ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995

General

Target

ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe
Size

70KB
MD5

ff138fdbc1666a43d3a03ef67e6ce5dd
SHA1

f322f61e9f572d9e9cbc971dbb475bcbd58376c7
SHA256

ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995
SHA512

c1e23a8aa602b452b9e12eba50293841141069408bd80027163de3fc7496f1d3701bc5f8d5fbfc3e10095f465da779f96c6feb592656ceb354398e30762ff790
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8B:Olg35GTslA5t3/w8B

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

itgoanag-ideas.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	itgoanag-ideas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	itgoanag-ideas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	itgoanag-ideas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	itgoanag-ideas.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

itgoanag-ideas.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\StubPath = "C:\\Windows\\system32\\ourlerev.exe"	itgoanag-ideas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}	itgoanag-ideas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	itgoanag-ideas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\IsInstalled = "1"	itgoanag-ideas.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

itgoanag-ideas.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	itgoanag-ideas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	itgoanag-ideas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ovxacav-iveab.exe"	itgoanag-ideas.exe

Executes dropped EXE 2 IoCs

Processes:

itgoanag-ideas.exeitgoanag-ideas.exe

pid process

2012 itgoanag-ideas.exe
2548 itgoanag-ideas.exe

Loads dropped DLL 3 IoCs

Processes:

ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exeitgoanag-ideas.exe

pid	process
2128	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe
2128	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe
2012	itgoanag-ideas.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

itgoanag-ideas.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	itgoanag-ideas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	itgoanag-ideas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	itgoanag-ideas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	itgoanag-ideas.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

itgoanag-ideas.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	itgoanag-ideas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\mxeapac-eanix.dll"	itgoanag-ideas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	itgoanag-ideas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	itgoanag-ideas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	itgoanag-ideas.exe

Drops file in System32 directory 9 IoCs

Processes:

itgoanag-ideas.exeac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mxeapac-eanix.dll	itgoanag-ideas.exe
File created	C:\Windows\SysWOW64\itgoanag-ideas.exe	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe
File opened for modification	C:\Windows\SysWOW64\ourlerev.exe	itgoanag-ideas.exe
File created	C:\Windows\SysWOW64\ourlerev.exe	itgoanag-ideas.exe
File created	C:\Windows\SysWOW64\mxeapac-eanix.dll	itgoanag-ideas.exe
File opened for modification	C:\Windows\SysWOW64\itgoanag-ideas.exe	itgoanag-ideas.exe
File opened for modification	C:\Windows\SysWOW64\itgoanag-ideas.exe	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe
File opened for modification	C:\Windows\SysWOW64\ovxacav-iveab.exe	itgoanag-ideas.exe
File created	C:\Windows\SysWOW64\ovxacav-iveab.exe	itgoanag-ideas.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

itgoanag-ideas.exeitgoanag-ideas.exe

pid	process
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2548	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe
2012	itgoanag-ideas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exeitgoanag-ideas.exe

description	pid	process
Token: SeDebugPrivilege	2128	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe
Token: SeDebugPrivilege	2012	itgoanag-ideas.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exeitgoanag-ideas.exe

description	pid	process	target process
PID 2128 wrote to memory of 2012	2128	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe	itgoanag-ideas.exe
PID 2128 wrote to memory of 2012	2128	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe	itgoanag-ideas.exe
PID 2128 wrote to memory of 2012	2128	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe	itgoanag-ideas.exe
PID 2128 wrote to memory of 2012	2128	ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe	itgoanag-ideas.exe
PID 2012 wrote to memory of 436	2012	itgoanag-ideas.exe	winlogon.exe
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 2548	2012	itgoanag-ideas.exe	itgoanag-ideas.exe
PID 2012 wrote to memory of 2548	2012	itgoanag-ideas.exe	itgoanag-ideas.exe
PID 2012 wrote to memory of 2548	2012	itgoanag-ideas.exe	itgoanag-ideas.exe
PID 2012 wrote to memory of 2548	2012	itgoanag-ideas.exe	itgoanag-ideas.exe
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE
PID 2012 wrote to memory of 1184	2012	itgoanag-ideas.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184

C:\Users\Admin\AppData\Local\Temp\ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe
"C:\Users\Admin\AppData\Local\Temp\ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\itgoanag-ideas.exe
"C:\Windows\system32\itgoanag-ideas.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\itgoanag-ideas.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mxeapac-eanix.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ourlerev.exe

Filesize
73KB

MD5
280c3ebc5f71b7603b9af4182f840b66

SHA1
39d62f721b262ef970df6bbd65bc04fde9c8c29b

SHA256
af85947c56fdad7bb47c95fdf434ab98ef4b4d4c3664a34d22245c226417d102

SHA512
03024b981d46944c7a914eb1e492b8c053c95e5d1285c3fdd6c1424b4d2709631491d897eed80be6d5d017876e7040c65f57c1e48ac4058bfe1e123f97b51c28

Download Submit
C:\Windows\SysWOW64\ovxacav-iveab.exe

Filesize
74KB

MD5
532897f0e0e1a1dce8f3dbf3b5b2cc03

SHA1
8ba99a197c7e172e99486608d4829441271ef03b

SHA256
232063518b6e8e862f4001578fc1b524986b38aedbff9d0dcd2a6675145c6f59

SHA512
25a4abfdae5ebfba30442d582af82a991222ce6ee95bedece245882f9e104f1a3a55391e1e0ce334ca87439fd1c72fe0727eca7cfa42b161355e94938e60ce70

Download Submit
\Windows\SysWOW64\itgoanag-ideas.exe

Filesize
70KB

MD5
ff138fdbc1666a43d3a03ef67e6ce5dd

SHA1
f322f61e9f572d9e9cbc971dbb475bcbd58376c7

SHA256
ac455700a8dc36559b0d70e13baa71bbc083a0f00b4ee370ee28983a28265995

SHA512
c1e23a8aa602b452b9e12eba50293841141069408bd80027163de3fc7496f1d3701bc5f8d5fbfc3e10095f465da779f96c6feb592656ceb354398e30762ff790

Download Submit
memory/2012-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2128-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2548-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads