Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/03/2024, 09:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
virussign.com_999d7e255f9ed7490988cdc221a88892.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
virussign.com_999d7e255f9ed7490988cdc221a88892.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target virussign.com_999d7e255f9ed7490988cdc221a88892.exe
- Size 70KB
- Sample240303-lxr96agg7w
- SHA256 021d6a4237d0ed05adcc40e8ce1d74f8897f497e4f280678b06ae9d7f07fae8a
- MD5 999d7e255f9ed7490988cdc221a88892
- SHA1 da3ee964aefa2b066fa4e66c7c8501f05d02c07a
- SHA512 8872ef709d8933ec3e5ebf7e255ee1c3e16c80295e9f2939429787fb03774bf1454e85221898b5100dad5f5e23780392b07521e26aff7c9b7de76091a3a0352a
- SSDEEP 1536:xQ3YrzjzGabh9X0PCig8Hf7j6iQ3e7Ori:qizj7bhtMC98/7pIe71
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" esrenoap-acoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" esrenoap-acoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" esrenoap-acoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" esrenoap-acoab.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514D5749-5253-4959-514D-574952534959} esrenoap-acoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514D5749-5253-4959-514D-574952534959}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" esrenoap-acoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514D5749-5253-4959-514D-574952534959}\IsInstalled = "1" esrenoap-acoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514D5749-5253-4959-514D-574952534959}\StubPath = "C:\\Windows\\system32\\kfehef-axat.exe" esrenoap-acoab.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe esrenoap-acoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" esrenoap-acoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ocfeaguv-abur.exe" esrenoap-acoab.exe - Executes dropped EXE 2 IoCs
pid Process 3856 esrenoap-acoab.exe 1188 esrenoap-acoab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" esrenoap-acoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" esrenoap-acoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" esrenoap-acoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" esrenoap-acoab.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} esrenoap-acoab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify esrenoap-acoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" esrenoap-acoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\outboovef-eaheas.dll" esrenoap-acoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" esrenoap-acoab.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\esrenoap-acoab.exe esrenoap-acoab.exe File created C:\Windows\SysWOW64\ocfeaguv-abur.exe esrenoap-acoab.exe File opened for modification C:\Windows\SysWOW64\kfehef-axat.exe esrenoap-acoab.exe File opened for modification C:\Windows\SysWOW64\outboovef-eaheas.dll esrenoap-acoab.exe File created C:\Windows\SysWOW64\outboovef-eaheas.dll esrenoap-acoab.exe File opened for modification C:\Windows\SysWOW64\esrenoap-acoab.exe virussign.com_999d7e255f9ed7490988cdc221a88892.exe File created C:\Windows\SysWOW64\esrenoap-acoab.exe virussign.com_999d7e255f9ed7490988cdc221a88892.exe File opened for modification C:\Windows\SysWOW64\ocfeaguv-abur.exe esrenoap-acoab.exe File created C:\Windows\SysWOW64\kfehef-axat.exe esrenoap-acoab.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 1188 esrenoap-acoab.exe 1188 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe 3856 esrenoap-acoab.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3856 esrenoap-acoab.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3824 wrote to memory of 3856 3824 virussign.com_999d7e255f9ed7490988cdc221a88892.exe 89 PID 3824 wrote to memory of 3856 3824 virussign.com_999d7e255f9ed7490988cdc221a88892.exe 89 PID 3824 wrote to memory of 3856 3824 virussign.com_999d7e255f9ed7490988cdc221a88892.exe 89 PID 3856 wrote to memory of 616 3856 esrenoap-acoab.exe 5 PID 3856 wrote to memory of 1188 3856 esrenoap-acoab.exe 90 PID 3856 wrote to memory of 1188 3856 esrenoap-acoab.exe 90 PID 3856 wrote to memory of 1188 3856 esrenoap-acoab.exe 90 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56 PID 3856 wrote to memory of 3408 3856 esrenoap-acoab.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_999d7e255f9ed7490988cdc221a88892.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_999d7e255f9ed7490988cdc221a88892.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\esrenoap-acoab.exe"C:\Windows\SysWOW64\esrenoap-acoab.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\esrenoap-acoab.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1188
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\esrenoap-acoab.exe
- Size 68KB
- SHA256 36c813ef93d923847df356644f156e80785b66d952c41f7aabad15b9bb206c46
- MD5 822fa9692fa0c5f76b512c8ddfe49104
- SHA1 a1887499e04234a6456ecbb9c2df16ecf0660fe1
- SHA512 c00a81e38fff4d69effd04ed5ba1cd4c696d155a9599dbe024fc074015edbe321ddd86bca08030ff9a979a5f5aca11dadba5698a97ba059d43e2effcd32ffabe
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8V:Olg35GTslA5t3/w8V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kfehef-axat.exe
- Size 70KB
- SHA256 eb2f97ab2ea6e885e138b9df2fb1defbde45b47dcac41156a2d850cb890903fb
- MD5 2292d7f7d9d20fa29010e816ccb4a996
- SHA1 83dbf4dcabcce987344bd01f1b4f0a048d7b0b10
- SHA512 3f7863e448f206310877a8a6b18483a685c1bb180e5dfb252bdefa515860f1a61761338ead6cdb1ba4df0b5b74ef5f1c4d6bf1c0cec995c6329c5a58b8b4debc
- SSDEEP 1536:xJrcZa4V5fH01ZJdlUOIV3js6/XyMgjm6Ul0sYnLwDi:j6RRH0IVweitm7lXYnEDi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ocfeaguv-abur.exe
- Size 71KB
- SHA256 0ad52d25d7e8b09904d213c975af928ae6a8ab4f641afd04064ab93ef91813ac
- MD5 e900bde59e3eead4a31823cdc0cc2add
- SHA1 76a5b9a0e17417e8a0e44e73c84d5e4ffa058c18
- SHA512 94932187816ec73d492ce3c35cbab9ca3c6b9ab252a4732cc55c5e0ea370ffa048cc7ca4899d64e784048f9a5330039091553030efaee343b856fc415dd6059d
- SSDEEP 768:hZZ6Zyf9wIh3SDyA0BIy/jIx+TZjUPx80sxCOopBoRxZzq3Yy+gMqMXmDLHr+cSW:1ldDCxGZwPm0/p8xY3clZcsV9s
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\outboovef-eaheas.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP