healer | 3b401ad80c730dfddfef80d2892eff11976d6119a826d38c6385ed92538116ae

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe
Size

1.0MB
MD5

0830a724de65918814ae5e69e8171d85
SHA1

1dc88bdfbba7407a92247b39eddffc9a23c4942c
SHA256

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54
SHA512

d3ddc185ec31b7bcbf2107073179d1c8b3078a9355b73d51916ec40b8e1fbde3ca984fcd5002f5724c2d6f5769b5a78c75327c1e86a79c5933cf7d1353e067ac
SSDEEP

24576:hyWeOkP/BrZbCTONNVDiug53DxeUNH5Rcod:UX7hrX3dg53DES

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1732-56-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1732-55-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1732-58-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1732-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1732-60-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Executes dropped EXE 5 IoCs

Processes:

z6001529.exez4836897.exez9605534.exez4334399.exeq3010868.exe

pid process

3016 z6001529.exe
2148 z4836897.exe
2120 z9605534.exe
2384 z4334399.exe
2728 q3010868.exe

pid	process
3016	z6001529.exe
2148	z4836897.exe
2120	z9605534.exe
2384	z4334399.exe
2728	q3010868.exe

Loads dropped DLL 15 IoCs

Processes:

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exez6001529.exez4836897.exez9605534.exez4334399.exeq3010868.exeWerFault.exe

pid	process
2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe
3016	z6001529.exe
3016	z6001529.exe
2148	z4836897.exe
2148	z4836897.exe
2120	z9605534.exe
2120	z9605534.exe
2384	z4334399.exe
2384	z4334399.exe
2384	z4334399.exe
2728	q3010868.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe
2924	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exez6001529.exez4836897.exez9605534.exez4334399.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6001529.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z4836897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z9605534.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z4334399.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

q3010868.exe

description pid process target process

PID 2728 set thread context of 1732 2728 q3010868.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2924 2728 WerFault.exe q3010868.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

1732 AppLaunch.exe
1732 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1732 AppLaunch.exe

description	pid	process	target process
PID 2728 set thread context of 1732	2728	q3010868.exe	AppLaunch.exe

pid	pid_target	process	target process
2924	2728	WerFault.exe	q3010868.exe

pid	process
1732	AppLaunch.exe
1732	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1732	AppLaunch.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exez6001529.exez4836897.exez9605534.exez4334399.exeq3010868.exe

description	pid	process	target process
PID 2596 wrote to memory of 3016	2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2596 wrote to memory of 3016	2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2596 wrote to memory of 3016	2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2596 wrote to memory of 3016	2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2596 wrote to memory of 3016	2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2596 wrote to memory of 3016	2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 2596 wrote to memory of 3016	2596	bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe	z6001529.exe
PID 3016 wrote to memory of 2148	3016	z6001529.exe	z4836897.exe
PID 3016 wrote to memory of 2148	3016	z6001529.exe	z4836897.exe
PID 3016 wrote to memory of 2148	3016	z6001529.exe	z4836897.exe
PID 3016 wrote to memory of 2148	3016	z6001529.exe	z4836897.exe
PID 3016 wrote to memory of 2148	3016	z6001529.exe	z4836897.exe
PID 3016 wrote to memory of 2148	3016	z6001529.exe	z4836897.exe
PID 3016 wrote to memory of 2148	3016	z6001529.exe	z4836897.exe
PID 2148 wrote to memory of 2120	2148	z4836897.exe	z9605534.exe
PID 2148 wrote to memory of 2120	2148	z4836897.exe	z9605534.exe
PID 2148 wrote to memory of 2120	2148	z4836897.exe	z9605534.exe
PID 2148 wrote to memory of 2120	2148	z4836897.exe	z9605534.exe
PID 2148 wrote to memory of 2120	2148	z4836897.exe	z9605534.exe
PID 2148 wrote to memory of 2120	2148	z4836897.exe	z9605534.exe
PID 2148 wrote to memory of 2120	2148	z4836897.exe	z9605534.exe
PID 2120 wrote to memory of 2384	2120	z9605534.exe	z4334399.exe
PID 2120 wrote to memory of 2384	2120	z9605534.exe	z4334399.exe
PID 2120 wrote to memory of 2384	2120	z9605534.exe	z4334399.exe
PID 2120 wrote to memory of 2384	2120	z9605534.exe	z4334399.exe
PID 2120 wrote to memory of 2384	2120	z9605534.exe	z4334399.exe
PID 2120 wrote to memory of 2384	2120	z9605534.exe	z4334399.exe
PID 2120 wrote to memory of 2384	2120	z9605534.exe	z4334399.exe
PID 2384 wrote to memory of 2728	2384	z4334399.exe	q3010868.exe
PID 2384 wrote to memory of 2728	2384	z4334399.exe	q3010868.exe
PID 2384 wrote to memory of 2728	2384	z4334399.exe	q3010868.exe
PID 2384 wrote to memory of 2728	2384	z4334399.exe	q3010868.exe
PID 2384 wrote to memory of 2728	2384	z4334399.exe	q3010868.exe
PID 2384 wrote to memory of 2728	2384	z4334399.exe	q3010868.exe
PID 2384 wrote to memory of 2728	2384	z4334399.exe	q3010868.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 1732	2728	q3010868.exe	AppLaunch.exe
PID 2728 wrote to memory of 2924	2728	q3010868.exe	WerFault.exe
PID 2728 wrote to memory of 2924	2728	q3010868.exe	WerFault.exe
PID 2728 wrote to memory of 2924	2728	q3010868.exe	WerFault.exe
PID 2728 wrote to memory of 2924	2728	q3010868.exe	WerFault.exe
PID 2728 wrote to memory of 2924	2728	q3010868.exe	WerFault.exe
PID 2728 wrote to memory of 2924	2728	q3010868.exe	WerFault.exe
PID 2728 wrote to memory of 2924	2728	q3010868.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe
"C:\Users\Admin\AppData\Local\Temp\bec121e347e5f64ef30e748468dce2e46e111a010193eeb6a3eb859492653a54.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2596

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2148

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2120

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 268
7⤵
- Loads dropped DLL
- Program crash
PID:2924

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
Filesize
964KB

MD5
566881171ec1ec419c79362e572c6058

SHA1
c9980837edc2ec9bd281821001e6d57f22440653

SHA256
42d27c5bd52cb9b2e961b412ca32cd139f78eed11e2530fc20532bc16628c999

SHA512
4caf51e3cd1c10274ac541184da1dbff57bce1e06e15a2f9d2f240b3f322bf969d5e4b84c93ad30f1e80f0dd9c27de1e32ec77782d7f8a8d722091aca0976ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
Filesize
964KB

MD5
566881171ec1ec419c79362e572c6058

SHA1
c9980837edc2ec9bd281821001e6d57f22440653

SHA256
42d27c5bd52cb9b2e961b412ca32cd139f78eed11e2530fc20532bc16628c999

SHA512
4caf51e3cd1c10274ac541184da1dbff57bce1e06e15a2f9d2f240b3f322bf969d5e4b84c93ad30f1e80f0dd9c27de1e32ec77782d7f8a8d722091aca0976ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
Filesize
781KB

MD5
66e4aac9c8943115b249d782b4fadf2e

SHA1
1fa309b00f9049453f6974531fbc5d95c4df46c1

SHA256
2201afb22012e38a428f8377b34e9b231c9403fdc782b49bb7835fe74596e270

SHA512
5d05f8aafa5029d33986c318a706ac7d13dd524366e6c6c753728a49d94fe383ff54ba0f0b30fb2c67eead88298b9c4b4a410f66853b389214ad20401a5dc912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
Filesize
781KB

MD5
66e4aac9c8943115b249d782b4fadf2e

SHA1
1fa309b00f9049453f6974531fbc5d95c4df46c1

SHA256
2201afb22012e38a428f8377b34e9b231c9403fdc782b49bb7835fe74596e270

SHA512
5d05f8aafa5029d33986c318a706ac7d13dd524366e6c6c753728a49d94fe383ff54ba0f0b30fb2c67eead88298b9c4b4a410f66853b389214ad20401a5dc912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
Filesize
599KB

MD5
0ae3013a7ffffcb1d414af2da402ea49

SHA1
0fbf6b8cf49a0e97d773feb6010755b135ea7e96

SHA256
a018677628ccc618cb6eec53470890663b280b294e93f159dc2357ee56fa90ea

SHA512
482ef4b87907313c398ce4296ac9017c91d206eca0ea2456a81ca6fdb93ac8c66fe719c4e6782f910ee5cd07849f09deeecc695971bec0aa58c4179c31ecba83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
Filesize
599KB

MD5
0ae3013a7ffffcb1d414af2da402ea49

SHA1
0fbf6b8cf49a0e97d773feb6010755b135ea7e96

SHA256
a018677628ccc618cb6eec53470890663b280b294e93f159dc2357ee56fa90ea

SHA512
482ef4b87907313c398ce4296ac9017c91d206eca0ea2456a81ca6fdb93ac8c66fe719c4e6782f910ee5cd07849f09deeecc695971bec0aa58c4179c31ecba83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
Filesize
336KB

MD5
46d638cf61e11b7df691f532014709eb

SHA1
db3563060af1992f2a89d08446d22d5853f96359

SHA256
f56104c1cb3f82ddfdf842786e73ce332f6ba72d1f332d79f47e889abd59c6e3

SHA512
ed00fe7ffc2015062c2e824ef0b18c9534f2630a537ec42fe67e27dd1ac5749f4aed1c435ba193cbde2ab33cbcc8fc06a8687a7742fb677aeba32a50209eb11a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
Filesize
336KB

