Analysis

  • max time kernel
    150s
  • max time network
    277s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-08-2024 14:35

General

  • Target

    GrowtopiaProxy.exe

  • Size

    901KB

  • MD5

    ae8853311b3f374068ebe50b5d311fe0

  • SHA1

    3f3175bdfa43fc538aa814d8121fa740d82d3be4

  • SHA256

    c02c592855d900dad06e53cfa2dc7cb8d0a1f618c0ca07f46d4707d2c561a703

  • SHA512

    48862ea918a78d26b7346aa9f8e4826040eb6a7cb979889fbb1d10c9a529563564e99b4e5bbb789171f30aa92d04061cd40cb694b07d48f9f554f356b0e24565

  • SSDEEP

    12288:2TEYAsROAsrt/uxduo1jB0Y96qYRPLf0v4Y4qBDhVqtUe81lupcOzk/AXy:2wT7rC6qOPLfhUQUe81Ilkl

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Eternity stealer 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GrowtopiaProxy.exe
    "C:\Users\Admin\AppData\Local\Temp\GrowtopiaProxy.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security modification
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_udeagtrr.cqs.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\dcd.exe

    Filesize

    227KB

    MD5

    b5ac46e446cead89892628f30a253a06

    SHA1

    f4ad1044a7f77a1b02155c3a355a1bb4177076ca

    SHA256

    def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

    SHA512

    bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

  • memory/2760-11-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-12-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-4-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-5-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-6-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-2-0x00000000027A0000-0x00000000027F0000-memory.dmp

    Filesize

    320KB

  • memory/2760-0-0x00007FFC19373000-0x00007FFC19375000-memory.dmp

    Filesize

    8KB

  • memory/2760-3-0x0000000000EB0000-0x0000000000EEE000-memory.dmp

    Filesize

    248KB

  • memory/2760-13-0x00007FFC19373000-0x00007FFC19375000-memory.dmp

    Filesize

    8KB

  • memory/2760-14-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-1-0x00000000005D0000-0x00000000006BA000-memory.dmp

    Filesize

    936KB

  • memory/3944-16-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-17-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-24-0x0000021BE6B70000-0x0000021BE6B92000-memory.dmp

    Filesize

    136KB

  • memory/3944-15-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-30-0x00007FFC19370000-0x00007FFC19E31000-memory.dmp

    Filesize

    10.8MB