Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 10:59

General

  • Target

    e91da56042cb38a9ddf26ae132c623d6125bf34a50628f69521006caeb3b48d8N.exe

  • Size

    324KB

  • MD5

    453b433f66a9cae7bd2f0df8c6120680

  • SHA1

    3c1e0f8e2e1940ba4ffa04d18451ef8ac1400afe

  • SHA256

    e91da56042cb38a9ddf26ae132c623d6125bf34a50628f69521006caeb3b48d8

  • SHA512

    0f61475d0d3a5743a10eac9de04668053f217f0104ed3f9600a3eedeee9f92e1e29dc44cf982b9038517c3f5998d49e584df3d7763d930a2188cc3915cb9046a

  • SSDEEP

    6144:K+y+bnr+7p0yN90QEE1AN5QRJArYGdehQDuz+IQgiIaw:+Mr3y90y1NAKhQDVbgKw

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e91da56042cb38a9ddf26ae132c623d6125bf34a50628f69521006caeb3b48d8N.exe
    "C:\Users\Admin\AppData\Local\Temp\e91da56042cb38a9ddf26ae132c623d6125bf34a50628f69521006caeb3b48d8N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b6202QA.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b6202QA.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c79eI25.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c79eI25.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 1100
        3⤵
        • Program crash
        PID:3984
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1048 -ip 1048
    1⤵
      PID:2844

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\b6202QA.exe

            Filesize

            11KB

            MD5

            7e93bacbbc33e6652e147e7fe07572a0

            SHA1

            421a7167da01c8da4dc4d5234ca3dd84e319e762

            SHA256

            850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

            SHA512

            250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c79eI25.exe

            Filesize

            226KB

            MD5

            87fdb2616cdd76d9350185b156701651

            SHA1

            7fdf84d01f1483a62b58ca49f7b6a611d4f3dcbd

            SHA256

            c67ca9d7889ab72b29cf894975dc011f98a5f05c978f703d5f74c106c692d23f

            SHA512

            3037c42e038fb974a976d2750a876b46aabd8236a3a2f4f8cddfa7ecd584608cec86e130bc3af974df56d75ff0bed1ea0ca1948fe3fdeda1016cbd33807afe71

          • memory/704-7-0x00007FF8CDE53000-0x00007FF8CDE55000-memory.dmp

            Filesize

            8KB

          • memory/704-8-0x0000000000010000-0x000000000001A000-memory.dmp

            Filesize

            40KB

          • memory/704-9-0x00007FF8CDE53000-0x00007FF8CDE55000-memory.dmp

            Filesize

            8KB

          • memory/1048-42-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-38-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-16-0x0000000002130000-0x000000000215D000-memory.dmp

            Filesize

            180KB

          • memory/1048-18-0x0000000002330000-0x000000000234A000-memory.dmp

            Filesize

            104KB

          • memory/1048-19-0x0000000004E40000-0x00000000053E4000-memory.dmp

            Filesize

            5.6MB

          • memory/1048-20-0x0000000002510000-0x0000000002528000-memory.dmp

            Filesize

            96KB

          • memory/1048-21-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-28-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-48-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-46-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-44-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-15-0x0000000000820000-0x0000000000920000-memory.dmp

            Filesize

            1024KB

          • memory/1048-40-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-17-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/1048-36-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-34-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-33-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-30-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-26-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-24-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-22-0x0000000002510000-0x0000000002522000-memory.dmp

            Filesize

            72KB

          • memory/1048-49-0x0000000000820000-0x0000000000920000-memory.dmp

            Filesize

            1024KB

          • memory/1048-50-0x0000000002130000-0x000000000215D000-memory.dmp

            Filesize

            180KB

          • memory/1048-52-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/1048-51-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/1048-54-0x0000000000400000-0x00000000004B8000-memory.dmp

            Filesize

            736KB

          • memory/1048-55-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB