c70f085a5bb6b5589088374114bbd7a7e097ad8dce5343aec499cd7bc070f061

General

Target

SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
Size

89KB
MD5

d617629cc616053d970ce78ec2df19ec
SHA1

778298b7d67c4b10d6ee0025142cbd2656f80452
SHA256

c70f085a5bb6b5589088374114bbd7a7e097ad8dce5343aec499cd7bc070f061
SHA512

3e15af84c04e70631c5efab857e58b8fb46c968b355bbd91915c2b8098fda6a9c8a32b98591c7d87cec8cc2571e3f40983c893ce7d7970258f101b5e683534e4

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/4252-9-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral2/memory/4252-10-0x0000000000403BEE-mapping.dmp	disable_win_def

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral2/memory/4768-6-0x0000000006AC0000-0x0000000006AC2000-memory.dmp	coreentity

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/4768-7-0x0000000006BA0000-0x0000000006BAB000-memory.dmp	rezer0

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe

description	pid	process	target process
PID 4768 set thread context of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3232 powershell.exe
3232 powershell.exe
3232 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3232 powershell.exe

pid	process
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3232	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exeSecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe

description	pid	process	target process
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4768 wrote to memory of 4252	4768	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
PID 4252 wrote to memory of 3232	4252	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	powershell.exe
PID 4252 wrote to memory of 3232	4252	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	powershell.exe
PID 4252 wrote to memory of 3232	4252	SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe
"{path}"
2⤵
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.MulDrop12.44210.25533.6581.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
memory/3232-24-0x0000000008690000-0x0000000008691000-memory.dmp

Filesize
4KB

Download
memory/3232-23-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

Filesize
4KB

Download
memory/3232-16-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/3232-37-0x0000000009850000-0x0000000009851000-memory.dmp

Filesize
4KB

Download
memory/3232-17-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/3232-35-0x00000000096E0000-0x00000000096E1000-memory.dmp

Filesize
4KB

Download
memory/3232-34-0x0000000009370000-0x0000000009371000-memory.dmp

Filesize
4KB

Download
memory/3232-27-0x0000000009590000-0x00000000095C3000-memory.dmp

Filesize
204KB

Download
memory/3232-25-0x00000000085E0000-0x00000000085E1000-memory.dmp

Filesize
4KB

Download
memory/3232-18-0x0000000007540000-0x0000000007541000-memory.dmp

Filesize
4KB

Download
memory/3232-21-0x0000000007DE0000-0x0000000007DE1000-memory.dmp

Filesize
4KB

Download
memory/3232-15-0x0000000000000000-mapping.dmp

Download
memory/3232-39-0x0000000009840000-0x0000000009841000-memory.dmp

Filesize
4KB

Download
memory/3232-36-0x00000000098A0000-0x00000000098A1000-memory.dmp

Filesize
4KB

Download
memory/3232-22-0x0000000008020000-0x0000000008021000-memory.dmp

Filesize
4KB

Download
memory/3232-19-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/3232-20-0x0000000007C20000-0x0000000007C21000-memory.dmp

Filesize
4KB

Download
memory/4252-12-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/4252-10-0x0000000000403BEE-mapping.dmp

Download
memory/4252-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4768-1-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/4768-3-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/4768-0-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/4768-8-0x0000000006C60000-0x0000000006C61000-memory.dmp

Filesize
4KB

Download
memory/4768-7-0x0000000006BA0000-0x0000000006BAB000-memory.dmp

Filesize
44KB

Download
memory/4768-6-0x0000000006AC0000-0x0000000006AC2000-memory.dmp

Filesize
8KB

Download
memory/4768-5-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/4768-4-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads