5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a

General

Target

5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe
Size

70KB
MD5

2610b75b039d757dca12ebe99ce12f92
SHA1

040bd781473f1d597a434f0762223911d4dc2063
SHA256

5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a
SHA512

668191ad2233516480938df4c6b3e0f92f6bd3ab004fd6168efaea289ae60da9827abe79c93ceb0915a81b132f8a943eb3f49343b40b0d0c54136cff709e0014
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slYV3w:Olg35GTslA5t3/w8h3w

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

ilhuric.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ilhuric.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ilhuric.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ilhuric.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ilhuric.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ilhuric.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ilhuric.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\IsInstalled = "1"	ilhuric.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\StubPath = "C:\\Windows\\system32\\avfeteat.exe"	ilhuric.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}	ilhuric.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ilhuric.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ilhuric.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ilhuric.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\nhucud.exe"	ilhuric.exe

Executes dropped EXE 2 IoCs

Processes:

ilhuric.exeilhuric.exe

pid process

4364 ilhuric.exe
1476 ilhuric.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

ilhuric.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ilhuric.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ilhuric.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ilhuric.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ilhuric.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ilhuric.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\oultotooh.dll"	ilhuric.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ilhuric.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ilhuric.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ilhuric.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ilhuric.exe

Drops file in System32 directory 9 IoCs

Processes:

ilhuric.exe5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nhucud.exe	ilhuric.exe
File opened for modification	C:\Windows\SysWOW64\oultotooh.dll	ilhuric.exe
File opened for modification	C:\Windows\SysWOW64\ilhuric.exe	5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe
File created	C:\Windows\SysWOW64\ilhuric.exe	5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe
File opened for modification	C:\Windows\SysWOW64\nhucud.exe	ilhuric.exe
File opened for modification	C:\Windows\SysWOW64\ilhuric.exe	ilhuric.exe
File opened for modification	C:\Windows\SysWOW64\avfeteat.exe	ilhuric.exe
File created	C:\Windows\SysWOW64\avfeteat.exe	ilhuric.exe
File created	C:\Windows\SysWOW64\oultotooh.dll	ilhuric.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ilhuric.exeilhuric.exe

pid	process
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
1476	ilhuric.exe
1476	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe
4364	ilhuric.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exeilhuric.exe

description	pid	process
Token: SeDebugPrivilege	2736	5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe
Token: SeDebugPrivilege	4364	ilhuric.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exeilhuric.exe

description	pid	process	target process
PID 2736 wrote to memory of 4364	2736	5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe	ilhuric.exe
PID 2736 wrote to memory of 4364	2736	5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe	ilhuric.exe
PID 2736 wrote to memory of 4364	2736	5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe	ilhuric.exe
PID 4364 wrote to memory of 604	4364	ilhuric.exe	winlogon.exe
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 1476	4364	ilhuric.exe	ilhuric.exe
PID 4364 wrote to memory of 1476	4364	ilhuric.exe	ilhuric.exe
PID 4364 wrote to memory of 1476	4364	ilhuric.exe	ilhuric.exe
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE
PID 4364 wrote to memory of 3492	4364	ilhuric.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3492
- C:\Users\Admin\AppData\Local\Temp\5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe
  "C:\Users\Admin\AppData\Local\Temp\5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\ilhuric.exe
    "C:\Windows\system32\ilhuric.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\ilhuric.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3904,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\avfeteat.exe

Filesize
73KB

MD5
fe311ba143b8c2edd6df052d144f22f5

SHA1
a9b2d28d569237b428d35ed45bfb1ecc5b2eab3c

SHA256
441f2962ade79c5a092a4c8a3fb884f2a41933d49d1c75b9da369d749dd2f262

SHA512
652f6c2e0b7e00f7435051db4c59faeb8ff6bdf259dae955b2bdbccfb62d2fbbd701954fd8358c617a921abae910d0a2817bd317f125bd156bcb7a8f3d54363f

Download Submit
C:\Windows\SysWOW64\ilhuric.exe

Filesize
70KB

MD5
2610b75b039d757dca12ebe99ce12f92

SHA1
040bd781473f1d597a434f0762223911d4dc2063

SHA256
5e304fdde28dbd519a96ea076f0019f1d3cb8dd29a73dc8b248354a252210f3a

SHA512
668191ad2233516480938df4c6b3e0f92f6bd3ab004fd6168efaea289ae60da9827abe79c93ceb0915a81b132f8a943eb3f49343b40b0d0c54136cff709e0014

Download Submit
C:\Windows\SysWOW64\nhucud.exe

Filesize
74KB

MD5
2b253ccd80f5d529c50fb6d22afe0d26

SHA1
01fded797298522e95f3e23483f76e9edff62ab5

SHA256
5d770812d1daf6b7a4e55bc9507deca9e0e20f37f1563fcae30ef44fcb90627f

SHA512
0e08a04c0c76dec23a22af126edc91533d83a80c2625a4698f83aa208b0e2ebdd3d68390d4f4599c3c94efa1b0b1156d8cbcc15ddb610172aad01fc18e5e1bcc

Download Submit
C:\Windows\SysWOW64\oultotooh.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
memory/1476-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2736-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4364-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads