Malware Analysis Report

2025-01-22 13:14

Sample ID 240719-2a56hatalq
Target Aeonixx.exe
SHA256 7634e00a8aa848b561d2d18d78b1bd9fb2f02380418fb8b6b8b36ee4a201106f
Tags
njrat evasion execution persistence trojan cs2
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7634e00a8aa848b561d2d18d78b1bd9fb2f02380418fb8b6b8b36ee4a201106f

Threat Level: Known bad

The file Aeonixx.exe was found to be: Known bad.

Malicious Activity Summary

njrat evasion execution persistence trojan cs2

Njrat family

UAC bypass

njRAT/Bladabindi

Stops running service(s)

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-19 22:23

Signatures

Njrat family

njrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-19 22:23

Reported

2024-07-19 22:26

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

njRAT/Bladabindi

trojan njrat

Stops running service(s)

evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\775de7e7e00d15df96207ab529453f70.exe C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\775de7e7e00d15df96207ab529453f70.exe C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\775de7e7e00d15df96207ab529453f70 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\775de7e7e00d15df96207ab529453f70 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\S.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\S.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3140 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
PID 3140 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
PID 3140 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
PID 4972 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
PID 4972 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
PID 4972 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
PID 4972 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\S.EXE
PID 4972 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\S.EXE
PID 4760 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\S.EXE C:\Windows\system32\cmd.exe
PID 4760 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\S.EXE C:\Windows\system32\cmd.exe
PID 1936 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 1936 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 1936 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 1424 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\attrib.exe
PID 1424 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\attrib.exe
PID 1424 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\attrib.exe
PID 1424 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2528 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 4456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1424 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2708 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1424 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3140 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3140 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3140 wrote to memory of 4924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1424 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2128 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2128 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1424 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2248 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2248 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe

"C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe"

C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE

"C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE"

C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE

"C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE"

C:\Users\Admin\AppData\Local\Temp\S.EXE

"C:\Users\Admin\AppData\Local\Temp\S.EXE"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Users\Admin\AppData\Local\Temp\dllhost.exe

"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"

C:\Windows\SysWOW64\attrib.exe

attrib +h "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\cmd.exe

cmd /c sc query windefend

C:\Windows\SysWOW64\sc.exe

sc query windefend

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop windefend

C:\Windows\SysWOW64\sc.exe

sc stop windefend

C:\Windows\SysWOW64\cmd.exe

cmd /c sc delete windefend

C:\Windows\SysWOW64\sc.exe

sc delete windefend

C:\Windows\SysWOW64\cmd.exe

cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
TR 85.108.113.75:1604 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
TR 85.108.113.75:1604 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
TR 85.108.113.75:1604 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
TR 85.108.113.75:1604 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
TR 85.108.113.75:1604 tcp
TR 85.108.113.75:1604 tcp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE

MD5 0b7321cbbce655bb14c3737973936d8a
SHA1 3fbedbf411835e0d54593ae2fe938679f2f5a858
SHA256 b13a4f5dc328fb50971d5579f8d32ca7af2b9cf5118999e033ff227242a04edd
SHA512 82ee9dafd3948702da5eef1237270828257177f237115921b96d9d604901e0ce291d82562e20c3e0ad5473bd88615559fca2253a603c229f480b4fec746f4b34

C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE

MD5 dcc788ade743525d6922369a9b1cc1d9
SHA1 4c100d13f4115f64bbdcc47ffb4f60d50ea9edde
SHA256 1a82a1b8db2e35e967a2f463292337e08717251b3e836bf1ffa20815b25037c9
SHA512 67faa32ffb6a426f2626384629ac75083da881f549efe7b42c4d3ad915d93e1f2b07a10d952d9b7079b21964f66a8e5c8adb9a9e5fe59040b4dc5a5447c4fb79

C:\Users\Admin\AppData\Local\Temp\S.EXE

MD5 3dbda3d47ec35af319228ebe3677e743
SHA1 0c3033b7568875bb6041c8eaf7eefb065f2f138e
SHA256 3d860b0b79377ea570b774977ac1d0976a5ce20c3a71ff67a9b91be84384fd9e
SHA512 348f308e96400a4abf2f820ecfaff4c9bb3690b6a60cd1f0376913d0cf01af836a78c5df4af0d2fe95d0fa9186cbf6eefc1b2ef75c021b48572457ff273d9f74

memory/1936-23-0x0000000073C32000-0x0000000073C33000-memory.dmp

memory/1936-25-0x0000000073C30000-0x00000000741E1000-memory.dmp

memory/1936-26-0x0000000073C30000-0x00000000741E1000-memory.dmp

memory/1936-36-0x0000000073C30000-0x00000000741E1000-memory.dmp

memory/4456-37-0x00000000048F0000-0x0000000004926000-memory.dmp

memory/4456-38-0x0000000004FD0000-0x00000000055F8000-memory.dmp

memory/4456-39-0x0000000005650000-0x0000000005672000-memory.dmp

memory/4456-41-0x0000000005890000-0x00000000058F6000-memory.dmp

memory/4456-40-0x00000000057B0000-0x0000000005816000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_omouhicb.he0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4456-51-0x0000000005900000-0x0000000005C54000-memory.dmp

memory/4456-52-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

memory/4456-53-0x0000000005F00000-0x0000000005F4C000-memory.dmp

memory/4456-54-0x00000000064A0000-0x00000000064D2000-memory.dmp

memory/4456-55-0x000000006EB80000-0x000000006EBCC000-memory.dmp

memory/4456-65-0x0000000006E90000-0x0000000006EAE000-memory.dmp

memory/4456-66-0x0000000006EC0000-0x0000000006F63000-memory.dmp

memory/4456-67-0x0000000007830000-0x0000000007EAA000-memory.dmp

memory/4456-68-0x00000000071F0000-0x000000000720A000-memory.dmp

memory/4456-69-0x0000000007260000-0x000000000726A000-memory.dmp

memory/4456-70-0x0000000007470000-0x0000000007506000-memory.dmp

memory/4456-71-0x00000000073F0000-0x0000000007401000-memory.dmp

memory/4456-72-0x0000000007430000-0x000000000743E000-memory.dmp

memory/4456-73-0x0000000007440000-0x0000000007454000-memory.dmp

memory/4456-74-0x0000000007530000-0x000000000754A000-memory.dmp

memory/4456-75-0x0000000007510000-0x0000000007518000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-19 22:23

Reported

2024-07-19 22:26

Platform

win7-20240704-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

njRAT/Bladabindi

trojan njrat

Stops running service(s)

evasion execution

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\775de7e7e00d15df96207ab529453f70.exe C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\775de7e7e00d15df96207ab529453f70.exe C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\775de7e7e00d15df96207ab529453f70 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\775de7e7e00d15df96207ab529453f70 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\S.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1188 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
PID 1188 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
PID 1188 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
PID 1188 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE
PID 344 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
PID 344 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
PID 344 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
PID 344 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE
PID 344 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\S.EXE
PID 344 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\S.EXE
PID 344 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\S.EXE
PID 344 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE C:\Users\Admin\AppData\Local\Temp\S.EXE
PID 2916 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\S.EXE C:\Windows\system32\cmd.exe
PID 2916 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\S.EXE C:\Windows\system32\cmd.exe
PID 2916 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\S.EXE C:\Windows\system32\cmd.exe
PID 2616 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 2616 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 2616 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 2616 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 1688 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\attrib.exe
PID 1688 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\attrib.exe
PID 1688 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\attrib.exe
PID 1688 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\attrib.exe
PID 1688 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1492 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1492 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1492 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1492 wrote to memory of 1500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1688 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2948 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2948 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2948 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1688 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1056 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1056 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1056 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1056 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1688 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1688 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\dllhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1356 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1356 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1356 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe

"C:\Users\Admin\AppData\Local\Temp\Aeonixx.exe"

C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE

"C:\Users\Admin\AppData\Local\Temp\AEONIX.EXE"

C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE

"C:\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE"

C:\Users\Admin\AppData\Local\Temp\S.EXE

"C:\Users\Admin\AppData\Local\Temp\S.EXE"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Users\Admin\AppData\Local\Temp\dllhost.exe

"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"

C:\Windows\SysWOW64\attrib.exe

attrib +h "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SysWOW64\cmd.exe

cmd /c sc query windefend

C:\Windows\SysWOW64\sc.exe

sc query windefend

C:\Windows\SysWOW64\cmd.exe

cmd /c sc stop windefend

C:\Windows\SysWOW64\sc.exe

sc stop windefend

C:\Windows\SysWOW64\cmd.exe

cmd /c sc delete windefend

C:\Windows\SysWOW64\sc.exe

sc delete windefend

C:\Windows\SysWOW64\cmd.exe

cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

Network

Country Destination Domain Proto
TR 85.108.113.75:1604 tcp
TR 85.108.113.75:1604 tcp
TR 85.108.113.75:1604 tcp
TR 85.108.113.75:1604 tcp
TR 85.108.113.75:1604 tcp
TR 85.108.113.75:1604 tcp

Files

\Users\Admin\AppData\Local\Temp\AEONIX.EXE

MD5 0b7321cbbce655bb14c3737973936d8a
SHA1 3fbedbf411835e0d54593ae2fe938679f2f5a858
SHA256 b13a4f5dc328fb50971d5579f8d32ca7af2b9cf5118999e033ff227242a04edd
SHA512 82ee9dafd3948702da5eef1237270828257177f237115921b96d9d604901e0ce291d82562e20c3e0ad5473bd88615559fca2253a603c229f480b4fec746f4b34

\Users\Admin\AppData\Local\Temp\PAYLOAD.EXE

MD5 dcc788ade743525d6922369a9b1cc1d9
SHA1 4c100d13f4115f64bbdcc47ffb4f60d50ea9edde
SHA256 1a82a1b8db2e35e967a2f463292337e08717251b3e836bf1ffa20815b25037c9
SHA512 67faa32ffb6a426f2626384629ac75083da881f549efe7b42c4d3ad915d93e1f2b07a10d952d9b7079b21964f66a8e5c8adb9a9e5fe59040b4dc5a5447c4fb79

\Users\Admin\AppData\Local\Temp\S.EXE

MD5 3dbda3d47ec35af319228ebe3677e743
SHA1 0c3033b7568875bb6041c8eaf7eefb065f2f138e
SHA256 3d860b0b79377ea570b774977ac1d0976a5ce20c3a71ff67a9b91be84384fd9e
SHA512 348f308e96400a4abf2f820ecfaff4c9bb3690b6a60cd1f0376913d0cf01af836a78c5df4af0d2fe95d0fa9186cbf6eefc1b2ef75c021b48572457ff273d9f74