MD5
46d638cf61e11b7df691f532014709eb

SHA1
db3563060af1992f2a89d08446d22d5853f96359

SHA256
f56104c1cb3f82ddfdf842786e73ce332f6ba72d1f332d79f47e889abd59c6e3

SHA512
ed00fe7ffc2015062c2e824ef0b18c9534f2630a537ec42fe67e27dd1ac5749f4aed1c435ba193cbde2ab33cbcc8fc06a8687a7742fb677aeba32a50209eb11a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
Filesize
964KB

MD5
566881171ec1ec419c79362e572c6058

SHA1
c9980837edc2ec9bd281821001e6d57f22440653

SHA256
42d27c5bd52cb9b2e961b412ca32cd139f78eed11e2530fc20532bc16628c999

SHA512
4caf51e3cd1c10274ac541184da1dbff57bce1e06e15a2f9d2f240b3f322bf969d5e4b84c93ad30f1e80f0dd9c27de1e32ec77782d7f8a8d722091aca0976ece

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6001529.exe
Filesize
964KB

MD5
566881171ec1ec419c79362e572c6058

SHA1
c9980837edc2ec9bd281821001e6d57f22440653

SHA256
42d27c5bd52cb9b2e961b412ca32cd139f78eed11e2530fc20532bc16628c999

SHA512
4caf51e3cd1c10274ac541184da1dbff57bce1e06e15a2f9d2f240b3f322bf969d5e4b84c93ad30f1e80f0dd9c27de1e32ec77782d7f8a8d722091aca0976ece

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
Filesize
781KB

MD5
66e4aac9c8943115b249d782b4fadf2e

SHA1
1fa309b00f9049453f6974531fbc5d95c4df46c1

SHA256
2201afb22012e38a428f8377b34e9b231c9403fdc782b49bb7835fe74596e270

SHA512
5d05f8aafa5029d33986c318a706ac7d13dd524366e6c6c753728a49d94fe383ff54ba0f0b30fb2c67eead88298b9c4b4a410f66853b389214ad20401a5dc912

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4836897.exe
Filesize
781KB

MD5
66e4aac9c8943115b249d782b4fadf2e

SHA1
1fa309b00f9049453f6974531fbc5d95c4df46c1

SHA256
2201afb22012e38a428f8377b34e9b231c9403fdc782b49bb7835fe74596e270

SHA512
5d05f8aafa5029d33986c318a706ac7d13dd524366e6c6c753728a49d94fe383ff54ba0f0b30fb2c67eead88298b9c4b4a410f66853b389214ad20401a5dc912

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
Filesize
599KB

MD5
0ae3013a7ffffcb1d414af2da402ea49

SHA1
0fbf6b8cf49a0e97d773feb6010755b135ea7e96

SHA256
a018677628ccc618cb6eec53470890663b280b294e93f159dc2357ee56fa90ea

SHA512
482ef4b87907313c398ce4296ac9017c91d206eca0ea2456a81ca6fdb93ac8c66fe719c4e6782f910ee5cd07849f09deeecc695971bec0aa58c4179c31ecba83

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9605534.exe
Filesize
599KB

MD5
0ae3013a7ffffcb1d414af2da402ea49

SHA1
0fbf6b8cf49a0e97d773feb6010755b135ea7e96

SHA256
a018677628ccc618cb6eec53470890663b280b294e93f159dc2357ee56fa90ea

SHA512
482ef4b87907313c398ce4296ac9017c91d206eca0ea2456a81ca6fdb93ac8c66fe719c4e6782f910ee5cd07849f09deeecc695971bec0aa58c4179c31ecba83

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
Filesize
336KB

MD5
46d638cf61e11b7df691f532014709eb

SHA1
db3563060af1992f2a89d08446d22d5853f96359

SHA256
f56104c1cb3f82ddfdf842786e73ce332f6ba72d1f332d79f47e889abd59c6e3

SHA512
ed00fe7ffc2015062c2e824ef0b18c9534f2630a537ec42fe67e27dd1ac5749f4aed1c435ba193cbde2ab33cbcc8fc06a8687a7742fb677aeba32a50209eb11a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4334399.exe
Filesize
336KB

MD5
46d638cf61e11b7df691f532014709eb

SHA1
db3563060af1992f2a89d08446d22d5853f96359

SHA256
f56104c1cb3f82ddfdf842786e73ce332f6ba72d1f332d79f47e889abd59c6e3

SHA512
ed00fe7ffc2015062c2e824ef0b18c9534f2630a537ec42fe67e27dd1ac5749f4aed1c435ba193cbde2ab33cbcc8fc06a8687a7742fb677aeba32a50209eb11a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3010868.exe
Filesize
217KB

MD5
c2fb5c0d9016509b349847e756c1a77d

SHA1
862e420a4358c4ad9c972169bafeaf6cc4a926dd

SHA256
9fee9d6619ef5d43eed475d74ce94819acf1f0d7d1b775034acb14f92da0433b

SHA512
1b69701ef0e33a2ba56b743bd73bb5b86317d9e36f295364056c2c0029f2e869f019301137ca2f62b04b11207b683b53fe63c248d9a81a346da7f5a65d8fdce5

Download Submit
memory/1732-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1732-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads