Overview
overview
10Static
static
705b48b2909...29.exe
windows10-2004-x64
143e14de3a...c5.exe
windows10-2004-x64
102c899ff55c...31.exe
windows10-2004-x64
102e0a9b6a39...9b.exe
windows10-2004-x64
104250b0250d...ee.exe
windows10-2004-x64
10464a716862...38.exe
windows10-2004-x64
104d09936a4a...bf.exe
windows10-2004-x64
1059c1607382...01.exe
windows10-2004-x64
1061f1416a77...2b.exe
windows10-2004-x64
1068ca177d42...f8.exe
windows7-x64
768ca177d42...f8.exe
windows10-2004-x64
76ba0db3b66...b3.exe
windows10-2004-x64
108b549a8688...5b.exe
windows10-2004-x64
10a8dffd83e4...8a.exe
windows10-2004-x64
7b6b53c7022...c9.exe
windows10-2004-x64
10ccc5c313f4...94.exe
windows10-2004-x64
e04ecd64b5...1b.exe
windows7-x64
3e04ecd64b5...1b.exe
windows10-2004-x64
10e38bd93e74...28.exe
windows7-x64
3e38bd93e74...28.exe
windows10-2004-x64
10eab14d8dad...38.exe
windows10-2004-x64
10f943251c5b...1b.exe
windows10-2004-x64
10fb49b50c0d...90.exe
windows7-x64
3fb49b50c0d...90.exe
windows10-2004-x64
10Analysis
-
max time kernel
0s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 13:23
Behavioral task
behavioral1
Sample
05b48b2909386e117184a0bdde8c6718992cf21d07674042c9d076292b260729.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
143e14de3ab20f2359132907b991db6a76d0d521ba132b83a736d149619409c5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
2c899ff55cbbdd4c5b9be75b0893daed295266b8392bd0365eb55f6acf67f731.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
2e0a9b6a39ce81b93beb155ac3c237f4a6b9248d6b872ed22bfdf8851796b19b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
464a7168620633d6f4e27494eec6c1cedff2ae39e5ffda7f9913f43efd93bd38.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
4d09936a4a5e882005320c53757dc18469109b9f86d4b6003bb674e1658b0dbf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
61f1416a771544600c2eb0122b2860693273306c4f450b6c7dc5af2a07a52b2b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
68ca177d42ab79022ede5d703f2f3b4e3de42fc1ae56a531b50f66f3339721f8.exe
Resource
win7-20240508-en
Behavioral task
behavioral11
Sample
68ca177d42ab79022ede5d703f2f3b4e3de42fc1ae56a531b50f66f3339721f8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
e04ecd64b5614cc4103cdde760de6180002d85792ec28fa0beb64b385bf3f11b.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
e04ecd64b5614cc4103cdde760de6180002d85792ec28fa0beb64b385bf3f11b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
e38bd93e7494d62b91d0445138d215387c568aa6b6e9ae0a92842ba7b1999228.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
e38bd93e7494d62b91d0445138d215387c568aa6b6e9ae0a92842ba7b1999228.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
eab14d8dada2d5205db79e415c61561de2646a3a67f4615bfffa2f0c272f8738.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
fb49b50c0d470063e9548552158ebf5137ca285f8cf0ccfe1a2ef2d44bbb4390.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
fb49b50c0d470063e9548552158ebf5137ca285f8cf0ccfe1a2ef2d44bbb4390.exe
Resource
win10v2004-20240426-en
Errors
General
-
Target
ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe
-
Size
389KB
-
MD5
2eeefdf643f78c415d5773e6839837b2
-
SHA1
797a0d8433f1b575915a9cb2952795535fb3546d
-
SHA256
ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394
-
SHA512
96c66dfb44902289d99a122c9e8b2804a236e61351e81ad56f5406fd935a2c5e65fac58da2bb8dd8f2738e5d7e1251128413b5247a1cfc421e1b5dc6c960272f
-
SSDEEP
6144:K8y+bnr+9p0yN90QEA748JHJlPx2r5z3HVK9ehKCCB2GTNXeD3zsvHclk:QMrty90mM8VJluVSaKCCEUXau
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral16/files/0x0008000000023418-13.dat healer behavioral16/memory/3412-15-0x0000000000840000-0x000000000084A000-memory.dmp healer -
Executes dropped EXE 2 IoCs
pid Process 3280 z2882788.exe 3412 p8565578.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z2882788.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4964 wrote to memory of 3280 4964 ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe 84 PID 4964 wrote to memory of 3280 4964 ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe 84 PID 4964 wrote to memory of 3280 4964 ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe 84 PID 3280 wrote to memory of 3412 3280 z2882788.exe 86 PID 3280 wrote to memory of 3412 3280 z2882788.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe"C:\Users\Admin\AppData\Local\Temp\ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2882788.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p8565578.exe3⤵
- Executes dropped EXE
PID:3412
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD56de9a950d4a4b7c0332b45a5bd235d01
SHA1841af90b26f4db62c4b8f90e28338191a6a7f828
SHA2563259015332b3c7d28f60d87021ad2c8774ee8fecdf700f3955e15f54889187a7
SHA5125020589a686c79d44bd60222e57d114a395b06e9d2a57d29097c2666ec76a8312558593415f55017d066964c49abe9a45ebd738d761666d1b0d93f1bb1e6ba3b
-
Filesize
14KB
MD596a788f0a5be814e86485a5a69530a9f
SHA12d3e089f1d1e6bcd963d905e4562b3f463795d85
SHA25649cb26c4643b21f4e6b5ac16f17256db971437aa4ad718cf747ffe01449a8e34
SHA512d2f13b86e881b2663e32b77cdc3323c971a42737295766ad575bad1fbc21bf8e7c358e87145acbd092dace56b56c7c76203580b4cdf91afb0346b22cb00ecc0f