Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 20:34

General

  • Target

    242f31c4cbeaf4fe905815364fc095cdc886aa10c0be9ab918a91457e8de8170.exe

  • Size

    166KB

  • MD5

    05740b3c1a2bd9913889d56c6c05d151

  • SHA1

    324178596192bd56b5bb817c83115205824227cb

  • SHA256

    242f31c4cbeaf4fe905815364fc095cdc886aa10c0be9ab918a91457e8de8170

  • SHA512

    7af7fac05c4f330520b09fa213da9d23782723d6d5d558ce7ddc5fc11c8ff36931154a05ec3f30146cf9979af0923de446d5eb8cd4434381c09484a89da39778

  • SSDEEP

    3072:yWpJZrSoCyIGCH/G+3jYu4yUuvd6sOx5ITx:5tSohCf33jYVuvdQ

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\242f31c4cbeaf4fe905815364fc095cdc886aa10c0be9ab918a91457e8de8170.exe
    "C:\Users\Admin\AppData\Local\Temp\242f31c4cbeaf4fe905815364fc095cdc886aa10c0be9ab918a91457e8de8170.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2104-1-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2104-3-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2104-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2104-10-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2104-9-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2104-11-0x00000000743BE000-0x00000000743BF000-memory.dmp

    Filesize

    4KB

  • memory/2104-12-0x00000000743BE000-0x00000000743BF000-memory.dmp

    Filesize

    4KB

  • memory/3052-0-0x0000000000424000-0x0000000000426000-memory.dmp

    Filesize

    8KB