e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe
Size

67KB
MD5

ccc2f9ce1b0d23dd59d4e63f5e305880
SHA1

c6db1c5ace09f5423cdb6f7e267d529d50fab419
SHA256

e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df
SHA512

0bff4d2ba3d942e97bab26ab80d8d841edec793e94881f4f15733cec01243ec057ad63b941568a233b291074dc4cedf9e1a00e74fe569c34aade11366e83ef92
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+aw+U:ulg35GTslA5t3Gaw+U

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	kteacoar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	kteacoar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	kteacoar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	kteacoar.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C414759-4c58-414f-4C41-47594C58414f}	kteacoar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C414759-4c58-414f-4C41-47594C58414f}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	kteacoar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C414759-4c58-414f-4C41-47594C58414f}\IsInstalled = "1"	kteacoar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C414759-4c58-414f-4C41-47594C58414f}\StubPath = "C:\\Windows\\system32\\ivxineaf.exe"	kteacoar.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	kteacoar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	kteacoar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\gdoakoah.exe"	kteacoar.exe

Executes dropped EXE 2 IoCs

pid	Process
1532	kteacoar.exe
5040	kteacoar.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	kteacoar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	kteacoar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	kteacoar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	kteacoar.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger	kteacoar.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	kteacoar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	kteacoar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eafcohear-ekoot.dll"	kteacoar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	kteacoar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	kteacoar.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ivxineaf.exe	kteacoar.exe
File created	C:\Windows\SysWOW64\ivxineaf.exe	kteacoar.exe
File created	C:\Windows\SysWOW64\eafcohear-ekoot.dll	kteacoar.exe
File opened for modification	C:\Windows\SysWOW64\kteacoar.exe	kteacoar.exe
File opened for modification	C:\Windows\SysWOW64\gdoakoah.exe	kteacoar.exe
File created	C:\Windows\SysWOW64\gdoakoah.exe	kteacoar.exe
File opened for modification	C:\Windows\SysWOW64\eafcohear-ekoot.dll	kteacoar.exe
File opened for modification	C:\Windows\SysWOW64\kteacoar.exe	e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe
File created	C:\Windows\SysWOW64\kteacoar.exe	e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kteacoar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kteacoar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
5040	kteacoar.exe
5040	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe
1532	kteacoar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe
Token: SeDebugPrivilege	1532	kteacoar.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1532	2936	e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe	84
PID 2936 wrote to memory of 1532	2936	e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe	84
PID 2936 wrote to memory of 1532	2936	e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe	84
PID 1532 wrote to memory of 5040	1532	kteacoar.exe	85
PID 1532 wrote to memory of 5040	1532	kteacoar.exe	85
PID 1532 wrote to memory of 5040	1532	kteacoar.exe	85

C:\Users\Admin\AppData\Local\Temp\e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe
"C:\Users\Admin\AppData\Local\Temp\e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\kteacoar.exe
  "C:\Windows\system32\kteacoar.exe"
  2⤵
  - Windows security bypass
  - Boot or Logon Autostart Execution: Active Setup
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Windows security modification
  - Indicator Removal: Clear Persistence
  - Modifies WinLogon
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\kteacoar.exe
    ùù¿çç¤
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\eafcohear-ekoot.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\gdoakoah.exe

Filesize
70KB

MD5
1e0239bea5a98124a0a85b0b14c119af

SHA1
95976121cd62216fbe13cbe55897b268a86101b0

SHA256
67205d18df7060810e3e6daf44b39e03ebba81694d1d04bfa11b4a9627ee2b82

SHA512
f7e9808c3e16e39c5b89012aa4932bc3b14dad88621f8fad64f4c9b9a7ef668bcafa44936390f0a4ead8ad25faf31856636ebd3ac600110cc154af078fe435d0

Download Submit
C:\Windows\SysWOW64\ivxineaf.exe

Filesize
69KB

MD5
349ed96dc72c79efabe02d89a4e39e7d

SHA1
b3e07b40dfb498ff0929f0f2e1a2c3151f7a2998

SHA256
a5323946e3473728f5328389e41a0df2829ca9f73797a6b531a9fbefadf752db

SHA512
cc3f4d88b2e13c60562e7717f50cb4cf1f817ec5a1dbaccccee86a51c8cf5720595924093603254e7ac7b29eb9b8875c5a3311494ec67264b0b5eeca387d06ef

Download Submit
C:\Windows\SysWOW64\kteacoar.exe

Filesize
67KB

MD5
ccc2f9ce1b0d23dd59d4e63f5e305880

SHA1
c6db1c5ace09f5423cdb6f7e267d529d50fab419

SHA256
e0a310faf96da27aa92067a5db7de09af060800a4087b101e1ed51ee00f9f5df

SHA512
0bff4d2ba3d942e97bab26ab80d8d841edec793e94881f4f15733cec01243ec057ad63b941568a233b291074dc4cedf9e1a00e74fe569c34aade11366e83ef92

Download Submit
memory/1532-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2936-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5040-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download