c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1

General

Target

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
Size

70KB
MD5

267763ab56153b11459ad352dd3b8154
SHA1

f3e6ea4feb6f514f338f7e243812973186d928f7
SHA256

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1
SHA512

5ce83b0e87cbc16248f580bc1820e37664c77cb4a2a20125c1b64da9e3d2026ce049e3571010c6a857239a243ddf9103794147d374968797278b40da8bd401be
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8vj:Olg35GTslA5t3/w8r

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	irbarev.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}\StubPath = "C:\\Windows\\system32\\afxacev-oudoot.exe"	irbarev.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}\IsInstalled = "1"	irbarev.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\uvkoatim-xeas.exe"	irbarev.exe

Executes dropped EXE 2 IoCs

Processes:

irbarev.exeirbarev.exe

pid process

2420 irbarev.exe
2212 irbarev.exe

Loads dropped DLL 3 IoCs

Processes:

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exeirbarev.exe

pid	process
2444	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
2444	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
2420	irbarev.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	irbarev.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	irbarev.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\anheahoat-odex.dll"	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	irbarev.exe

Drops file in System32 directory 9 IoCs

Processes:

irbarev.exec5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\irbarev.exe	irbarev.exe
File created	C:\Windows\SysWOW64\irbarev.exe	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
File opened for modification	C:\Windows\SysWOW64\uvkoatim-xeas.exe	irbarev.exe
File created	C:\Windows\SysWOW64\anheahoat-odex.dll	irbarev.exe
File created	C:\Windows\SysWOW64\afxacev-oudoot.exe	irbarev.exe
File opened for modification	C:\Windows\SysWOW64\anheahoat-odex.dll	irbarev.exe
File opened for modification	C:\Windows\SysWOW64\irbarev.exe	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
File created	C:\Windows\SysWOW64\uvkoatim-xeas.exe	irbarev.exe
File opened for modification	C:\Windows\SysWOW64\afxacev-oudoot.exe	irbarev.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

irbarev.exeirbarev.exe

pid	process
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2212	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe
2420	irbarev.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exeirbarev.exe

description	pid	process
Token: SeDebugPrivilege	2444	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
Token: SeDebugPrivilege	2420	irbarev.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exeirbarev.exe

description	pid	process	target process
PID 2444 wrote to memory of 2420	2444	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe	irbarev.exe
PID 2444 wrote to memory of 2420	2444	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe	irbarev.exe
PID 2444 wrote to memory of 2420	2444	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe	irbarev.exe
PID 2444 wrote to memory of 2420	2444	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe	irbarev.exe
PID 2420 wrote to memory of 432	2420	irbarev.exe	winlogon.exe
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 2212	2420	irbarev.exe	irbarev.exe
PID 2420 wrote to memory of 2212	2420	irbarev.exe	irbarev.exe
PID 2420 wrote to memory of 2212	2420	irbarev.exe	irbarev.exe
PID 2420 wrote to memory of 2212	2420	irbarev.exe	irbarev.exe
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE
PID 2420 wrote to memory of 1200	2420	irbarev.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200

C:\Users\Admin\AppData\Local\Temp\c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
"C:\Users\Admin\AppData\Local\Temp\c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\SysWOW64\irbarev.exe
"C:\Windows\system32\irbarev.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\irbarev.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2212

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\afxacev-oudoot.exe
Filesize
73KB

MD5
1fc1be50e8e0c45d234af3571fae5503

SHA1
91b032f97c47ae0ffa8051cd68be7ce2c65ad4f2

SHA256
794e23d9939c2d75d048d6daffa428c82e12e52be4e0e3d2e9bad47eb968a712

SHA512
ce13e697fa5504e8a07c4ef0c119746e3a95a18cd4bcbcae31c7dc4289cd7b326c1f4aeca712595aad89468741c8d0aa2ca789bf9d58e235875d1b8c7fe0ed77

Download Submit
C:\Windows\SysWOW64\anheahoat-odex.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\uvkoatim-xeas.exe
Filesize
74KB

MD5
58aa72afad163ef0c5dc71cf946ec552

SHA1
2f6202441299127a5c343c2fbb2dc964a56342d7

SHA256
35dab4ea087ed977a51c4ebc57a0e07fb2720a679db1e7c18e5cf6f63dac8a24

SHA512
d37d6a45c2becc98292446e28c9499fd3ae753c4a71a5f93e14392fd6d15ac667ca6400689d2ca478d5f59db32ca2ed5a548b6e949f760ec0b395366fb66776f

Download Submit
\Windows\SysWOW64\irbarev.exe
Filesize
70KB

MD5
267763ab56153b11459ad352dd3b8154

SHA1
f3e6ea4feb6f514f338f7e243812973186d928f7

SHA256
c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1

SHA512
5ce83b0e87cbc16248f580bc1820e37664c77cb4a2a20125c1b64da9e3d2026ce049e3571010c6a857239a243ddf9103794147d374968797278b40da8bd401be

Download Submit
memory/2212-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2420-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2444-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads