8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4

General

Target

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
Size

71KB
MD5

694c3f87e27746986b5cace09a1f9a9c
SHA1

3d4b301600e5cb6c174f41b4f48fc7799c3df968
SHA256

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4
SHA512

ba36599d8eae4fb697f4b0752be062989b24098d7d83f048178625a8dd46959ae8c801716649dd6f7736ec3a5d7d95f802bb491925761a50737761bebbbbb6ac
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl8:Olg35GTslA5t3/w83

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eknaxoot-cat.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\ifloakid-adoot.exe"	eknaxoot-cat.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eavbucok.exe"	eknaxoot-cat.exe

Executes dropped EXE 2 IoCs

Processes:

eknaxoot-cat.exeeknaxoot-cat.exe

pid process

2972 eknaxoot-cat.exe
2616 eknaxoot-cat.exe

Loads dropped DLL 3 IoCs

Processes:

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exeeknaxoot-cat.exe

pid	process
844	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
844	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
2972	eknaxoot-cat.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eknaxoot-cat.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	eknaxoot-cat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eavmoveav.dll"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	eknaxoot-cat.exe

Drops file in System32 directory 9 IoCs

Processes:

eknaxoot-cat.exe8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\eavbucok.exe	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\ifloakid-adoot.exe	eknaxoot-cat.exe
File created	C:\Windows\SysWOW64\ifloakid-adoot.exe	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\eavmoveav.dll	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\eknaxoot-cat.exe	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
File created	C:\Windows\SysWOW64\eknaxoot-cat.exe	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
File created	C:\Windows\SysWOW64\eavbucok.exe	eknaxoot-cat.exe
File created	C:\Windows\SysWOW64\eavmoveav.dll	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\eknaxoot-cat.exe	eknaxoot-cat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eknaxoot-cat.exeeknaxoot-cat.exe

pid	process
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2616	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe
2972	eknaxoot-cat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exeeknaxoot-cat.exe

description	pid	process
Token: SeDebugPrivilege	844	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
Token: SeDebugPrivilege	2972	eknaxoot-cat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exeeknaxoot-cat.exe

description	pid	process	target process
PID 844 wrote to memory of 2972	844	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe	eknaxoot-cat.exe
PID 844 wrote to memory of 2972	844	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe	eknaxoot-cat.exe
PID 844 wrote to memory of 2972	844	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe	eknaxoot-cat.exe
PID 844 wrote to memory of 2972	844	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe	eknaxoot-cat.exe
PID 2972 wrote to memory of 2616	2972	eknaxoot-cat.exe	eknaxoot-cat.exe
PID 2972 wrote to memory of 2616	2972	eknaxoot-cat.exe	eknaxoot-cat.exe
PID 2972 wrote to memory of 2616	2972	eknaxoot-cat.exe	eknaxoot-cat.exe
PID 2972 wrote to memory of 2616	2972	eknaxoot-cat.exe	eknaxoot-cat.exe
PID 2972 wrote to memory of 436	2972	eknaxoot-cat.exe	winlogon.exe
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE
PID 2972 wrote to memory of 1216	2972	eknaxoot-cat.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
"C:\Users\Admin\AppData\Local\Temp\8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\eknaxoot-cat.exe
"C:\Windows\system32\eknaxoot-cat.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\SysWOW64\eknaxoot-cat.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\eavbucok.exe

Filesize
74KB

MD5
ea0797c49ce2f6d4e9d3438c8b24fc02

SHA1
cae65f8ad37ad34f2e5051762f3ffb826cca23b9

SHA256
604dbeafae086957de4d8b9cebd7431dec979cc7f764a79957c248b8c4ef5d5a

SHA512
05921d9fbdb05fd1e52e3c28cf961366e289594c515268ad555f385ca422a19e6bfce0474ff9a2bb737265c5fb1428b0ca549c583d95a5120a7007073c0332eb

Download Submit
C:\Windows\SysWOW64\eavmoveav.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ifloakid-adoot.exe

Filesize
73KB

MD5
4be03ef1bef51c12a5ecff51e809453f

SHA1
4415d9dcd759fdb3eea5800f782255dcd12e85a4

SHA256
ef3772717013bc7531cc012f200866a333d96cf29ecd78907787c6c68872744a

SHA512
450a96bfde77168241893aee3da5b58f341bb209c9d0dd48c13307bc38bae10b648578804306ece924ccf42a0f756929c7e3580b7dc62dacee00f34746ae9930

Download Submit
\Windows\SysWOW64\eknaxoot-cat.exe

Filesize
71KB

MD5
694c3f87e27746986b5cace09a1f9a9c

SHA1
3d4b301600e5cb6c174f41b4f48fc7799c3df968

SHA256
8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4

SHA512
ba36599d8eae4fb697f4b0752be062989b24098d7d83f048178625a8dd46959ae8c801716649dd6f7736ec3a5d7d95f802bb491925761a50737761bebbbbb6ac

Download Submit
memory/844-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2616-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2972-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads