Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2025 23:14

General

  • Target

    6201a1b25c3769b2ae8c50afd1e05b11bc5b7bbf0cefd33f68961a0263b27555.exe

  • Size

    1.7MB

  • MD5

    69ce298b82b8e2a8cad9ac9555ef10c7

  • SHA1

    2e398c8e5ef663342d3e47e3002b9ccecb4b618f

  • SHA256

    6201a1b25c3769b2ae8c50afd1e05b11bc5b7bbf0cefd33f68961a0263b27555

  • SHA512

    a02a0f85c402b798a78d191fd03aa99bd8dc946d4643508321cbf18f037b62e52abed8ffe955970b7a38aa409ef9981a548caa6666250efd2b48ab44c9831b48

  • SSDEEP

    49152:RHdCRa1XfBArWbnXkyJ+zWLp+xehlipSS4:R2a1XfBArWbUTzW8xWiI

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6201a1b25c3769b2ae8c50afd1e05b11bc5b7bbf0cefd33f68961a0263b27555.exe
    "C:\Users\Admin\AppData\Local\Temp\6201a1b25c3769b2ae8c50afd1e05b11bc5b7bbf0cefd33f68961a0263b27555.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Modifies Windows Defender notification settings
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Windows security modification
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3060-0-0x0000000000330000-0x0000000000790000-memory.dmp

    Filesize

    4.4MB

  • memory/3060-1-0x0000000000330000-0x0000000000790000-memory.dmp

    Filesize

    4.4MB

  • memory/3060-2-0x0000000000330000-0x0000000000790000-memory.dmp

    Filesize

    4.4MB

  • memory/3060-5-0x0000000000330000-0x0000000000790000-memory.dmp

    Filesize

    4.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.