be3eb1b9f6c201ef9cf8d152e35

    SHA256

    d47a0e74439686157c5df59bebdca1191610cef8512a51b6cb7afd39378cdfa4

    SHA512

    2cf36d98347dd98204143a484200199fe8d09df90084867532536c76e47d1b4a6b29bf6dba7c0611fff56e9a0c266480e83c7ae4b229f02e276a9ef6dbb1a535

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9188688.exe

    Filesize

    346KB

    MD5

    e57402ca1a3b3dbc7c0d4ec0ea58930a

    SHA1

    3029be79e59ad52ff5858ea533e6feb3738c3c6d

    SHA256

    da0c644f3049b66316ac87bc3f30660ead507b4954c90ee85b1968a58a697cdb

    SHA512

    a4d581c963ced67f8e2b2e7dafa58e6bb1b59b182c1c77ab33821246e492ea46e740e53ce6ea26e866dd45d912e86f64555bcfa8cf41ce690bbfad874ba9b668

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9188688.exe

    Filesize

    346KB

    MD5

    e57402ca1a3b3dbc7c0d4ec0ea58930a

    SHA1

    3029be79e59ad52ff5858ea533e6feb3738c3c6d

    SHA256

    da0c644f3049b66316ac87bc3f30660ead507b4954c90ee85b1968a58a697cdb

    SHA512

    a4d581c963ced67f8e2b2e7dafa58e6bb1b59b182c1c77ab33821246e492ea46e740e53ce6ea26e866dd45d912e86f64555bcfa8cf41ce690bbfad874ba9b668

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z4103137.exe

    Filesize

    983KB

    MD5

    cb088bfae36547132cfd6cbd4f766ed0

    SHA1

    02b12c50a060a0dc452a6c3c27b0cfd3983d52e0

    SHA256

    c7a48c9add10d606d5459f4eb7f3dfc80a7fa368c2a8b19fe27c158cf842e13c

    SHA512

    339520b194bebb424f2ffd26e83dcee56c11f7cf21c5c9dbf2246de2fe3a9a825c45cda1928bebd3827ad52d764e7af705f22f72c523e0ca35903a605bdc627c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z4103137.exe

    Filesize

    983KB

    MD5

    cb088bfae36547132cfd6cbd4f766ed0

    SHA1

    02b12c50a060a0dc452a6c3c27b0cfd3983d52e0

    SHA256

    c7a48c9add10d606d5459f4eb7f3dfc80a7fa368c2a8b19fe27c158cf842e13c

    SHA512

    339520b194bebb424f2ffd26e83dcee56c11f7cf21c5c9dbf2246de2fe3a9a825c45cda1928bebd3827ad52d764e7af705f22f72c523e0ca35903a605bdc627c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z2478712.exe

    Filesize

    800KB

    MD5

    c68e5dca1bb79060be344490b304eb52

    SHA1

    22c043bfc1436ac8f0cdcb5fc585b9dad88fa8a0

    SHA256

    53ec63d8642dee463b3891343b490075b94f40c5e5c908d10f6d019e24fe11ce

    SHA512

    d717fe845cbb85701442048d2188b086695af52a25a21ceec2ff334f09a8f65ea8f23e36b4d977acb4e87963cc18b8bbed1591cad79ee840636c280c9b587f9a

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z2478712.exe

    Filesize

    800KB

    MD5

    c68e5dca1bb79060be344490b304eb52

    SHA1

    22c043bfc1436ac8f0cdcb5fc585b9dad88fa8a0

    SHA256

    53ec63d8642dee463b3891343b490075b94f40c5e5c908d10f6d019e24fe11ce

    SHA512

    d717fe845cbb85701442048d2188b086695af52a25a21ceec2ff334f09a8f65ea8f23e36b4d977acb4e87963cc18b8bbed1591cad79ee840636c280c9b587f9a

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z2948128.exe

    Filesize

    617KB

    MD5

    9295c8ed09486582257dd5aac337d01a

    SHA1

    5205e92edf8c7be3eb1b9f6c201ef9cf8d152e35

    SHA256

    d47a0e74439686157c5df59bebdca1191610cef8512a51b6cb7afd39378cdfa4

    SHA512

    2cf36d98347dd98204143a484200199fe8d09df90084867532536c76e47d1b4a6b29bf6dba7c0611fff56e9a0c266480e83c7ae4b229f02e276a9ef6dbb1a535

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z2948128.exe

    Filesize

    617KB

    MD5

    9295c8ed09486582257dd5aac337d01a

    SHA1

    5205e92edf8c7be3eb1b9f6c201ef9cf8d152e35

    SHA256

    d47a0e74439686157c5df59bebdca1191610cef8512a51b6cb7afd39378cdfa4

    SHA512

    2cf36d98347dd98204143a484200199fe8d09df90084867532536c76e47d1b4a6b29bf6dba7c0611fff56e9a0c266480e83c7ae4b229f02e276a9ef6dbb1a535

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z9188688.exe

    Filesize

    346KB

    MD5

    e57402ca1a3b3dbc7c0d4ec0ea58930a

    SHA1

    3029be79e59ad52ff5858ea533e6feb3738c3c6d

    SHA256

    da0c644f3049b66316ac87bc3f30660ead507b4954c90ee85b1968a58a697cdb

    SHA512

    a4d581c963ced67f8e2b2e7dafa58e6bb1b59b182c1c77ab33821246e492ea46e740e53ce6ea26e866dd45d912e86f64555bcfa8cf41ce690bbfad874ba9b668

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z9188688.exe

    Filesize

    346KB

    MD5

    e57402ca1a3b3dbc7c0d4ec0ea58930a

    SHA1

    3029be79e59ad52ff5858ea533e6feb3738c3c6d

    SHA256

    da0c644f3049b66316ac87bc3f30660ead507b4954c90ee85b1968a58a697cdb

    SHA512

    a4d581c963ced67f8e2b2e7dafa58e6bb1b59b182c1c77ab33821246e492ea46e740e53ce6ea26e866dd45d912e86f64555bcfa8cf41ce690bbfad874ba9b668

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q3304067.exe

    Filesize

    227KB

    MD5

    86e2e2104afba03781eb15b8379a8a48

    SHA1

    3e4bfb4a537963be01cd535a286ad04d1a2cd371

    SHA256

    fcfcb6c0392556a0c81d6436d29fc29d665f0417eb0a6b7c0c75d28a46a6a445

    SHA512

    865633a3838d24fa61321eaf80557e75d21c7cdcf141572ecb10fd0b0689985b4687e4c20579b9fd69876fbe78b9b054d070386398127ce6314c08fde3bcbea4

  • memory/2500-54-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2500-58-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2500-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2500-60-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2500-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2500-56-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2500-55-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2500-53-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB