Analysis

  • max time kernel
    119s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 09:54 UTC

General

  • Target

    67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5.exe

  • Size

    1.0MB

  • MD5

    e767bbeb6e8148b867a7d852c506268e

  • SHA1

    21eb1e99770befd91c04b781066388c583cdf87f

  • SHA256

    67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5

  • SHA512

    77d69923156a9765cdd0e0dfee4d1a212bcd0d132c74f658cb07bc92c0e08b30ee7c70db9f415acdce143b079c5b44bbabe13efcf02a050968e30d31a42414ad

  • SSDEEP

    24576:6yS31DyhN2Z6A896RaCB1NvkgWI5UnX9WocaWFiXM9:BSNyhMFaCbNdUnUrFY

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 5 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5.exe
    "C:\Users\Admin\AppData\Local\Temp\67f7ec01f0097430554252708324ccd837268be66f78d17cf533e65e497ec8b5.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2268
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Modifies Windows Defender Real-time Protection settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2632
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 272
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:1256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\z8483101.exe

    Filesize

    961KB

    MD5

    02d0d9d822e8948f4991555619254df1

    SHA1

    e7c4ebbb5fc5941436f7bed7e6fff02348c0d62a

    SHA256

    0decee1470b5bdfe85655d71ae0fa96bd661ccabd4a85996b254694a18ef5b78

    SHA512

    ddbebcd38a6352e86406bc52ab2d28cefc3da0ae690658cb2914d8bfb40b65a30adf0f0ab4a170a6b59ba9ae9d4004b3d9df9295783d3ef2475622afb1b2cf72

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\z4286774.exe

    Filesize

    778KB

    MD5

    d2819530f328c2912ffec8ae40399365

    SHA1

    d2ef6a52af538e36f360b2f3a7bea7c519cd73c1

    SHA256

    4cfe5aba9f1eaff494a0f83ed0a29d7d3dce09974a8ce1a315b231b5518eb22d

    SHA512

    ce6d71038e320ab06ad2748841ad79d49d2f89cbcc4fd7f0b966a042bed2517d73b15209e49a85e503ab073b4fafddeaeafc02ba44cab1484c464b4bc630ddb4

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\z4970870.exe

    Filesize

    595KB

    MD5

    27ca490eb4e94680b2a40c644e228e24

    SHA1

    adb6b8023580628be2c3a58626e99fc74ce32729

    SHA256

    a7490b6ff9eec4fa6f9b8cca282c7d279d1f1189cc08c8abc9347fcbcb03f811

    SHA512

    28d0354085ee23bbbc61a6bcbbfecbdfcb089f8e0b02d6379bfd629bf9b03c33b30f03a07c13105b3c676e7b9f8f7ce6368efc4b5b74c380cbaac59167d434f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\z2071286.exe

    Filesize

    334KB

    MD5

    ffc2cc41ffef64d475d67ca5404849cc

    SHA1

    bed908787b08867e0fe875976e7d75fb8bf6c2a5

    SHA256

    23d7f987df2e955c87e46b5c3758599091b7e2471330e383bec4df490d71261c

    SHA512

    d2b6ddb50100db8e1977986e233af285ca86b6169d52a673a1bdabe145b739a51e22834a807189f1c383037d049738386f93e7f18d2b420cdbf9c5b68167d98b

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\q1336364.exe

    Filesize

    221KB

    MD5

    fdd83f4f9832fb2cfcd569d32b611fb8

    SHA1

    9ce30d9380ae8fa315b2145a578a51c7550c2fcb

    SHA256

    f3da943420f4ceed4255ec789f610b597fed6d0435ee25f079b7ab6fac6c6e84

    SHA512

    175cc210274ff407a2fba51390e4f65438cee626b789c2c8f71d6c874a10a6b90186c970a4371d65964c7a2e6a2629e918ec6d18d91d0f39e75ac3b852a6baf3

  • memory/2632-59-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-53-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-64-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-66-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-55-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-57-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2632-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2632-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.