8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4

General

Target

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
Size

71KB
MD5

694c3f87e27746986b5cace09a1f9a9c
SHA1

3d4b301600e5cb6c174f41b4f48fc7799c3df968
SHA256

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4
SHA512

ba36599d8eae4fb697f4b0752be062989b24098d7d83f048178625a8dd46959ae8c801716649dd6f7736ec3a5d7d95f802bb491925761a50737761bebbbbb6ac
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl8:Olg35GTslA5t3/w83

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eknaxoot-cat.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\IsInstalled = "1"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\StubPath = "C:\\Windows\\system32\\ifloakid-adoot.exe"	eknaxoot-cat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	eknaxoot-cat.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eavbucok.exe"	eknaxoot-cat.exe

Executes dropped EXE 2 IoCs

Processes:

eknaxoot-cat.exeeknaxoot-cat.exe

pid process

976 eknaxoot-cat.exe
4688 eknaxoot-cat.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eknaxoot-cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eknaxoot-cat.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

eknaxoot-cat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	eknaxoot-cat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eavmoveav.dll"	eknaxoot-cat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	eknaxoot-cat.exe

Drops file in System32 directory 9 IoCs

Processes:

eknaxoot-cat.exe8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe

description	ioc	process
File created	C:\Windows\SysWOW64\eavbucok.exe	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\ifloakid-adoot.exe	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\eavmoveav.dll	eknaxoot-cat.exe
File created	C:\Windows\SysWOW64\eavmoveav.dll	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\eknaxoot-cat.exe	eknaxoot-cat.exe
File opened for modification	C:\Windows\SysWOW64\eknaxoot-cat.exe	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
File created	C:\Windows\SysWOW64\eknaxoot-cat.exe	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
File opened for modification	C:\Windows\SysWOW64\eavbucok.exe	eknaxoot-cat.exe
File created	C:\Windows\SysWOW64\ifloakid-adoot.exe	eknaxoot-cat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eknaxoot-cat.exeeknaxoot-cat.exe

pid	process
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
4688	eknaxoot-cat.exe
4688	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe
976	eknaxoot-cat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exeeknaxoot-cat.exe

description	pid	process
Token: SeDebugPrivilege	588	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
Token: SeDebugPrivilege	976	eknaxoot-cat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exeeknaxoot-cat.exe

description	pid	process	target process
PID 588 wrote to memory of 976	588	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe	eknaxoot-cat.exe
PID 588 wrote to memory of 976	588	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe	eknaxoot-cat.exe
PID 588 wrote to memory of 976	588	8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe	eknaxoot-cat.exe
PID 976 wrote to memory of 608	976	eknaxoot-cat.exe	winlogon.exe
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 4688	976	eknaxoot-cat.exe	eknaxoot-cat.exe
PID 976 wrote to memory of 4688	976	eknaxoot-cat.exe	eknaxoot-cat.exe
PID 976 wrote to memory of 4688	976	eknaxoot-cat.exe	eknaxoot-cat.exe
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE
PID 976 wrote to memory of 3472	976	eknaxoot-cat.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe
"C:\Users\Admin\AppData\Local\Temp\8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\eknaxoot-cat.exe
"C:\Windows\system32\eknaxoot-cat.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\eknaxoot-cat.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\eavbucok.exe

Filesize
74KB

MD5
8cef92a90f94960882f11374aeac01dc

SHA1
0b873077a920663917e3d2c1d9cbb1ae1505b432

SHA256
226f1c756ef6ea9a26a8aa9076f079873c2acfc81de16e3ba45d3f5554686166

SHA512
1a4fd13f5ee09d0b799b06aa3239f865d89dc2587153ec89958a7096915d96548f6fd310dc3f9dc927f01ed877a7247d5434c01494cc0923a96a0585c03d7c09

Download Submit
C:\Windows\SysWOW64\eavmoveav.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\eknaxoot-cat.exe

Filesize
71KB

MD5
694c3f87e27746986b5cace09a1f9a9c

SHA1
3d4b301600e5cb6c174f41b4f48fc7799c3df968

SHA256
8e2828c2596bf626138a22e644d4473ced1bafc5ee60a4961cd594d765eb92d4

SHA512
ba36599d8eae4fb697f4b0752be062989b24098d7d83f048178625a8dd46959ae8c801716649dd6f7736ec3a5d7d95f802bb491925761a50737761bebbbbb6ac

Download Submit
C:\Windows\SysWOW64\ifloakid-adoot.exe

Filesize
73KB

MD5
251522b8f1489ea1b6805e205d259d56

SHA1
07c1b94bf2ca40b2de9d49689f8bd99a96c0e032

SHA256
845664fe3ee26d0ea015d85857edc9f9e3f7a83185ead833a65dd873ffd6e458

SHA512
146c5d62a1eb0f308cef7e3dd7f9d0c8a8bd9cd662388fd059a4e8bff60b77846ee060439ff77be09177be019b1b4b6cca4c15951c0c88205097f872c496d368

Download Submit
memory/588-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/976-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4688-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads