d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe
Size 73KB
Sample240614-e71kysvfqg
SHA256 d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86
MD5 ac28c2506b65cb361235bbd865300468
SHA1 7a3c782663b61a4d42101df0dec0191e1f51001d
SHA512 75a980250886065070a1b8b8d07a7f18cec0f3d1f0df760a75b3edad83d00005f005ee09b1cb42f634c4be2ae40c66d41947c67d5e59edef6b236804a9bc8aa3
SSDEEP 1536:xU9NVM6oqQg9lOkOYmxCibH6n2VY7WMezC:e9NVDvlOrjxH6IYKMem
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	etcucos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	etcucos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	etcucos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	etcucos.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\StubPath = "C:\\Windows\\system32\\ummoarob.exe"	etcucos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}	etcucos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	etcucos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\IsInstalled = "1"	etcucos.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	etcucos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	etcucos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oxteatut.exe"	etcucos.exe

Executes dropped EXE 2 IoCs

pid	Process
4048	etcucos.exe
4752	etcucos.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	etcucos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	etcucos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	etcucos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	etcucos.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\oukroocoos.dll"	etcucos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	etcucos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	etcucos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	etcucos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	etcucos.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\etcucos.exe	d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe
File opened for modification	C:\Windows\SysWOW64\oxteatut.exe	etcucos.exe
File created	C:\Windows\SysWOW64\oxteatut.exe	etcucos.exe
File opened for modification	C:\Windows\SysWOW64\oukroocoos.dll	etcucos.exe
File opened for modification	C:\WINDOWS\SysWOW64\etcucos.exe	d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe
File opened for modification	C:\Windows\SysWOW64\ummoarob.exe	etcucos.exe
File created	C:\Windows\SysWOW64\ummoarob.exe	etcucos.exe
File created	C:\Windows\SysWOW64\oukroocoos.dll	etcucos.exe
File opened for modification	C:\WINDOWS\SysWOW64\etcucos.exe	etcucos.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4752	etcucos.exe
4752	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe
4048	etcucos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	etcucos.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4048	628	d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe	91
PID 628 wrote to memory of 4048	628	d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe	91
PID 628 wrote to memory of 4048	628	d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe	91
PID 4048 wrote to memory of 4752	4048	etcucos.exe	92
PID 4048 wrote to memory of 4752	4048	etcucos.exe	92
PID 4048 wrote to memory of 4752	4048	etcucos.exe	92
PID 4048 wrote to memory of 632	4048	etcucos.exe	5
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57
PID 4048 wrote to memory of 3268	4048	etcucos.exe	57

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3268
- C:\Users\Admin\AppData\Local\Temp\d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe
  "C:\Users\Admin\AppData\Local\Temp\d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\WINDOWS\SysWOW64\etcucos.exe
    "C:\WINDOWS\SysWOW64\etcucos.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\WINDOWS\SysWOW64\etcucos.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1516 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

etcucos.exe

Path C:\Windows\SysWOW64\etcucos.exe
Size 71KB
SHA256 2ce3773113d1a8b9341e16590c83dc96128727c38d45880de7b98112d6204e63
MD5 714728387675b76543e187d1d6863940
SHA1 80096027d69a6f2abad63ed3ce81b4d35f2eb1bb
SHA512 fd7972c99d901d8e340b9896807036fb6014fc80851307c777467ffdf05ed967a02b675e421ac3c0aed846fa92a703321c7acf7a8db959541c9195a1f96d0206
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slOgHX:Olg35GTslA5t3/w8K3
MD5 SHA1 SHA512 SSDEEP

Submit Download

oukroocoos.dll

Path C:\Windows\SysWOW64\oukroocoos.dll
Size 5KB
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxteatut.exe

Path C:\Windows\SysWOW64\oxteatut.exe
Size 74KB
SHA256 1d85f3bcf5476a1d51980635663c0b418d5db3604b57da9be65ebd63ad336b92
MD5 203e5c0356a7a6a76a78ee4c286b9967
SHA1 8c319b3982f44e7bb98ba52f4a3839c689d995a2
SHA512 102b065ca758ad09f287360c7c34b1e4eabaa419a7325e15f80bc93efd9ccf51c052f1f5cc582f57c5a7d2b482dc6a8ef68febb9a23c4997e853898cecf3dfee
SSDEEP 1536:14R9KzUD5X66zFOa2INL0U/zDDiGPsMI7MPeDm5EMiD:2KzAXXzFt2INJ/4MPuqBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

ummoarob.exe

Path C:\Windows\SysWOW64\ummoarob.exe
Size 73KB
SHA256 fc65c6225801d1180a4ee53a74869f61e2a75a59a1dbc985d2584fc58404ad08
MD5 a5a507bb89ebc345caa1fea6ef68fc3a
SHA1 1eafc660c553b07701d4af3ec2130bce2184b200
SHA512 d682cbf4f697dc95f7c1aa66e33632fba5860c2328894705a31d54249e8cd4fbb238a81285c5ceb1bdfb492988042eb85a8af321d5383adc9a2a69e2ed89394f
SSDEEP 1536:xnQYxd5ngUaB4tcVsfDGwZSk3QDTcFMxTGigP+LN3P78XsGyelTf4JTk:f1EvMCTyI/ksGySz4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-3-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/4048-35-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4752-42-0x0000000000400000-0x0000000000414000-memory.dmp

Download