Analysis
- max time kernel
149s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 00:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe
- Size 70KB
- Sample240604-a15h4sfb2v
- SHA256 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef
- MD5 36c61d27ba4ec7ccebdd33f31e1c7f42
- SHA1 860ceddb461149b323c0269fabbd70846ddb359e
- SHA512 bf49e716dd6129d297cf8f7b8aedecc08b278f6b9489d5ab0a8db3f160bbbd021cf0f0c93203838a86ab8623c68ce08f0c5252bc1dd643b187c6a9e9773306e5
- SSDEEP 1536:x/7ylw2jlA6WBRCJKObnTNBbJ6I4WMJvdDlQDhI5erKT3Fa0:p7H6rbTNSImvplQVIQ0z
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" idxeavet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" idxeavet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" idxeavet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" idxeavet.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743} idxeavet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" idxeavet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\IsInstalled = "1" idxeavet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\StubPath = "C:\\Windows\\system32\\ubboofoor.exe" idxeavet.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe idxeavet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" idxeavet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\xketoac-ofom.exe" idxeavet.exe - Executes dropped EXE 2 IoCs
pid Process 3580 idxeavet.exe 3404 idxeavet.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" idxeavet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" idxeavet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" idxeavet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" idxeavet.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" idxeavet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} idxeavet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify idxeavet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" idxeavet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\aglapoot-coot.dll" idxeavet.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\aglapoot-coot.dll idxeavet.exe File opened for modification C:\Windows\SysWOW64\ubboofoor.exe idxeavet.exe File created C:\Windows\SysWOW64\idxeavet.exe 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe File opened for modification C:\Windows\SysWOW64\xketoac-ofom.exe idxeavet.exe File created C:\Windows\SysWOW64\xketoac-ofom.exe idxeavet.exe File created C:\Windows\SysWOW64\ubboofoor.exe idxeavet.exe File opened for modification C:\Windows\SysWOW64\aglapoot-coot.dll idxeavet.exe File opened for modification C:\Windows\SysWOW64\idxeavet.exe idxeavet.exe File opened for modification C:\Windows\SysWOW64\idxeavet.exe 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3404 idxeavet.exe 3404 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe 3580 idxeavet.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3580 idxeavet.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4984 wrote to memory of 3580 4984 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe 82 PID 4984 wrote to memory of 3580 4984 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe 82 PID 4984 wrote to memory of 3580 4984 9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe 82 PID 3580 wrote to memory of 3404 3580 idxeavet.exe 83 PID 3580 wrote to memory of 3404 3580 idxeavet.exe 83 PID 3580 wrote to memory of 3404 3580 idxeavet.exe 83 PID 3580 wrote to memory of 636 3580 idxeavet.exe 5 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56 PID 3580 wrote to memory of 3368 3580 idxeavet.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:636
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe"C:\Users\Admin\AppData\Local\Temp\9bc10c24ee7904e918417d283a67454976d1f5841c85227bb88ced64f7ae65ef.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\idxeavet.exe"C:\Windows\SysWOW64\idxeavet.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\idxeavet.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3404
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\aglapoot-coot.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\idxeavet.exe
- Size 68KB
- SHA256 86bfe6a4b91197ffeaf29a8c2fa97bb2d9beaf4e23d579e26bd9d76493872843
- MD5 8d5669edc96e52e9bc0e26f2e4f4c198
- SHA1 16d2446f83e1eb34e7596e5d6eb5b17a7a04d0e0
- SHA512 fedd92b3d20092b9960a8b34dc6d8376018ff273479dfba47d64fba719df8aa34d83b5829c7d4a8d141ac4d3d94e6bc8fa71c9338fc75814c37cab9462b8b1d6
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8iN:Olg35GTslA5t3/w8iN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ubboofoor.exe
- Size 70KB
- SHA256 6d8e80600518209596e038c05d3af06dea7e4e79b50cbc4700a553d7cd9c0b67
- MD5 fedce9c2949b0bbeeb0a22fd757a596a
- SHA1 cbe013a1440309da8ab3379135f9dfadeca979b1
- SHA512 6c706254cde33c07d07a9c5e3c2bd210c7ed80d1339ebd8fa31ec730206a6016278c9ea9ec062ea60b21412665ed9f392d480005914c64653c604bc4d3f46bbf
- SSDEEP 1536:xk8KE3UknVTVpXd4Q2x6H5eCU8hh/Q/0ATiPGQQPWk//:Tp37VTV5d4Q2xpIhhTA5feS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xketoac-ofom.exe
- Size 71KB
- SHA256 0995d459eb82e621b83003d02fbbb0b8cd9263184ecb4d261c2e009ef95e6011
- MD5 0ddc9e32eeb64bc3c2b63d5325f7cf0d
- SHA1 0c21f7c052b51946ed35b4d2bd993f4ff05b77ec
- SHA512 b8c3188540b9d70c1de9aa16ef4ffbcffe48a0c3c8f2bc6ed64e3b31c7e89c25cc3f2bd38e680368ed44ec0a5b9405c2c28bce32dac93191d52d8ab00c049dd0
- SSDEEP 768:hZZ6Zyf9ei1kK4GJrydY8O8oM+9asPW+JXr7QILPcMLopRgVdfbII8CQ7QHt08FI:14K8Y1XVVkgVdrI7Q3FIskXJlOO
- MD5 SHA1 SHA512 SSDEEP