Analysis
-
max time kernel
95s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2024, 08:25
Static task
static1
General
-
Target
b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe
-
Size
406KB
-
MD5
c8c0a98d50684374dc76c2acf2b052f3
-
SHA1
e0a0fb9b73cd7d70687f9d553575b18b94151f38
-
SHA256
b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6
-
SHA512
a38dc0071cf3bb3f67851ff11c76deff83b6d114cb33b9fd615a366790e160cff8cc2df4817d3b5c26489353d44d78d62032e63057e969799ac14c3f7b425efe
-
SSDEEP
6144:eXp0yN90QEDlqnRgZqLtAs10zZm8yFwiYDiBa+WytZuVKgZA:ry90zyKZqLtl10zewLi0egK/
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3068-8-0x0000000002120000-0x000000000213A000-memory.dmp healer behavioral1/memory/3068-11-0x00000000049A0000-0x00000000049B8000-memory.dmp healer behavioral1/memory/3068-18-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-36-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-34-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-32-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-30-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-28-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-26-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-24-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-22-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-20-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-16-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-14-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-13-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-40-0x00000000049A0000-0x00000000049B3000-memory.dmp healer behavioral1/memory/3068-38-0x00000000049A0000-0x00000000049B3000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 102700783.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 102700783.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 102700783.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 102700783.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 217328004.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 217328004.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 217328004.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 102700783.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 102700783.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 217328004.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 217328004.exe -
Executes dropped EXE 2 IoCs
pid Process 3068 102700783.exe 4544 217328004.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 102700783.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 217328004.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 102700783.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3508 4544 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217328004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 102700783.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3068 102700783.exe 3068 102700783.exe 4544 217328004.exe 4544 217328004.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3068 102700783.exe Token: SeDebugPrivilege 4544 217328004.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1180 wrote to memory of 3068 1180 b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe 83 PID 1180 wrote to memory of 3068 1180 b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe 83 PID 1180 wrote to memory of 3068 1180 b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe 83 PID 1180 wrote to memory of 4544 1180 b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe 93 PID 1180 wrote to memory of 4544 1180 b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe 93 PID 1180 wrote to memory of 4544 1180 b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe"C:\Users\Admin\AppData\Local\Temp\b018ba87e92d34ad0e38bff3a83c988e34ed0796b4540e100a1810dce61c76c6.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\102700783.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\102700783.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\217328004.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\217328004.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 10763⤵
- Program crash
PID:3508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4544 -ip 45441⤵PID:716
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD52b71f4b18ac8214a2bff547b6ce2f64f
SHA1b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5
SHA256f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc
SHA51233518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177
-
Filesize
258KB
MD5272f70e8ed1743dc55ffab0f679f48b6
SHA14ec4841d9a15e57669fa428e77dd3b4c3cfa6247
SHA2567f752180bf3503d34fac0856e16ec30a8820d536e35cf2f3cbcb92e77ea1a4f5
SHA512b4bcedbec001de1969f5db28126869d1b4bc1c7a347f52dc03ae1be4e8cab1f3dab9a4abe3341ccb4d5bd5a3997f63ec3b2c8362c99886b6944adc886720a4d2