a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77

General

Target

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
Size

71KB
MD5

9624335e6ef6e7130f112c945b0f43d7
SHA1

b2dc3815a28fa4448f94f4e8d1f2aa7117697f33
SHA256

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77
SHA512

af6422baab829dcd14e1a022d76cfef3c4b8af116d8bc9a36fd51e095c6e3e593635801ac42cd2e2fb053d7582138e759504f1f5a17705d0cc580220b5555dd9
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slo:Olg35GTslA5t3/w8d

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eadgobos.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\IsInstalled = "1"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\StubPath = "C:\\Windows\\system32\\etlehib-adeab.exe"	eadgobos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}	eadgobos.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\abdoogex.exe"	eadgobos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	eadgobos.exe

Executes dropped EXE 2 IoCs

Processes:

eadgobos.exeeadgobos.exe

pid process

1708 eadgobos.exe
1792 eadgobos.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eadgobos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eadgobos.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

eadgobos.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	eadgobos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ibsubeat-mom.dll"	eadgobos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	eadgobos.exe

Drops file in System32 directory 9 IoCs

Processes:

eadgobos.exea0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ibsubeat-mom.dll	eadgobos.exe
File opened for modification	C:\Windows\SysWOW64\eadgobos.exe	eadgobos.exe
File created	C:\Windows\SysWOW64\eadgobos.exe	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
File opened for modification	C:\Windows\SysWOW64\abdoogex.exe	eadgobos.exe
File created	C:\Windows\SysWOW64\abdoogex.exe	eadgobos.exe
File opened for modification	C:\Windows\SysWOW64\etlehib-adeab.exe	eadgobos.exe
File created	C:\Windows\SysWOW64\etlehib-adeab.exe	eadgobos.exe
File created	C:\Windows\SysWOW64\ibsubeat-mom.dll	eadgobos.exe
File opened for modification	C:\Windows\SysWOW64\eadgobos.exe	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eadgobos.exeeadgobos.exe

pid	process
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1792	eadgobos.exe
1792	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe
1708	eadgobos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exeeadgobos.exe

description	pid	process
Token: SeDebugPrivilege	1488	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
Token: SeDebugPrivilege	1708	eadgobos.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exeeadgobos.exe

description	pid	process	target process
PID 1488 wrote to memory of 1708	1488	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe	eadgobos.exe
PID 1488 wrote to memory of 1708	1488	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe	eadgobos.exe
PID 1488 wrote to memory of 1708	1488	a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe	eadgobos.exe
PID 1708 wrote to memory of 612	1708	eadgobos.exe	winlogon.exe
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 1792	1708	eadgobos.exe	eadgobos.exe
PID 1708 wrote to memory of 1792	1708	eadgobos.exe	eadgobos.exe
PID 1708 wrote to memory of 1792	1708	eadgobos.exe	eadgobos.exe
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE
PID 1708 wrote to memory of 3424	1708	eadgobos.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424

C:\Users\Admin\AppData\Local\Temp\a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe
"C:\Users\Admin\AppData\Local\Temp\a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\eadgobos.exe
"C:\Windows\system32\eadgobos.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\eadgobos.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\abdoogex.exe
Filesize
74KB

MD5
3f0a20d80f087c0806029fc1dac1f869

SHA1
0d82ca8563f8d0889b8ab4287e39adababe9716f

SHA256
995f240e50daedc8a1696fd6d00179ca3f5a26c438056f8717347cde8e90a4f1

SHA512
f3859f8e20c5de9b7e643e210880f2632b38b0c17669cba25f063a90542adeef30fe14ed928b2bda9638b38ac632eed53e42e2c3ea29d3580fb29ea9082427ad

Download Submit
C:\Windows\SysWOW64\eadgobos.exe
Filesize
71KB

MD5
9624335e6ef6e7130f112c945b0f43d7

SHA1
b2dc3815a28fa4448f94f4e8d1f2aa7117697f33

SHA256
a0352de05bccf37d102cb875f231bf2717549caea84e82a9204dd031b3311a77

SHA512
af6422baab829dcd14e1a022d76cfef3c4b8af116d8bc9a36fd51e095c6e3e593635801ac42cd2e2fb053d7582138e759504f1f5a17705d0cc580220b5555dd9

Download Submit
C:\Windows\SysWOW64\etlehib-adeab.exe
Filesize
73KB

MD5
201ac6fb81725611452905b15a913a89

SHA1
8cb9139a23488c8716f46af196ffe5236bed458e

SHA256
d6eb788cee4bca33cfe0a8eb1eb774c52f3fb6a1b052c7d769b843f9f4afa6d7

SHA512
9428c7cd3b99f219cdd7053ce32b3a6fac0be1e9c639da4a732b94e506e8a996acdb0d52eff3a9603933a65ac4141ce80f34ee821151f4a35f9f2c4cd64b18c4

Download Submit
C:\Windows\SysWOW64\ibsubeat-mom.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
memory/1488-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1708-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1792-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads