c7521925c8e9143932e7bda1d7ab50dfd3f89464554bbccb87c1417599d76ecb

General

Target

Ql4Tm89.exe
Size

525KB
MD5

a7aa2a123ba1da99005727e64825ae83
SHA1

ed00120809f7f8409b41076b11a996e4f7359355
SHA256

c7521925c8e9143932e7bda1d7ab50dfd3f89464554bbccb87c1417599d76ecb
SHA512

5aede6655964fa58189e490542ead269aa0a64452c52fd1578c2df37098a19e88389a74101430d3a1a8fbe1789d16ccc70a795eadabdd0f68544cf47e0f034a7
SSDEEP

12288:wMrZy90SiPm6Tv6HtLE7s3PavYTxkaV/U4ZhtUhSQbL/7bt8Rzmc0:5y/iP7UMs/amxxNU4LtUEub7bkv0

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Executes dropped EXE 1 IoCs

pid	Process
868	1gu07ix0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Ql4Tm89.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 772	868	1gu07ix0.exe	73

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	868	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
772	AppLaunch.exe
772	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	772	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 868	2436	Ql4Tm89.exe	71
PID 2436 wrote to memory of 868	2436	Ql4Tm89.exe	71
PID 2436 wrote to memory of 868	2436	Ql4Tm89.exe	71
PID 868 wrote to memory of 832	868	1gu07ix0.exe	72
PID 868 wrote to memory of 832	868	1gu07ix0.exe	72
PID 868 wrote to memory of 832	868	1gu07ix0.exe	72
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73
PID 868 wrote to memory of 772	868	1gu07ix0.exe	73

C:\Users\Admin\AppData\Local\Temp\Ql4Tm89.exe
"C:\Users\Admin\AppData\Local\Temp\Ql4Tm89.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 592
    3⤵
    - Program crash
    PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1gu07ix0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
memory/772-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/772-10-0x0000000073380000-0x0000000073A6E000-memory.dmp

Filesize
6.9MB

Download
memory/772-19-0x0000000073380000-0x0000000073A6E000-memory.dmp

Filesize
6.9MB

Download
memory/772-34-0x0000000073380000-0x0000000073A6E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads