598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b

General

Target

598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
Size

308KB
MD5

1ea303047c2d631108e382977400e8aa
SHA1

455cce5c4f0f948de08dbb6950ddac242514233d
SHA256

598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b
SHA512

bd0d43d40006a78e696dc7afefea9fe551fc5925261fa220fc5236c6de87a4faf3abefe3dc8533d689ebd5a64aa9a2af47cbc32ec266638b5fe04b9cefaec161
SSDEEP

6144:Kky+bnr+1p0yN90QEnlEY+zbPsL4JfR7wDvROxnGgjK0MVLY:cMrhy909b+zYemgxxjK0MxY

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g5060263.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g5060263.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g5060263.exe

Executes dropped EXE 2 IoCs

pid	Process
108	g5060263.exe
1640	h9602166.exe

Loads dropped DLL 4 IoCs

pid	Process
1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
108	g5060263.exe
1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
1640	h9602166.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	g5060263.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	g5060263.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
108	g5060263.exe
108	g5060263.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	108	g5060263.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 108	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	27
PID 1700 wrote to memory of 108	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	27
PID 1700 wrote to memory of 108	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	27
PID 1700 wrote to memory of 108	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	27
PID 1700 wrote to memory of 108	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	27
PID 1700 wrote to memory of 108	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	27
PID 1700 wrote to memory of 108	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	27
PID 1700 wrote to memory of 1640	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	28
PID 1700 wrote to memory of 1640	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	28
PID 1700 wrote to memory of 1640	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	28
PID 1700 wrote to memory of 1640	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	28
PID 1700 wrote to memory of 1640	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	28
PID 1700 wrote to memory of 1640	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	28
PID 1700 wrote to memory of 1640	1700	598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe	28

C:\Users\Admin\AppData\Local\Temp\598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe
"C:\Users\Admin\AppData\Local\Temp\598926b45ac3645ea67beaad934ab589a2c76280cf09091160fb1498cc402c6b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:108
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe

Filesize
176KB

MD5
9cd7e55bb0b5fda9580a3a4280242b86

SHA1
ad6f6f72d8cdf1222075b30456f218423dcad96c

SHA256
37eeeb8b49174cd6f97d46e945a2edc95afb2da88ce14070844617ca3848e038

SHA512
50a09c1e43ea0bf1a0e50c536a2f064b42f72445f3d759343ac988053541cea214a266cadb4739f0ea7258e1c7abeec0fd4806adfe9a9c08adc3076501da1304

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe

Filesize
176KB

MD5
9cd7e55bb0b5fda9580a3a4280242b86

SHA1
ad6f6f72d8cdf1222075b30456f218423dcad96c

SHA256
37eeeb8b49174cd6f97d46e945a2edc95afb2da88ce14070844617ca3848e038

SHA512
50a09c1e43ea0bf1a0e50c536a2f064b42f72445f3d759343ac988053541cea214a266cadb4739f0ea7258e1c7abeec0fd4806adfe9a9c08adc3076501da1304

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe

Filesize
136KB

MD5
b49f649215b1ea2b01059e92eb1d084d

SHA1
c8c8afecdfd39cf63f4c562112300cf6f8ef6a0a

SHA256
d1371583342e716d1c8c452ebf090f2ceffa85c0e089cc87a66804835de19df8

SHA512
90a25e6931895aa9036f401ca8cf6165d1c1f4ef4aa7f48da2aacac8255a1e369daaaaa8da24962b3cf75897be4be4bf1c535c90772e792ee817e2f5fce42312

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe

Filesize
136KB

MD5
b49f649215b1ea2b01059e92eb1d084d

SHA1
c8c8afecdfd39cf63f4c562112300cf6f8ef6a0a

SHA256
d1371583342e716d1c8c452ebf090f2ceffa85c0e089cc87a66804835de19df8

SHA512
90a25e6931895aa9036f401ca8cf6165d1c1f4ef4aa7f48da2aacac8255a1e369daaaaa8da24962b3cf75897be4be4bf1c535c90772e792ee817e2f5fce42312

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe

Filesize
176KB

MD5
9cd7e55bb0b5fda9580a3a4280242b86

SHA1
ad6f6f72d8cdf1222075b30456f218423dcad96c

SHA256
37eeeb8b49174cd6f97d46e945a2edc95afb2da88ce14070844617ca3848e038

SHA512
50a09c1e43ea0bf1a0e50c536a2f064b42f72445f3d759343ac988053541cea214a266cadb4739f0ea7258e1c7abeec0fd4806adfe9a9c08adc3076501da1304

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5060263.exe

Filesize
176KB

MD5
9cd7e55bb0b5fda9580a3a4280242b86

SHA1
ad6f6f72d8cdf1222075b30456f218423dcad96c

SHA256
37eeeb8b49174cd6f97d46e945a2edc95afb2da88ce14070844617ca3848e038

SHA512
50a09c1e43ea0bf1a0e50c536a2f064b42f72445f3d759343ac988053541cea214a266cadb4739f0ea7258e1c7abeec0fd4806adfe9a9c08adc3076501da1304

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe

Filesize
136KB

MD5
b49f649215b1ea2b01059e92eb1d084d

SHA1
c8c8afecdfd39cf63f4c562112300cf6f8ef6a0a

SHA256
d1371583342e716d1c8c452ebf090f2ceffa85c0e089cc87a66804835de19df8

SHA512
90a25e6931895aa9036f401ca8cf6165d1c1f4ef4aa7f48da2aacac8255a1e369daaaaa8da24962b3cf75897be4be4bf1c535c90772e792ee817e2f5fce42312

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9602166.exe

Filesize
136KB

MD5
b49f649215b1ea2b01059e92eb1d084d

SHA1
c8c8afecdfd39cf63f4c562112300cf6f8ef6a0a

SHA256
d1371583342e716d1c8c452ebf090f2ceffa85c0e089cc87a66804835de19df8

SHA512
90a25e6931895aa9036f401ca8cf6165d1c1f4ef4aa7f48da2aacac8255a1e369daaaaa8da24962b3cf75897be4be4bf1c535c90772e792ee817e2f5fce42312

Download Submit
memory/108-79-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-89-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-71-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-73-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-75-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-77-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-68-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-81-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-83-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-85-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-87-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-69-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-91-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-93-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-95-0x0000000000710000-0x0000000000722000-memory.dmp

Filesize
72KB

Download
memory/108-67-0x0000000000710000-0x0000000000728000-memory.dmp

Filesize
96KB

Download
memory/108-66-0x0000000004BC0000-0x0000000004C00000-memory.dmp

Filesize
256KB

Download
memory/108-65-0x0000000004BC0000-0x0000000004C00000-memory.dmp

Filesize
256KB

Download
memory/108-64-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/1640-102-0x00000000011F0000-0x0000000001218000-memory.dmp

Filesize
160KB

Download
memory/1640-103-0x00000000072C0000-0x0000000007300000-memory.dmp

Filesize
256KB

Download
memory/1640-104-0x00000000072C0000-0x0000000007300000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads