healer | 3bf7c2acdcc95da081a14cb6fd66b3f936afbc79ff32225f7fbbe0501b2cd065

Analysis

max time kernel
118s
max time network
148s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe
Size

1.3MB
MD5

b2e1f1bd23cd1f68d6da95e5682d459e
SHA1

74bfa943a8925fdf078b2d1b57b48cc909ae3837
SHA256

cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce
SHA512

c7b95c533ac186ecfa37aa508a1dc1dd909c5d2d96e50e6cfdcbcdc51775e7c8acdaff2935673b34195c512ba7778f32e510de523c828f788c37ea8ce76a11cf
SSDEEP

24576:3yIHNXn8re9wAY8p69P6PlJHLaqeCcCGQ9rqqZOaByM5VXvA0leNk7T:CO98y9JY8pDJca9r7ZL5xvA0l2k7

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2508-55-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2508-60-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2508-58-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2508-56-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2508-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Executes dropped EXE 5 IoCs

Processes:

z1905635.exez7736370.exez0107694.exez9990717.exeq6454909.exe

pid process

2044 z1905635.exe
2652 z7736370.exe
2964 z0107694.exe
2644 z9990717.exe
2864 q6454909.exe

pid	process
2044	z1905635.exe
2652	z7736370.exe
2964	z0107694.exe
2644	z9990717.exe
2864	q6454909.exe

Loads dropped DLL 15 IoCs

Processes:

cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exez1905635.exez7736370.exez0107694.exez9990717.exeq6454909.exeWerFault.exe

pid	process
2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe
2044	z1905635.exe
2044	z1905635.exe
2652	z7736370.exe
2652	z7736370.exe
2964	z0107694.exe
2964	z0107694.exe
2644	z9990717.exe
2644	z9990717.exe
2644	z9990717.exe
2864	q6454909.exe
2568	WerFault.exe
2568	WerFault.exe
2568	WerFault.exe
2568	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exez1905635.exez7736370.exez0107694.exez9990717.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1905635.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z7736370.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0107694.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z9990717.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

q6454909.exe

description pid process target process

PID 2864 set thread context of 2508 2864 q6454909.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2568 2864 WerFault.exe q6454909.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2508 AppLaunch.exe
2508 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2508 AppLaunch.exe

description	pid	process	target process
PID 2864 set thread context of 2508	2864	q6454909.exe	AppLaunch.exe

pid	pid_target	process	target process
2568	2864	WerFault.exe	q6454909.exe

pid	process
2508	AppLaunch.exe
2508	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2508	AppLaunch.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exez1905635.exez7736370.exez0107694.exez9990717.exeq6454909.exe

description	pid	process	target process
PID 2440 wrote to memory of 2044	2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe	z1905635.exe
PID 2440 wrote to memory of 2044	2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe	z1905635.exe
PID 2440 wrote to memory of 2044	2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe	z1905635.exe
PID 2440 wrote to memory of 2044	2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe	z1905635.exe
PID 2440 wrote to memory of 2044	2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe	z1905635.exe
PID 2440 wrote to memory of 2044	2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe	z1905635.exe
PID 2440 wrote to memory of 2044	2440	cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe	z1905635.exe
PID 2044 wrote to memory of 2652	2044	z1905635.exe	z7736370.exe
PID 2044 wrote to memory of 2652	2044	z1905635.exe	z7736370.exe
PID 2044 wrote to memory of 2652	2044	z1905635.exe	z7736370.exe
PID 2044 wrote to memory of 2652	2044	z1905635.exe	z7736370.exe
PID 2044 wrote to memory of 2652	2044	z1905635.exe	z7736370.exe
PID 2044 wrote to memory of 2652	2044	z1905635.exe	z7736370.exe
PID 2044 wrote to memory of 2652	2044	z1905635.exe	z7736370.exe
PID 2652 wrote to memory of 2964	2652	z7736370.exe	z0107694.exe
PID 2652 wrote to memory of 2964	2652	z7736370.exe	z0107694.exe
PID 2652 wrote to memory of 2964	2652	z7736370.exe	z0107694.exe
PID 2652 wrote to memory of 2964	2652	z7736370.exe	z0107694.exe
PID 2652 wrote to memory of 2964	2652	z7736370.exe	z0107694.exe
PID 2652 wrote to memory of 2964	2652	z7736370.exe	z0107694.exe
PID 2652 wrote to memory of 2964	2652	z7736370.exe	z0107694.exe
PID 2964 wrote to memory of 2644	2964	z0107694.exe	z9990717.exe
PID 2964 wrote to memory of 2644	2964	z0107694.exe	z9990717.exe
PID 2964 wrote to memory of 2644	2964	z0107694.exe	z9990717.exe
PID 2964 wrote to memory of 2644	2964	z0107694.exe	z9990717.exe
PID 2964 wrote to memory of 2644	2964	z0107694.exe	z9990717.exe
PID 2964 wrote to memory of 2644	2964	z0107694.exe	z9990717.exe
PID 2964 wrote to memory of 2644	2964	z0107694.exe	z9990717.exe
PID 2644 wrote to memory of 2864	2644	z9990717.exe	q6454909.exe
PID 2644 wrote to memory of 2864	2644	z9990717.exe	q6454909.exe
PID 2644 wrote to memory of 2864	2644	z9990717.exe	q6454909.exe
PID 2644 wrote to memory of 2864	2644	z9990717.exe	q6454909.exe
PID 2644 wrote to memory of 2864	2644	z9990717.exe	q6454909.exe
PID 2644 wrote to memory of 2864	2644	z9990717.exe	q6454909.exe
PID 2644 wrote to memory of 2864	2644	z9990717.exe	q6454909.exe
PID 2864 wrote to memory of 2844	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2844	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2844	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2844	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2844	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2844	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2844	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2508	2864	q6454909.exe	AppLaunch.exe
PID 2864 wrote to memory of 2568	2864	q6454909.exe	WerFault.exe
PID 2864 wrote to memory of 2568	2864	q6454909.exe	WerFault.exe
PID 2864 wrote to memory of 2568	2864	q6454909.exe	WerFault.exe
PID 2864 wrote to memory of 2568	2864	q6454909.exe	WerFault.exe
PID 2864 wrote to memory of 2568	2864	q6454909.exe	WerFault.exe
PID 2864 wrote to memory of 2568	2864	q6454909.exe	WerFault.exe
PID 2864 wrote to memory of 2568	2864	q6454909.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe
"C:\Users\Admin\AppData\Local\Temp\cb123ce92b1e2d4cf313c5fd116c2eacd4acf7259b070847b186789e216957ce.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2652

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2964

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:2844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 280
7⤵
- Loads dropped DLL
- Program crash
PID:2568

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exe
Filesize
1.2MB

MD5
b199acaa8b22647f7b729661f94b58d9

SHA1
d27a58335e8aee061f60f8c5e31804e1a080efb5

SHA256
f5668e26afdc9e4c092ad0300ae695b1427cccd896d7aa93936e52b2b54cb357

SHA512
e7b07bbc489f62e93d7209e3ad6eec282f255dde3abcd623d0778041b5f9e16bc7d57ce9c12ccf153cc3f15924e9d9c79cbc95e2d275a677db950d523a4b2a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exe
Filesize
1.2MB

MD5
b199acaa8b22647f7b729661f94b58d9

SHA1
d27a58335e8aee061f60f8c5e31804e1a080efb5

SHA256
f5668e26afdc9e4c092ad0300ae695b1427cccd896d7aa93936e52b2b54cb357

SHA512
e7b07bbc489f62e93d7209e3ad6eec282f255dde3abcd623d0778041b5f9e16bc7d57ce9c12ccf153cc3f15924e9d9c79cbc95e2d275a677db950d523a4b2a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exe
Filesize
1.0MB

MD5
627b3d44cad6ab301149c6e6bbd06c81

SHA1
ac7d684ddc10c2f3039068b18f0c7036c445d7f4

SHA256
0eed858c5793d246e2db45b06c749164dbbf349d9d42b7d828b8f59ec19e1ee6

SHA512
62ab2bc3b37d74ee23fb24800493acc600505754abd3b0b53d2c3865bb6c92dd63e4479a7923957736a7b8850af9e08f3912f7ab8058f97ceaad529d3ee71bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exe
Filesize
1.0MB

MD5
627b3d44cad6ab301149c6e6bbd06c81

SHA1
ac7d684ddc10c2f3039068b18f0c7036c445d7f4

SHA256
0eed858c5793d246e2db45b06c749164dbbf349d9d42b7d828b8f59ec19e1ee6

SHA512
62ab2bc3b37d74ee23fb24800493acc600505754abd3b0b53d2c3865bb6c92dd63e4479a7923957736a7b8850af9e08f3912f7ab8058f97ceaad529d3ee71bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exe
Filesize
887KB

MD5
081974903672b949fd1c6a9dd217c9ef

SHA1
919b221d95be7c89edf4f281cc2b4d903ffae076

SHA256
7cd01f63b72173aed81a7155909f7c304fef2d81ffe07ee5f2d476f46285e0ce

SHA512
4a87df9aa33708d7e2df2ff3b91730df42c7f92d306ab1110c5a4cab25091728d443871745df08a4cee2116140a953ba45fa12abdb4f6d405d1b3fd463ce2d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exe
Filesize
887KB

MD5
081974903672b949fd1c6a9dd217c9ef

SHA1
919b221d95be7c89edf4f281cc2b4d903ffae076

SHA256
7cd01f63b72173aed81a7155909f7c304fef2d81ffe07ee5f2d476f46285e0ce

SHA512
4a87df9aa33708d7e2df2ff3b91730df42c7f92d306ab1110c5a4cab25091728d443871745df08a4cee2116140a953ba45fa12abdb4f6d405d1b3fd463ce2d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exe
Filesize
496KB

MD5
60bf505062532bdcfad818a2d720154e

SHA1
75d8ce12af0f92cf4fce354d8a2ff432f6a01ff3

SHA256
a1325db89cce6fa9e047538c748b32035a0238ca2ea380131cc1f1b06940f189

SHA512
6609a0313e4226f0f005f104c1c34051afdf91b7e41fcba440ebf8dc562c0f635e17d322cea3695ffbc8580f222ec260f3762444b8a988f5e04a117817837859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exe
Filesize
496KB

MD5
60bf505062532bdcfad818a2d720154e

SHA1
75d8ce12af0f92cf4fce354d8a2ff432f6a01ff3

SHA256
a1325db89cce6fa9e047538c748b32035a0238ca2ea380131cc1f1b06940f189

SHA512
6609a0313e4226f0f005f104c1c34051afdf91b7e41fcba440ebf8dc562c0f635e17d322cea3695ffbc8580f222ec260f3762444b8a988f5e04a117817837859

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exe
Filesize
1.2MB

MD5
b199acaa8b22647f7b729661f94b58d9

SHA1
d27a58335e8aee061f60f8c5e31804e1a080efb5

SHA256
f5668e26afdc9e4c092ad0300ae695b1427cccd896d7aa93936e52b2b54cb357

SHA512
e7b07bbc489f62e93d7209e3ad6eec282f255dde3abcd623d0778041b5f9e16bc7d57ce9c12ccf153cc3f15924e9d9c79cbc95e2d275a677db950d523a4b2a79

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1905635.exe
Filesize
1.2MB

MD5
b199acaa8b22647f7b729661f94b58d9

SHA1
d27a58335e8aee061f60f8c5e31804e1a080efb5

SHA256
f5668e26afdc9e4c092ad0300ae695b1427cccd896d7aa93936e52b2b54cb357

SHA512
e7b07bbc489f62e93d7209e3ad6eec282f255dde3abcd623d0778041b5f9e16bc7d57ce9c12ccf153cc3f15924e9d9c79cbc95e2d275a677db950d523a4b2a79

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exe
Filesize
1.0MB

MD5
627b3d44cad6ab301149c6e6bbd06c81

SHA1
ac7d684ddc10c2f3039068b18f0c7036c445d7f4

SHA256
0eed858c5793d246e2db45b06c749164dbbf349d9d42b7d828b8f59ec19e1ee6

SHA512
62ab2bc3b37d74ee23fb24800493acc600505754abd3b0b53d2c3865bb6c92dd63e4479a7923957736a7b8850af9e08f3912f7ab8058f97ceaad529d3ee71bcc

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7736370.exe
Filesize
1.0MB

MD5
627b3d44cad6ab301149c6e6bbd06c81

SHA1
ac7d684ddc10c2f3039068b18f0c7036c445d7f4

SHA256
0eed858c5793d246e2db45b06c749164dbbf349d9d42b7d828b8f59ec19e1ee6

SHA512
62ab2bc3b37d74ee23fb24800493acc600505754abd3b0b53d2c3865bb6c92dd63e4479a7923957736a7b8850af9e08f3912f7ab8058f97ceaad529d3ee71bcc

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exe
Filesize
887KB

MD5
081974903672b949fd1c6a9dd217c9ef

SHA1
919b221d95be7c89edf4f281cc2b4d903ffae076

SHA256
7cd01f63b72173aed81a7155909f7c304fef2d81ffe07ee5f2d476f46285e0ce

SHA512
4a87df9aa33708d7e2df2ff3b91730df42c7f92d306ab1110c5a4cab25091728d443871745df08a4cee2116140a953ba45fa12abdb4f6d405d1b3fd463ce2d06

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0107694.exe
Filesize
887KB

MD5
081974903672b949fd1c6a9dd217c9ef

SHA1
919b221d95be7c89edf4f281cc2b4d903ffae076

SHA256
7cd01f63b72173aed81a7155909f7c304fef2d81ffe07ee5f2d476f46285e0ce

SHA512
4a87df9aa33708d7e2df2ff3b91730df42c7f92d306ab1110c5a4cab25091728d443871745df08a4cee2116140a953ba45fa12abdb4f6d405d1b3fd463ce2d06

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exe
Filesize
496KB

MD5
60bf505062532bdcfad818a2d720154e

SHA1
75d8ce12af0f92cf4fce354d8a2ff432f6a01ff3

SHA256
a1325db89cce6fa9e047538c748b32035a0238ca2ea380131cc1f1b06940f189

SHA512
6609a0313e4226f0f005f104c1c34051afdf91b7e41fcba440ebf8dc562c0f635e17d322cea3695ffbc8580f222ec260f3762444b8a988f5e04a117817837859

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9990717.exe
Filesize
496KB

MD5
60bf505062532bdcfad818a2d720154e

SHA1
75d8ce12af0f92cf4fce354d8a2ff432f6a01ff3

SHA256
a1325db89cce6fa9e047538c748b32035a0238ca2ea380131cc1f1b06940f189

SHA512
6609a0313e4226f0f005f104c1c34051afdf91b7e41fcba440ebf8dc562c0f635e17d322cea3695ffbc8580f222ec260f3762444b8a988f5e04a117817837859

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6454909.exe
Filesize
860KB

MD5
9c368883f6dc1449981a858d914954bb

SHA1
3f385129151520af6f6edaacfc3795547a9eb045

SHA256
09f140d5cc67468d95153ed3dd7540183c34c48670be78e498d081c3188f0c66

SHA512
208bbe4c0525f86daa0462ba276f81382f6e56432d13de7cc0af9ea7b053e204b4f5a25523d3837a604266cc449f1362000d92feca32c2767017a83f84528c2b

Download Submit
memory/2508-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2508-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2508-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2508-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2508-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2508-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2508-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads