352494f701b3edc0eeace7d19eb3f4e84cfcaeea898f04af697567333ff4a52b

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1403c3ed752b00b6b44f542fd9971080_NEAS.exe
Size

73KB
MD5

1403c3ed752b00b6b44f542fd9971080
SHA1

8babbb8b216795975c5de813e829613d84f7f3fb
SHA256

352494f701b3edc0eeace7d19eb3f4e84cfcaeea898f04af697567333ff4a52b
SHA512

6962bfa17f340e257f183da536426fbd07164f1b82f9e980902df85f06d238aed9f31529153a7be0f9d2bbcd153912ad325e15f59f24faa8b0e8b3931f1df8a6
SSDEEP

1536:x3jgs+6phKAQx5c895P5Zxuyowea2eJYIuv1iahWuSxaqMXSm3:BTdphKRxR95P5Zhowea2yuv/hWuSxa9t

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ipgutep-med.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50594457-4747-5545-5059-445747475545}	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50594457-4747-5545-5059-445747475545}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50594457-4747-5545-5059-445747475545}\IsInstalled = "1"	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50594457-4747-5545-5059-445747475545}\StubPath = "C:\\Windows\\system32\\agfifok-ocoot.exe"	ipgutep-med.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ouxleaxev.exe"	ipgutep-med.exe

Executes dropped EXE 2 IoCs

pid	Process
4204	ipgutep-med.exe
2036	ipgutep-med.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ipgutep-med.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ipgutep-med.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ipgutep-med.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ipgutep-med.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ipgutep-med.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eagboxut.dll"	ipgutep-med.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ouxleaxev.exe	ipgutep-med.exe
File created	C:\Windows\SysWOW64\agfifok-ocoot.exe	ipgutep-med.exe
File opened for modification	C:\Windows\SysWOW64\eagboxut.dll	ipgutep-med.exe
File created	C:\Windows\SysWOW64\eagboxut.dll	ipgutep-med.exe
File opened for modification	C:\Windows\SysWOW64\ipgutep-med.exe	ipgutep-med.exe
File opened for modification	C:\Windows\SysWOW64\ipgutep-med.exe	1403c3ed752b00b6b44f542fd9971080_NEAS.exe
File created	C:\Windows\SysWOW64\ipgutep-med.exe	1403c3ed752b00b6b44f542fd9971080_NEAS.exe
File opened for modification	C:\Windows\SysWOW64\ouxleaxev.exe	ipgutep-med.exe
File opened for modification	C:\Windows\SysWOW64\agfifok-ocoot.exe	ipgutep-med.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
2036	ipgutep-med.exe
2036	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe
4204	ipgutep-med.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	ipgutep-med.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4204	1940	1403c3ed752b00b6b44f542fd9971080_NEAS.exe	83
PID 1940 wrote to memory of 4204	1940	1403c3ed752b00b6b44f542fd9971080_NEAS.exe	83
PID 1940 wrote to memory of 4204	1940	1403c3ed752b00b6b44f542fd9971080_NEAS.exe	83
PID 4204 wrote to memory of 2036	4204	ipgutep-med.exe	84
PID 4204 wrote to memory of 2036	4204	ipgutep-med.exe	84
PID 4204 wrote to memory of 2036	4204	ipgutep-med.exe	84
PID 4204 wrote to memory of 616	4204	ipgutep-med.exe	5
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56
PID 4204 wrote to memory of 3412	4204	ipgutep-med.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3412
- C:\Users\Admin\AppData\Local\Temp\1403c3ed752b00b6b44f542fd9971080_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\1403c3ed752b00b6b44f542fd9971080_NEAS.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\ipgutep-med.exe
    "C:\Windows\SysWOW64\ipgutep-med.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\SysWOW64\ipgutep-med.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\agfifok-ocoot.exe

Filesize
73KB

MD5
dd1026cd2c19825c381ffed0dd370c03

SHA1
0ea341819fa50d924e75b557cff68914a1c7d750

SHA256
3365ee75cdc349c985dc36141eed39c8652bdfa118737b80e510163715e43da8

SHA512
c5de631985c8d4203acb14e80d9b898436c6fc0ba54a0aff86eb0938ac8a0f6e433a0402f10c03f3b023f54f93dee2dd5f777cdcf69a792cbc50a72cf6fae00c

Download Submit
C:\Windows\SysWOW64\eagboxut.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ipgutep-med.exe

Filesize
71KB

MD5
adf943844b6dceeb2d3f8f34c1b76d70

SHA1
703ef552f58cc3d6c92b8d41bb36c22a1ade91bb

SHA256
e6eb0d16eb9fbe6ff0ea1082db45f4fc5db64d5614159a7afeb81039835b0f7d

SHA512
c1449cf6d0f9499abe10ca1de4668a34b34153a0ab5c925db3f69009ec0810c9d8b3a075a69437e9eb2fd67e2a0a1cf7fddcdab683cb701b0f8ee1ab8c9836f4

Download Submit
C:\Windows\SysWOW64\ouxleaxev.exe

Filesize
74KB

MD5
f9ab7ccd69b1fb6168ccac57195e310e

SHA1
767b5259d9f26eab17de3955499846fac3b99b89

SHA256
36df18ac53fd7be4e286edf680d5df3994fb2e5d510a81c77c79dd73723990b5

SHA512
a229887f62fe31bf2fa6781d1c71a3e5cf7c5f648480ce7bc6522d73e9d246f4461ecb53a1eb6558d78632dc2c65dd44308ca24aed3297ee079ee54c036aacd6

Download Submit
memory/1940-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2036-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4204-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download