7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5

General

Target

7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe
Size

73KB
MD5

05de2c665f88705c9d3b61a3dd7dbd40
SHA1

0a4130976f40a20547a98fd90acb407e8b697194
SHA256

7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5
SHA512

825798dab15bb8bbe4f9f3b4cee03cd18560bf0d8f6f37bb37b92ee9f1c05481e2241d5d22919edb4dac64de244eee668fe4e0d8169431d3648de3724de3a364
SSDEEP

1536:xKHv1wJKSY3t8c0rbs0N2/DuTLpCSZpPW2:aOJUKsxDuTV/f

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oxboteat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oxboteat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oxboteat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oxboteat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oxboteat.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oxboteat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851}	oxboteat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	oxboteat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851}\IsInstalled = "1"	oxboteat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851}\StubPath = "C:\\Windows\\system32\\oulbineam.exe"	oxboteat.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oxboteat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	oxboteat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	oxboteat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\uhnoopac-adat.exe"	oxboteat.exe

Executes dropped EXE 2 IoCs

Processes:

oxboteat.exeoxboteat.exe

pid process

1732 oxboteat.exe
2160 oxboteat.exe

Loads dropped DLL 3 IoCs

Processes:

7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exeoxboteat.exe

pid	process
2064	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe
2064	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe
1732	oxboteat.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oxboteat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oxboteat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oxboteat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oxboteat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oxboteat.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

oxboteat.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	oxboteat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ukbetix.dll"	oxboteat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	oxboteat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	oxboteat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	oxboteat.exe

Drops file in System32 directory 9 IoCs

Processes:

oxboteat.exe7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\uhnoopac-adat.exe	oxboteat.exe
File created	C:\Windows\SysWOW64\ukbetix.dll	oxboteat.exe
File opened for modification	C:\Windows\SysWOW64\oxboteat.exe	oxboteat.exe
File opened for modification	C:\Windows\SysWOW64\oxboteat.exe	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe
File created	C:\Windows\SysWOW64\oxboteat.exe	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe
File created	C:\Windows\SysWOW64\uhnoopac-adat.exe	oxboteat.exe
File opened for modification	C:\Windows\SysWOW64\oulbineam.exe	oxboteat.exe
File created	C:\Windows\SysWOW64\oulbineam.exe	oxboteat.exe
File opened for modification	C:\Windows\SysWOW64\ukbetix.dll	oxboteat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

oxboteat.exeoxboteat.exe

pid	process
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
2160	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe
1732	oxboteat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

oxboteat.exe

description pid process

Token: SeDebugPrivilege 1732 oxboteat.exe

description	pid	process
Token: SeDebugPrivilege	1732	oxboteat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exeoxboteat.exe

description	pid	process	target process
PID 2064 wrote to memory of 1732	2064	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe	oxboteat.exe
PID 2064 wrote to memory of 1732	2064	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe	oxboteat.exe
PID 2064 wrote to memory of 1732	2064	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe	oxboteat.exe
PID 2064 wrote to memory of 1732	2064	7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe	oxboteat.exe
PID 1732 wrote to memory of 428	1732	oxboteat.exe	winlogon.exe
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 2160	1732	oxboteat.exe	oxboteat.exe
PID 1732 wrote to memory of 2160	1732	oxboteat.exe	oxboteat.exe
PID 1732 wrote to memory of 2160	1732	oxboteat.exe	oxboteat.exe
PID 1732 wrote to memory of 2160	1732	oxboteat.exe	oxboteat.exe
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE
PID 1732 wrote to memory of 1204	1732	oxboteat.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe
"C:\Users\Admin\AppData\Local\Temp\7e693821a1d33b3ec44a19cc8ba037f4c1d96380c08e09d5c3e87dd3599edee5.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\oxboteat.exe
"C:\Windows\SysWOW64\oxboteat.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\oxboteat.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\oulbineam.exe

Filesize
73KB

MD5
85171513e9eefc73c458805726a810ec

SHA1
0e4cd94acad9c34251ae715b6d0dab6f57afbc93

SHA256
61a118f7a1769dba4b795a6f53548b70037188a70a4b0707dfa65a50a04306b7

SHA512
78b20d7f672e4b3965b7cb6d222e5729e42b70c3be0a7fe252af0e5e4991bc8680c96bb1880f052b37a7b80e978f3e6067e1b921a8f778d6bb50eef5f45f3034

Download Submit
C:\Windows\SysWOW64\uhnoopac-adat.exe

Filesize
74KB

MD5
89d1bf1eb191992b47133220556c42d6

SHA1
593382643e3b0e4c28ba7c9d0787611717337c04

SHA256
5899d58a8ed3f9192e6962011d02450b37aebfd209fd8ecd203f5a122af3b2bd

SHA512
19d4d3f7b62d9aef56d95b04d68e287df7f212fb60d6f618e6c95b36ab99c38c295362c4b08c780b303acfe692fb3f7a44f60297e2f11115a679875f19500f68

Download Submit
C:\Windows\SysWOW64\ukbetix.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\oxboteat.exe

Filesize
71KB

MD5
d7c07c3afb12263a2440f79eda27c075

SHA1
0779e484e920dd07639d64c4295599e482b15563

SHA256
39dbf16737e7f2cc21b04050f2fd10cb11cda1943b3f270ab5233bba4487ef90

SHA512
d4a77ea8bbe707baecfe6acffd951defe6ec32916ed5b5731478a755f953ecb0fdead05e245d809a79c5a30bd3d9a01f3771fd4c35eb3f2c5a3bcd7a377925d4

Download Submit
memory/1732-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2064-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2160-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads