b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9

General

Target

b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe
Size

71KB
MD5

50e3f2e853f6f69a9f4ca9379b8190cd
SHA1

eb4d46e9e38d0b1b2011ca48c2cf1d46e51e4573
SHA256

b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9
SHA512

60de78c7726dccac26739298806b035a8e7d00a7f2931417298d189847e6ea57d89718949f179949169f24d45b89300cb102b0f5374a631027a4c279e653b163
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl60SA:Olg35GTslA5t3/w870V

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

inteabeah.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	inteabeah.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	inteabeah.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	inteabeah.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	inteabeah.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

inteabeah.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}	inteabeah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	inteabeah.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\IsInstalled = "1"	inteabeah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\StubPath = "C:\\Windows\\system32\\arxikop.exe"	inteabeah.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

inteabeah.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	inteabeah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	inteabeah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ifhoobeg.exe"	inteabeah.exe

Executes dropped EXE 2 IoCs

Processes:

inteabeah.exeinteabeah.exe

pid process

2388 inteabeah.exe
2592 inteabeah.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

inteabeah.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	inteabeah.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	inteabeah.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	inteabeah.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	inteabeah.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

inteabeah.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	inteabeah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	inteabeah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	inteabeah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ilhooduh.dll"	inteabeah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	inteabeah.exe

Drops file in System32 directory 9 IoCs

Processes:

inteabeah.exeb2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ilhooduh.dll	inteabeah.exe
File opened for modification	C:\Windows\SysWOW64\inteabeah.exe	b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe
File created	C:\Windows\SysWOW64\inteabeah.exe	b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe
File opened for modification	C:\Windows\SysWOW64\ifhoobeg.exe	inteabeah.exe
File created	C:\Windows\SysWOW64\ifhoobeg.exe	inteabeah.exe
File opened for modification	C:\Windows\SysWOW64\arxikop.exe	inteabeah.exe
File created	C:\Windows\SysWOW64\arxikop.exe	inteabeah.exe
File opened for modification	C:\Windows\SysWOW64\ilhooduh.dll	inteabeah.exe
File opened for modification	C:\Windows\SysWOW64\inteabeah.exe	inteabeah.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

inteabeah.exeinteabeah.exe

pid	process
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2592	inteabeah.exe
2592	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe
2388	inteabeah.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exeinteabeah.exe

description	pid	process
Token: SeDebugPrivilege	1616	b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe
Token: SeDebugPrivilege	2388	inteabeah.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exeinteabeah.exe

description	pid	process	target process
PID 1616 wrote to memory of 2388	1616	b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe	inteabeah.exe
PID 1616 wrote to memory of 2388	1616	b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe	inteabeah.exe
PID 1616 wrote to memory of 2388	1616	b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe	inteabeah.exe
PID 2388 wrote to memory of 2592	2388	inteabeah.exe	inteabeah.exe
PID 2388 wrote to memory of 2592	2388	inteabeah.exe	inteabeah.exe
PID 2388 wrote to memory of 2592	2388	inteabeah.exe	inteabeah.exe
PID 2388 wrote to memory of 612	2388	inteabeah.exe	winlogon.exe
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE
PID 2388 wrote to memory of 3300	2388	inteabeah.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3300

C:\Users\Admin\AppData\Local\Temp\b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe
"C:\Users\Admin\AppData\Local\Temp\b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\inteabeah.exe
"C:\Windows\system32\inteabeah.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\inteabeah.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\arxikop.exe

Filesize
73KB

MD5
cc9f5de37903b8f7726d51d34472a9f2

SHA1
17c51bb50ee1e20287769c4953188d81c023b838

SHA256
4bf27a912689acf973792e2ad90c133b86ce1a82dbb358e39ceb8a39b3a40263

SHA512
d6bad981db0118f4638eb76dc5167a2296c2c5c39cfb4ae506aaf857464e677c7826bf49d3d8e212aeb90a6e60777411ec716fdc88a0e97443a0708856186a32

Download Submit
C:\Windows\SysWOW64\ifhoobeg.exe

Filesize
74KB

MD5
24f3a5670ee287d81d8c5c7c3c4e94fe

SHA1
3ec5dabd83130bce89b27bcb62d8079f8e515c83

SHA256
f0db13316b71690819a6fc5dff6493b2c6deb579996edf650e8bbfdd4f9d5ffa

SHA512
844d20e4e399da0358b7754288b0c3b9a0b94233ea006add1299e7520bfab2089161d5e5ff3bef960afe49f5ca90401d6b98436f062faac5c53163bc778bd1a9

Download Submit
C:\Windows\SysWOW64\ilhooduh.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\inteabeah.exe

Filesize
71KB

MD5
50e3f2e853f6f69a9f4ca9379b8190cd

SHA1
eb4d46e9e38d0b1b2011ca48c2cf1d46e51e4573

SHA256
b2affb49b8de845b88fff5d2b3912fa3f3aa5772df2e1a9c36ec0bafea3f76d9

SHA512
60de78c7726dccac26739298806b035a8e7d00a7f2931417298d189847e6ea57d89718949f179949169f24d45b89300cb102b0f5374a631027a4c279e653b163

Download Submit
memory/1616-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2388-46-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2592-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads