79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81

Analysis

max time kernel
149s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe
Size

69KB
MD5

f6f5fc7bb900ec98408b793003df319b
SHA1

77ce66b1ff85230acbcd7d9ea42db42be7c252d7
SHA256

79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81
SHA512

057153418ad942b4966c91760848bfa05bc94164f851a8ef5748988003e99fc6814f26f34cc1eb109d41071028c931785219d50f2f8875c4ca57f21f01d50569
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8VU:Olg35GTslA5t3/w8VU

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eadsuxok.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eadsuxok.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eadsuxok.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eadsuxok.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54}	eadsuxok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	eadsuxok.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54}\IsInstalled = "1"	eadsuxok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54}\StubPath = "C:\\Windows\\system32\\ubbumat.exe"	eadsuxok.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	eadsuxok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	eadsuxok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\absoaroop.exe"	eadsuxok.exe

Executes dropped EXE 2 IoCs

pid	Process
3552	eadsuxok.exe
3432	eadsuxok.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eadsuxok.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eadsuxok.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eadsuxok.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eadsuxok.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	eadsuxok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ouxkeavoag.dll"	eadsuxok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	eadsuxok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	eadsuxok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	eadsuxok.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ubbumat.exe	eadsuxok.exe
File opened for modification	C:\Windows\SysWOW64\eadsuxok.exe	79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe
File opened for modification	C:\Windows\SysWOW64\absoaroop.exe	eadsuxok.exe
File opened for modification	C:\Windows\SysWOW64\ubbumat.exe	eadsuxok.exe
File opened for modification	C:\Windows\SysWOW64\ouxkeavoag.dll	eadsuxok.exe
File created	C:\Windows\SysWOW64\ouxkeavoag.dll	eadsuxok.exe
File opened for modification	C:\Windows\SysWOW64\eadsuxok.exe	eadsuxok.exe
File created	C:\Windows\SysWOW64\eadsuxok.exe	79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe
File created	C:\Windows\SysWOW64\absoaroop.exe	eadsuxok.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3432	eadsuxok.exe
3432	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe
3552	eadsuxok.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe
Token: SeDebugPrivilege	3552	eadsuxok.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3552	4116	79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe	84
PID 4116 wrote to memory of 3552	4116	79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe	84
PID 4116 wrote to memory of 3552	4116	79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe	84
PID 3552 wrote to memory of 3432	3552	eadsuxok.exe	85
PID 3552 wrote to memory of 3432	3552	eadsuxok.exe	85
PID 3552 wrote to memory of 3432	3552	eadsuxok.exe	85
PID 3552 wrote to memory of 632	3552	eadsuxok.exe	5
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56
PID 3552 wrote to memory of 3468	3552	eadsuxok.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3468
- C:\Users\Admin\AppData\Local\Temp\79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe
  "C:\Users\Admin\AppData\Local\Temp\79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\eadsuxok.exe
    "C:\Windows\system32\eadsuxok.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\SysWOW64\eadsuxok.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\absoaroop.exe

Filesize
72KB

MD5
b6a812655b67708d5a291b7cca435f79

SHA1
049974bb9096c8250d3a458dcf245bc519f2ce8d

SHA256
6fc9301182da19444e8f44ade68854092b5e8d0f88baeafede80140dfeff41ef

SHA512
489b91b132939fb52131407281059e7b46e4c132743da0bc5b2667568fa23128b2dfd2eb11efe9c481dceb821e3b0174f070d181d0fe9ba0546a05fc7bd684cf

Download Submit
C:\Windows\SysWOW64\eadsuxok.exe

Filesize
69KB

MD5
f6f5fc7bb900ec98408b793003df319b

SHA1
77ce66b1ff85230acbcd7d9ea42db42be7c252d7

SHA256
79c20c9eea62d8bf622cd04090dd046fcc98406a2a049540920f5a42b2090e81

SHA512
057153418ad942b4966c91760848bfa05bc94164f851a8ef5748988003e99fc6814f26f34cc1eb109d41071028c931785219d50f2f8875c4ca57f21f01d50569

Download Submit
C:\Windows\SysWOW64\ouxkeavoag.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ubbumat.exe

Filesize
71KB

MD5
1cdd8f1055bc187689a3b8ff42b32771

SHA1
b2eefa1d7fba9bf45aa572b8868cb4010709d396

SHA256
841e3ed03e4476a80d500cd12d5ec1917491d4923c6724fe6fcb16a2fcc527ae

SHA512
f6101c52220cdd03f81de29d43387357518dd20828b619c42e30b92334b778501f19bb14056ee69c41f0db87eb59990fb8e660a1c37944e52491200247a2e695

Download Submit
memory/4116-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download