c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1

General

Target

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
Size

70KB
MD5

267763ab56153b11459ad352dd3b8154
SHA1

f3e6ea4feb6f514f338f7e243812973186d928f7
SHA256

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1
SHA512

5ce83b0e87cbc16248f580bc1820e37664c77cb4a2a20125c1b64da9e3d2026ce049e3571010c6a857239a243ddf9103794147d374968797278b40da8bd401be
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8vj:Olg35GTslA5t3/w8r

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	irbarev.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\IsInstalled = "1"	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\StubPath = "C:\\Windows\\system32\\afxacev-oudoot.exe"	irbarev.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\uvkoatim-xeas.exe"	irbarev.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	irbarev.exe

Executes dropped EXE 2 IoCs

Processes:

irbarev.exeirbarev.exe

pid process

2908 irbarev.exe
1996 irbarev.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	irbarev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	irbarev.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

irbarev.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\anheahoat-odex.dll"	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	irbarev.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	irbarev.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	irbarev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	irbarev.exe

Drops file in System32 directory 9 IoCs

Processes:

irbarev.exec5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe

description	ioc	process
File created	C:\Windows\SysWOW64\anheahoat-odex.dll	irbarev.exe
File opened for modification	C:\Windows\SysWOW64\irbarev.exe	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
File opened for modification	C:\Windows\SysWOW64\uvkoatim-xeas.exe	irbarev.exe
File created	C:\Windows\SysWOW64\uvkoatim-xeas.exe	irbarev.exe
File opened for modification	C:\Windows\SysWOW64\afxacev-oudoot.exe	irbarev.exe
File created	C:\Windows\SysWOW64\afxacev-oudoot.exe	irbarev.exe
File opened for modification	C:\Windows\SysWOW64\anheahoat-odex.dll	irbarev.exe
File opened for modification	C:\Windows\SysWOW64\irbarev.exe	irbarev.exe
File created	C:\Windows\SysWOW64\irbarev.exe	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

irbarev.exeirbarev.exe

pid	process
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
1996	irbarev.exe
1996	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe
2908	irbarev.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exeirbarev.exe

description	pid	process
Token: SeDebugPrivilege	3020	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
Token: SeDebugPrivilege	2908	irbarev.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exeirbarev.exe

description	pid	process	target process
PID 3020 wrote to memory of 2908	3020	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe	irbarev.exe
PID 3020 wrote to memory of 2908	3020	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe	irbarev.exe
PID 3020 wrote to memory of 2908	3020	c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe	irbarev.exe
PID 2908 wrote to memory of 608	2908	irbarev.exe	winlogon.exe
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 1996	2908	irbarev.exe	irbarev.exe
PID 2908 wrote to memory of 1996	2908	irbarev.exe	irbarev.exe
PID 2908 wrote to memory of 1996	2908	irbarev.exe	irbarev.exe
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE
PID 2908 wrote to memory of 3436	2908	irbarev.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436

C:\Users\Admin\AppData\Local\Temp\c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe
"C:\Users\Admin\AppData\Local\Temp\c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\irbarev.exe
"C:\Windows\system32\irbarev.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\irbarev.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2700,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:4240

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\afxacev-oudoot.exe
Filesize
73KB

MD5
85d962917958a84a46accc4e43c90f5d

SHA1
d59ea74828859aea701d3a72b1dfe4a6eb730f67

SHA256
8ba99ec74e20c778e1f0df20530ec2c1ee67373962d5bfc2b60beb698567964b

SHA512
5bfb3c833e492d042a83c656ff8e4f3324ccf01043bee07dc2f58044596a6d6f49875d0336ee5e943c454b436a855f954c9083ef877ae9d907a2fa18875cc2ad

Download Submit
C:\Windows\SysWOW64\anheahoat-odex.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\irbarev.exe
Filesize
70KB

MD5
267763ab56153b11459ad352dd3b8154

SHA1
f3e6ea4feb6f514f338f7e243812973186d928f7

SHA256
c5b0e84880d34a47115712f9400b14c14714cad8cbc4f6cc90dd8c54fc55a4a1

SHA512
5ce83b0e87cbc16248f580bc1820e37664c77cb4a2a20125c1b64da9e3d2026ce049e3571010c6a857239a243ddf9103794147d374968797278b40da8bd401be

Download Submit
C:\Windows\SysWOW64\uvkoatim-xeas.exe
Filesize
74KB

MD5
6ec31f2d51ff3f3a651755a154f056a9

SHA1
b6f7f49acf17bd467a2cb4ab8f70772f11dab2d0

SHA256
85818bdc299f574b625a29acbaa45e9f9830c3d239f97a85f5f4a625362ecc10

SHA512
0182358617af25ccb7cf62524e2f8acaba9490b3d1498ca311e6dcb55e2f43917dd2cdbd1ec96ae610dc0465e9c52e51be7357b78f78bcb4c439e1a075eadc78

Download Submit
memory/1996-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2908-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3020-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads