2eaddbbaef4bac1f9f6277dc93c428cdd13024139d158fa7f83fa371721aa62c

General

Target

b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
Size

966KB
MD5

219a80b59c3cab8bac5d5c20634fb530
SHA1

b681a334906fa48f7c881b4a645888a7fe4b05f2
SHA256

b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25
SHA512

71cb11b1af6f7ba69b623979eb42b7621b3dc3979b346bec70a57491391eaf6ddf6062b72a6163ad3d3708de2a826965e3d5efb2988e4b4bfd17c184c6341bb9

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2008-12-0x0000000004670000-0x0000000004689000-memory.dmp	disable_win_def
behavioral1/memory/572-13-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def
behavioral1/memory/572-14-0x000000000041757E-mapping.dmp	disable_win_def
behavioral1/memory/572-15-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def
behavioral1/memory/572-16-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def

Suspicious use of SetThreadContext 1 IoCs

Processes:

b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

description	pid	process	target process
PID 2008 set thread context of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1844 schtasks.exe
1428 schtasks.exe

pid	process
1844	schtasks.exe
1428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exeb170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

pid	process
2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exeb170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

description	pid	process
Token: SeDebugPrivilege	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
Token: SeDebugPrivilege	572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

pid	process
572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exeb170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe

C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
"C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DKlXVvcwbq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E86.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
  "C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe"
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
  "C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe"
  2⤵
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
  "C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E86.tmp

MD5
f2885b56f588081d9ccb5eb39862f0b8

SHA1
8601f82bf665e02c2fa2297cfa2e08268c003f56

SHA256
755980cceb856b76d993edae4d9983428527cf05b6d9b863d7efc821c021ed43

SHA512
c4540d7ab8656286520429c27d9c4fa1e273eed92ead994658f17ebc4caa129880eda9ee0f91b68b04cf1754376327e2fa51c71f423a2d537fef7772433abf6b

Download Submit
memory/572-17-0x0000000073AF0000-0x00000000741DE000-memory.dmp

Filesize
6.9MB

Download
memory/572-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/572-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/572-14-0x000000000041757E-mapping.dmp

Download
memory/572-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1428-20-0x0000000000000000-mapping.dmp

Download
memory/1844-10-0x0000000000000000-mapping.dmp

Download
memory/2008-12-0x0000000004670000-0x0000000004689000-memory.dmp

Filesize
100KB

Download
memory/2008-2-0x0000000073AF0000-0x00000000741DE000-memory.dmp

Filesize
6.9MB

Download
memory/2008-9-0x0000000004FE0000-0x000000000502B000-memory.dmp

Filesize
300KB

Download
memory/2008-7-0x0000000000660000-0x0000000000668000-memory.dmp

Filesize
32KB

Download
memory/2008-6-0x00000000055A0000-0x0000000005607000-memory.dmp

Filesize
412KB

Download
memory/2008-5-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/2008-3-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 2008 wrote to memory of 1844	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe
PID 2008 wrote to memory of 1844	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe
PID 2008 wrote to memory of 1844	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe
PID 2008 wrote to memory of 1844	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe
PID 2008 wrote to memory of 932	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 932	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 932	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 932	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 1504	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 1504	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 1504	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 1504	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 2008 wrote to memory of 572	2008	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe
PID 572 wrote to memory of 1428	572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe
PID 572 wrote to memory of 1428	572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe
PID 572 wrote to memory of 1428	572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe
PID 572 wrote to memory of 1428	572	b170368730c5c5cff393d9d171ca74c928e36f9fa4f2a2b795b463bb8caa1e25.exe	schtasks.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads