c7521925c8e9143932e7bda1d7ab50dfd3f89464554bbccb87c1417599d76ecb

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
30-10-2023 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ql4Tm89.exe
Size

525KB
MD5

a7aa2a123ba1da99005727e64825ae83
SHA1

ed00120809f7f8409b41076b11a996e4f7359355
SHA256

c7521925c8e9143932e7bda1d7ab50dfd3f89464554bbccb87c1417599d76ecb
SHA512

5aede6655964fa58189e490542ead269aa0a64452c52fd1578c2df37098a19e88389a74101430d3a1a8fbe1789d16ccc70a795eadabdd0f68544cf47e0f034a7
SSDEEP

12288:wMrZy90SiPm6Tv6HtLE7s3PavYTxkaV/U4ZhtUhSQbL/7bt8Rzmc0:5y/iP7UMs/amxxNU4LtUEub7bkv0

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Executes dropped EXE 1 IoCs

pid	Process
2852	1gu07ix0.exe

Loads dropped DLL 6 IoCs

pid	Process
2256	Ql4Tm89.exe
2256	Ql4Tm89.exe
2852	1gu07ix0.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Ql4Tm89.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2852 set thread context of 2704	2852	1gu07ix0.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2852	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	AppLaunch.exe
2704	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	AppLaunch.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2852	2256	Ql4Tm89.exe	28
PID 2256 wrote to memory of 2852	2256	Ql4Tm89.exe	28
PID 2256 wrote to memory of 2852	2256	Ql4Tm89.exe	28
PID 2256 wrote to memory of 2852	2256	Ql4Tm89.exe	28
PID 2256 wrote to memory of 2852	2256	Ql4Tm89.exe	28
PID 2256 wrote to memory of 2852	2256	Ql4Tm89.exe	28
PID 2256 wrote to memory of 2852	2256	Ql4Tm89.exe	28
PID 2852 wrote to memory of 1968	2852	1gu07ix0.exe	29
PID 2852 wrote to memory of 1968	2852	1gu07ix0.exe	29
PID 2852 wrote to memory of 1968	2852	1gu07ix0.exe	29
PID 2852 wrote to memory of 1968	2852	1gu07ix0.exe	29
PID 2852 wrote to memory of 1968	2852	1gu07ix0.exe	29
PID 2852 wrote to memory of 1968	2852	1gu07ix0.exe	29
PID 2852 wrote to memory of 1968	2852	1gu07ix0.exe	29
PID 2852 wrote to memory of 1756	2852	1gu07ix0.exe	30
PID 2852 wrote to memory of 1756	2852	1gu07ix0.exe	30
PID 2852 wrote to memory of 1756	2852	1gu07ix0.exe	30
PID 2852 wrote to memory of 1756	2852	1gu07ix0.exe	30
PID 2852 wrote to memory of 1756	2852	1gu07ix0.exe	30
PID 2852 wrote to memory of 1756	2852	1gu07ix0.exe	30
PID 2852 wrote to memory of 1756	2852	1gu07ix0.exe	30
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2704	2852	1gu07ix0.exe	31
PID 2852 wrote to memory of 2828	2852	1gu07ix0.exe	32
PID 2852 wrote to memory of 2828	2852	1gu07ix0.exe	32
PID 2852 wrote to memory of 2828	2852	1gu07ix0.exe	32
PID 2852 wrote to memory of 2828	2852	1gu07ix0.exe	32
PID 2852 wrote to memory of 2828	2852	1gu07ix0.exe	32
PID 2852 wrote to memory of 2828	2852	1gu07ix0.exe	32
PID 2852 wrote to memory of 2828	2852	1gu07ix0.exe	32

C:\Users\Admin\AppData\Local\Temp\Ql4Tm89.exe
"C:\Users\Admin\AppData\Local\Temp\Ql4Tm89.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1968
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 288
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
memory/2704-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2704-17-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2704-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2704-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2704-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2704-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2704-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2704-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download