a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77

General

Target

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
Size

71KB
MD5

9624335e6ef6e7130f112c945b0f43d7
SHA1

b2dc3815a28fa4448f94f4e8d1f2aa7117697f33
SHA256

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77
SHA512

af6422baab829dcd14e1a022d76cfef3c4b8af116d8bc9a36fd51e095c6e3e593635801ac42cd2e2fb053d7582138e759504f1f5a17705d0cc580220b5555dd9
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slo:Olg35GTslA5t3/w8d

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eadgobos.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\etlehib-adeab.exe"	eadgobos.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\abdoogex.exe"	eadgobos.exe

Executes dropped EXE 2 IoCs

Processes:

eadgobos.exeeadgobos.exe

pid process

2736 eadgobos.exe
2536 eadgobos.exe

Loads dropped DLL 3 IoCs

Processes:

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exeeadgobos.exe

pid	process
2744	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
2744	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
2736	eadgobos.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eadgobos.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	eadgobos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ibsubeat-mom.dll"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	eadgobos.exe

Drops file in System32 directory 9 IoCs

Processes:

eadgobos.exea0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\eadgobos.exe	eadgobos.exe
File opened for modification	C:\Windows\SysWOW64\eadgobos.exe	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
File created	C:\Windows\SysWOW64\eadgobos.exe	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
File created	C:\Windows\SysWOW64\abdoogex.exe	eadgobos.exe
File created	C:\Windows\SysWOW64\etlehib-adeab.exe	eadgobos.exe
File opened for modification	C:\Windows\SysWOW64\ibsubeat-mom.dll	eadgobos.exe
File created	C:\Windows\SysWOW64\ibsubeat-mom.dll	eadgobos.exe
File opened for modification	C:\Windows\SysWOW64\abdoogex.exe	eadgobos.exe
File opened for modification	C:\Windows\SysWOW64\etlehib-adeab.exe	eadgobos.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eadgobos.exeeadgobos.exe

pid	process
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2536	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe
2736	eadgobos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exeeadgobos.exe

description	pid	process
Token: SeDebugPrivilege	2744	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
Token: SeDebugPrivilege	2736	eadgobos.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exeeadgobos.exe

description	pid	process	target process
PID 2744 wrote to memory of 2736	2744	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe	eadgobos.exe
PID 2744 wrote to memory of 2736	2744	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe	eadgobos.exe
PID 2744 wrote to memory of 2736	2744	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe	eadgobos.exe
PID 2744 wrote to memory of 2736	2744	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe	eadgobos.exe
PID 2736 wrote to memory of 428	2736	eadgobos.exe	winlogon.exe
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 2536	2736	eadgobos.exe	eadgobos.exe
PID 2736 wrote to memory of 2536	2736	eadgobos.exe	eadgobos.exe
PID 2736 wrote to memory of 2536	2736	eadgobos.exe	eadgobos.exe
PID 2736 wrote to memory of 2536	2736	eadgobos.exe	eadgobos.exe
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE
PID 2736 wrote to memory of 1192	2736	eadgobos.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
"C:\Users\Admin\AppData\Local\Temp\a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\eadgobos.exe
"C:\Windows\system32\eadgobos.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\eadgobos.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\abdoogex.exe
Filesize
74KB

MD5
c334b80123cc2b0bb6a8dda4aafe4130

SHA1
8093fdbf582b7642b6ecb906a669d4846e29114c

SHA256
9eb189d6fc2b55da73b14c19f2e24481df669b07df30060567b2a13d269801e4

SHA512
8b49956061ca02f6c4270f5a93efb65873c9724843481ad70a537413b06b957fa58f052046e36e9f75c1bfa47a84e80cf9ddc290f9f8e35c243c0cac86bbc685

Download Submit
C:\Windows\SysWOW64\etlehib-adeab.exe
Filesize
73KB

MD5
b91daea3f4781f67a98722aa7ae5b0de

SHA1
37c832cd56b5cc97afa021bd4b40c616f295131a

SHA256
8721f52edb0130b9adb81b87bb94ce821c2d41dac9f4ae14d1b07a0b9466e00c

SHA512
06f3f989fe58972c527d68fcc1cbd9a2c1a9fad8171dbe82307cc51ed3c25c9ff99f0b47a04507aa7259190fb4fe27f3a327c2dd366cc1bef85dc681c38eaf09

Download Submit
C:\Windows\SysWOW64\ibsubeat-mom.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\eadgobos.exe
Filesize
71KB

MD5
9624335e6ef6e7130f112c945b0f43d7

SHA1
b2dc3815a28fa4448f94f4e8d1f2aa7117697f33

SHA256
a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77

SHA512
af6422baab829dcd14e1a022d76cfef3c4b8af116d8bc9a36fd51e095c6e3e593635801ac42cd2e2fb053d7582138e759504f1f5a17705d0cc580220b5555dd9

Download Submit
memory/2536-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2736-52-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2744-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads