352494f701b3edc0eeace7d19eb3f4e84cfcaeea898f04af697567333ff4a52b

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1403c3ed752b00b6b44f542fd9971080_NEAS.exe
Size

73KB
MD5

1403c3ed752b00b6b44f542fd9971080
SHA1

8babbb8b216795975c5de813e829613d84f7f3fb
SHA256

352494f701b3edc0eeace7d19eb3f4e84cfcaeea898f04af697567333ff4a52b
SHA512

6962bfa17f340e257f183da536426fbd07164f1b82f9e980902df85f06d238aed9f31529153a7be0f9d2bbcd153912ad325e15f59f24faa8b0e8b3931f1df8a6
SSDEEP

1536:x3jgs+6phKAQx5c895P5Zxuyowea2eJYIuv1iahWuSxaqMXSm3:BTdphKRxR95P5Zhowea2yuv/hWuSxa9t

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ipgutep-med.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\IsInstalled = "1"	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\StubPath = "C:\\Windows\\system32\\agfifok-ocoot.exe"	ipgutep-med.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ouxleaxev.exe"	ipgutep-med.exe

Executes dropped EXE 2 IoCs

pid	Process
2804	ipgutep-med.exe
2304	ipgutep-med.exe

Loads dropped DLL 3 IoCs

pid	Process
2212	1403c3ed752b00b6b44f542fd9971080_NEAS.exe
2212	1403c3ed752b00b6b44f542fd9971080_NEAS.exe
2804	ipgutep-med.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ipgutep-med.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ipgutep-med.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ipgutep-med.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eagboxut.dll"	ipgutep-med.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ipgutep-med.exe	1403c3ed752b00b6b44f542fd9971080_NEAS.exe
File opened for modification	C:\Windows\SysWOW64\ouxleaxev.exe	ipgutep-med.exe
File opened for modification	C:\Windows\SysWOW64\ipgutep-med.exe	ipgutep-med.exe
File created	C:\Windows\SysWOW64\agfifok-ocoot.exe	ipgutep-med.exe
File opened for modification	C:\Windows\SysWOW64\eagboxut.dll	ipgutep-med.exe
File created	C:\Windows\SysWOW64\eagboxut.dll	ipgutep-med.exe
File created	C:\Windows\SysWOW64\ipgutep-med.exe	1403c3ed752b00b6b44f542fd9971080_NEAS.exe
File created	C:\Windows\SysWOW64\ouxleaxev.exe	ipgutep-med.exe
File opened for modification	C:\Windows\SysWOW64\agfifok-ocoot.exe	ipgutep-med.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2304	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe
2804	ipgutep-med.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	ipgutep-med.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2804	2212	1403c3ed752b00b6b44f542fd9971080_NEAS.exe	28
PID 2212 wrote to memory of 2804	2212	1403c3ed752b00b6b44f542fd9971080_NEAS.exe	28
PID 2212 wrote to memory of 2804	2212	1403c3ed752b00b6b44f542fd9971080_NEAS.exe	28
PID 2212 wrote to memory of 2804	2212	1403c3ed752b00b6b44f542fd9971080_NEAS.exe	28
PID 2804 wrote to memory of 436	2804	ipgutep-med.exe	5
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 2304	2804	ipgutep-med.exe	29
PID 2804 wrote to memory of 2304	2804	ipgutep-med.exe	29
PID 2804 wrote to memory of 2304	2804	ipgutep-med.exe	29
PID 2804 wrote to memory of 2304	2804	ipgutep-med.exe	29
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21
PID 2804 wrote to memory of 1208	2804	ipgutep-med.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\1403c3ed752b00b6b44f542fd9971080_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\1403c3ed752b00b6b44f542fd9971080_NEAS.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\ipgutep-med.exe
    "C:\Windows\SysWOW64\ipgutep-med.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\ipgutep-med.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\agfifok-ocoot.exe

Filesize
73KB

MD5
570928da94eb2a79636a1112ee28cd45

SHA1
3c88e0e57ff6baa1fde3f6a3418dab4586632ee0

SHA256
e06ffd2933a657905f2eb9ce848955bd17b48fbb8dd8ef6989dd8eee080cbb11

SHA512
f9b33da61a9cac0f04b17470f5e44df7a94b9abd533bd154a4dcbb57c553bcc6f66ee7b295af5eee73141c2f5ca94e51501a6f8acbb43c134b670493246cc645

Download Submit
C:\Windows\SysWOW64\eagboxut.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ouxleaxev.exe

Filesize
74KB

MD5
f77cefc3c617b23d6e5de61f8c7ba23d

SHA1
7524c6b11c95e3609d78a7c43239f062fe70edc6

SHA256
2437275f74b44bce4e34502780e66b4cc7b45008fb6871ee03de819f3b07296b

SHA512
b4ab89c71397d838f58d7663091afe40d87e6e0ca9bc578611490be627a314a9f564884654b80c10bb8a7c3d6994fb036659938de17c749df27ee5a1094679f8

Download Submit
\Windows\SysWOW64\ipgutep-med.exe

Filesize
71KB

MD5
adf943844b6dceeb2d3f8f34c1b76d70

SHA1
703ef552f58cc3d6c92b8d41bb36c22a1ade91bb

SHA256
e6eb0d16eb9fbe6ff0ea1082db45f4fc5db64d5614159a7afeb81039835b0f7d

SHA512
c1449cf6d0f9499abe10ca1de4668a34b34153a0ab5c925db3f69009ec0810c9d8b3a075a69437e9eb2fd67e2a0a1cf7fddcdab683cb701b0f8ee1ab8c9836f4

Download Submit
memory/2212-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2304-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2804-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download