Analysis
- max time kernel
14s - max time network
19s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
18/11/2024, 03:44
General
- Target cb9e4da68833eaae68a51238bba45d6595df5304f61dd68dfd73a32fec1a0fed.exe
- Size 277KB
- Sample241118-ear8baxeka
- SHA256 cb9e4da68833eaae68a51238bba45d6595df5304f61dd68dfd73a32fec1a0fed
Malware Config
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- Windows security modification 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb9e4da68833eaae68a51238bba45d6595df5304f61dd68dfd73a32fec1a0fed.exe"C:\Users\Admin\AppData\Local\Temp\cb9e4da68833eaae68a51238bba45d6595df5304f61dd68dfd73a32fec1a0fed.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/564-1-0x0000000002C30000-0x0000000002D30000-memory.dmp
memory/564-2-0x00000000002C0000-0x00000000002ED000-memory.dmp
memory/564-3-0x0000000000400000-0x0000000000430000-memory.dmp
memory/564-4-0x00000000003D0000-0x00000000003EA000-memory.dmp
memory/564-5-0x0000000000400000-0x0000000002B9F000-memory.dmp
memory/564-6-0x0000000004590000-0x00000000045A8000-memory.dmp
memory/564-7-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-32-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-34-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-30-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-28-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-26-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-24-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-22-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-20-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-18-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-16-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-14-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-12-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-10-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-8-0x0000000004590000-0x00000000045A2000-memory.dmp
memory/564-35-0x0000000002C30000-0x0000000002D30000-memory.dmp
memory/564-37-0x00000000002C0000-0x00000000002ED000-memory.dmp
memory/564-38-0x0000000000400000-0x0000000000430000-memory.dmp
memory/564-40-0x0000000000400000-0x0000000000430000-memory.dmp
memory/564-41-0x0000000000400000-0x0000000002B9F000-memory.dmp