resource	yara_rule
behavioral15/memory/4664-41-0x00000000004A0000-0x00000000004DE000-memory.dmp	healer
behavioral15/files/0x0007000000023404-46.dat	healer
behavioral15/memory/4444-48-0x0000000000A00000-0x0000000000A0A000-memory.dmp	healer

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a6918678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a6918678.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b0194431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b0194431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b0194431.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a6918678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a6918678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a6918678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a6918678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b0194431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b0194431.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b0194431.exe

resource	yara_rule
behavioral15/memory/4808-53-0x0000000000590000-0x000000000061C000-memory.dmp	family_redline
behavioral15/memory/4808-60-0x0000000000590000-0x000000000061C000-memory.dmp	family_redline

pid	Process
4268	v8193530.exe
5028	v7356747.exe
2896	v1869910.exe
1524	v6266876.exe
4664	a6918678.exe
4444	b0194431.exe
4808	c9863785.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a6918678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a6918678.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b0194431.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v8193530.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7356747.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v1869910.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	v6266876.exe

description	pid	Process
Token: SeDebugPrivilege	4664	a6918678.exe
Token: SeDebugPrivilege	4444	b0194431.exe

description	pid	Process	procid_target
PID 4004 wrote to memory of 4268	4004	b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe	81
PID 4004 wrote to memory of 4268	4004	b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe	81
PID 4004 wrote to memory of 4268	4004	b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe	81
PID 4268 wrote to memory of 5028	4268	v8193530.exe	82
PID 4268 wrote to memory of 5028	4268	v8193530.exe	82
PID 4268 wrote to memory of 5028	4268	v8193530.exe	82
PID 5028 wrote to memory of 2896	5028	v7356747.exe	83
PID 5028 wrote to memory of 2896	5028	v7356747.exe	83
PID 5028 wrote to memory of 2896	5028	v7356747.exe	83
PID 2896 wrote to memory of 1524	2896	v1869910.exe	84
PID 2896 wrote to memory of 1524	2896	v1869910.exe	84
PID 2896 wrote to memory of 1524	2896	v1869910.exe	84
PID 1524 wrote to memory of 4664	1524	v6266876.exe	85
PID 1524 wrote to memory of 4664	1524	v6266876.exe	85
PID 1524 wrote to memory of 4664	1524	v6266876.exe	85
PID 1524 wrote to memory of 4444	1524	v6266876.exe	87
PID 1524 wrote to memory of 4444	1524	v6266876.exe	87
PID 2896 wrote to memory of 4808	2896	v1869910.exe	88
PID 2896 wrote to memory of 4808	2896	v1869910.exe	88
PID 2896 wrote to memory of 4808	2896	v1869910.exe	88

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.