6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe
Size

73KB
MD5

988d5b863b1262cb9c61cf7293f11a17
SHA1

693e2311c370529f8d7e62a4d55619cdfdfbce4c
SHA256

6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17
SHA512

88670c626e05f99dd278907ff4278a220cd07fa4dc95b6f3b81675b489d2c7d4ea17681e7eb880e54e05a55dd5784901a7f5e701a77108484b36fdad9c2966a0
SSDEEP

768:x/njmDFaDK3pNRRyLjYF0vpXOdWpKER5e0VI9UofCKjK5vOEGAQebEoi:x7O7pNHMjY2vpw4CovNG1

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ecpekos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ecpekos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ecpekos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ecpekos.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}	ecpekos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ecpekos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\IsInstalled = "1"	ecpekos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\StubPath = "C:\\Windows\\system32\\ubbuxoor-acom.exe"	ecpekos.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ecpekos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ecpekos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\isfavoox-eamoab.exe"	ecpekos.exe

Executes dropped EXE 2 IoCs

pid	Process
2984	ecpekos.exe
1980	ecpekos.exe

Loads dropped DLL 3 IoCs

pid	Process
2868	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe
2868	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe
2984	ecpekos.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ecpekos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ecpekos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ecpekos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ecpekos.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\mleasic.dll"	ecpekos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ecpekos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ecpekos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ecpekos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ecpekos.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ecpekos.exe	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe
File created	C:\Windows\SysWOW64\isfavoox-eamoab.exe	ecpekos.exe
File created	C:\Windows\SysWOW64\ubbuxoor-acom.exe	ecpekos.exe
File opened for modification	C:\Windows\SysWOW64\mleasic.dll	ecpekos.exe
File opened for modification	C:\Windows\SysWOW64\ecpekos.exe	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe
File opened for modification	C:\Windows\SysWOW64\isfavoox-eamoab.exe	ecpekos.exe
File opened for modification	C:\Windows\SysWOW64\ubbuxoor-acom.exe	ecpekos.exe
File created	C:\Windows\SysWOW64\mleasic.dll	ecpekos.exe
File opened for modification	C:\Windows\SysWOW64\ecpekos.exe	ecpekos.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
1980	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe
2984	ecpekos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	ecpekos.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2984	2868	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe	28
PID 2868 wrote to memory of 2984	2868	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe	28
PID 2868 wrote to memory of 2984	2868	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe	28
PID 2868 wrote to memory of 2984	2868	6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe	28
PID 2984 wrote to memory of 436	2984	ecpekos.exe	5
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1980	2984	ecpekos.exe	29
PID 2984 wrote to memory of 1980	2984	ecpekos.exe	29
PID 2984 wrote to memory of 1980	2984	ecpekos.exe	29
PID 2984 wrote to memory of 1980	2984	ecpekos.exe	29
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21
PID 2984 wrote to memory of 1180	2984	ecpekos.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180
- C:\Users\Admin\AppData\Local\Temp\6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe
  "C:\Users\Admin\AppData\Local\Temp\6bc1f6e5c34253246e5404b198af94f98488681edd56e1ad6ba140a98d350a17.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\ecpekos.exe
    "C:\Windows\SysWOW64\ecpekos.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\ecpekos.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\isfavoox-eamoab.exe

Filesize
74KB

MD5
d64b0d295b55160fb29d36c753a7f1f9

SHA1
8dd15ddd2ab7389a7b44fdb183c03e0e72a8d56e

SHA256
2d615e31319ed9e78ef9f338af5c3a47327e5a8852b9ecc059355e644618fcc9

SHA512
c560fa5c540aa7ffde7fc08369fcc3c0151c353215ba4ac12dd4a85006fc29ff37866e037a06b780a9935b919b854015dcdd58ca47e8e74ae2991e97c449514a

Download Submit
C:\Windows\SysWOW64\mleasic.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ubbuxoor-acom.exe

Filesize
73KB

MD5
72a858c2e1eaed4c35b6a2e04397e7e1

SHA1
19b8fa042a2a38c85276657e5b2329c65d61b9cd

SHA256
90a2a8f743cdc5d8d89024cc0fc1a3c14aa0637b95b9f5dc9aca6317a6381a16

SHA512
6650556b46181a2bd12f36fbead20d1be26ad469fae1b3ac91bf828c9a7e338fde004782dfed5a4fae0bb946a367b540f67015526fbc30e3a9d8d2bfd39c3633

Download Submit
\Windows\SysWOW64\ecpekos.exe

Filesize
71KB

MD5
7ea3ed7717f2816bd41600e729421fb9

SHA1
384362535248cd30e28a8924d13232350dbe7c33

SHA256
5777535b3e2429a8a6546a1467da2449d9762ce36fb3b75dfa1ef50328089183

SHA512
4b3c232785f741f16a39f35913a2269f0cfb0c08a65a0b5f0505dfc79ea5e18251143f90d0328c21b7e9eebd3177f29403808d5fb6412ebad38dd9a25e8ec47b

Download Submit
memory/1980-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2868-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2984-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download