Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 22:23

General

  • Target

    Aeonixx.exe

  • Size

    907KB

  • MD5

    554025c57d014fd5ed8ab159c96da159

  • SHA1

    2295d41aae469f8252c872eab15f7b5fcd85593c

  • SHA256

    7634e00a8aa848b561d2d18d78b1bd9fb2f02380418fb8b6b8b36ee4a201106f

  • SHA512

    125dce70da69479503f6cd42a16518bfd25b993b58499059703ffd8761dfeea71421d5a212ccddd84663e2ec464eb60128c07154d3a4db07fabe31906225a11c

  • SSDEEP

    12288:C4j4mGk/gKAsEu0Q07J4TpiQlO0Qcuvmxn0HOBJ7V:C2icgKAo0h0piQlO0QkxnRBJ5

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe
    "C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
      "C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
        "C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Users\Admin\AppData\Local\Temp\dllhost.exe
          "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1424
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
            5⤵
            • Views/modifies file attributes
            PID:4396
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2528
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell Set-MpPreference -DisableRealtimeMonitoring $true
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4456
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c sc query windefend
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\SysWOW64\sc.exe
              sc query windefend
              6⤵
              • Launches sc.exe
              PID:4780
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c sc stop windefend
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3140
            • C:\Windows\SysWOW64\sc.exe
              sc stop windefend
              6⤵
              • Launches sc.exe
              PID:4924
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c sc delete windefend
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2128
            • C:\Windows\SysWOW64\sc.exe
              sc delete windefend
              6⤵
              • Launches sc.exe
              PID:3692
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2248
            • C:\Windows\SysWOW64\reg.exe
              reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
              6⤵
              • UAC bypass
              • Modifies registry key
              PID:116
      • C:\Users\Admin\AppData\Local\Temp\S.EXE
        "C:\Users\Admin\AppData\Local\Temp\S.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c pause
          4⤵
            PID:4748

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE

      Filesize

      849KB

      MD5

      0b7321cbbce655bb14c3737973936d8a

      SHA1

      3fbedbf411835e0d54593ae2fe938679f2f5a858

      SHA256

      b13a4f5dc328fb50971d5579f8d32ca7af2b9cf5118999e033ff227242a04edd

      SHA512

      82ee9dafd3948702da5eef1237270828257177f237115921b96d9d604901e0ce291d82562e20c3e0ad5473bd88615559fca2253a603c229f480b4fec746f4b34

    • C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE

      Filesize

      54KB

      MD5

      dcc788ade743525d6922369a9b1cc1d9

      SHA1

      4c100d13f4115f64bbdcc47ffb4f60d50ea9edde

      SHA256

      1a82a1b8db2e35e967a2f463292337e08717251b3e836bf1ffa20815b25037c9

      SHA512

      67faa32ffb6a426f2626384629ac75083da881f549efe7b42c4d3ad915d93e1f2b07a10d952d9b7079b21964f66a8e5c8adb9a9e5fe59040b4dc5a5447c4fb79

    • C:\Users\Admin\AppData\Local\Temp\S.EXE

      Filesize

      742KB

      MD5

      3dbda3d47ec35af319228ebe3677e743

      SHA1

      0c3033b7568875bb6041c8eaf7eefb065f2f138e

      SHA256

      3d860b0b79377ea570b774977ac1d0976a5ce20c3a71ff67a9b91be84384fd9e

      SHA512

      348f308e96400a4abf2f820ecfaff4c9bb3690b6a60cd1f0376913d0cf01af836a78c5df4af0d2fe95d0fa9186cbf6eefc1b2ef75c021b48572457ff273d9f74

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_omouhicb.he0.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1936-23-0x0000000073C32000-0x0000000073C33000-memory.dmp

      Filesize

      4KB

    • memory/1936-25-0x0000000073C30000-0x00000000741E1000-memory.dmp

      Filesize

      5.7MB

    • memory/1936-26-0x0000000073C30000-0x00000000741E1000-memory.dmp

      Filesize

      5.7MB

    • memory/1936-36-0x0000000073C30000-0x00000000741E1000-memory.dmp

      Filesize

      5.7MB

    • memory/4456-52-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

      Filesize

      120KB

    • memory/4456-66-0x0000000006EC0000-0x0000000006F63000-memory.dmp

      Filesize

      652KB

    • memory/4456-41-0x0000000005890000-0x00000000058F6000-memory.dmp

      Filesize

      408KB

    • memory/4456-40-0x00000000057B0000-0x0000000005816000-memory.dmp

      Filesize

      408KB

    • memory/4456-38-0x0000000004FD0000-0x00000000055F8000-memory.dmp

      Filesize

      6.2MB

    • memory/4456-51-0x0000000005900000-0x0000000005C54000-memory.dmp

      Filesize

      3.3MB

    • memory/4456-37-0x00000000048F0000-0x0000000004926000-memory.dmp

      Filesize

      216KB

    • memory/4456-53-0x0000000005F00000-0x0000000005F4C000-memory.dmp

      Filesize

      304KB

    • memory/4456-54-0x00000000064A0000-0x00000000064D2000-memory.dmp

      Filesize

      200KB

    • memory/4456-55-0x000000006EB80000-0x000000006EBCC000-memory.dmp

      Filesize

      304KB

    • memory/4456-65-0x0000000006E90000-0x0000000006EAE000-memory.dmp

      Filesize

      120KB

    • memory/4456-39-0x0000000005650000-0x0000000005672000-memory.dmp

      Filesize

      136KB

    • memory/4456-67-0x0000000007830000-0x0000000007EAA000-memory.dmp

      Filesize

      6.5MB

    • memory/4456-68-0x00000000071F0000-0x000000000720A000-memory.dmp

      Filesize

      104KB

    • memory/4456-69-0x0000000007260000-0x000000000726A000-memory.dmp

      Filesize

      40KB

    • memory/4456-70-0x0000000007470000-0x0000000007506000-memory.dmp

      Filesize

      600KB

    • memory/4456-71-0x00000000073F0000-0x0000000007401000-memory.dmp

      Filesize

      68KB

    • memory/4456-72-0x0000000007430000-0x000000000743E000-memory.dmp

      Filesize

      56KB

    • memory/4456-73-0x0000000007440000-0x0000000007454000-memory.dmp

      Filesize

      80KB

    • memory/4456-74-0x0000000007530000-0x000000000754A000-memory.dmp

      Filesize

      104KB

    • memory/4456-75-0x0000000007510000-0x0000000007518000-memory.dmp

      Filesize

      32KB