Analysis
-
max time kernel
150s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2024 14:35
General
-
Target
GrowtopiaProxy.exe
-
Size
901KB
-
MD5
ae8853311b3f374068ebe50b5d311fe0
-
SHA1
3f3175bdfa43fc538aa814d8121fa740d82d3be4
-
SHA256
c02c592855d900dad06e53cfa2dc7cb8d0a1f618c0ca07f46d4707d2c561a703
-
SHA512
48862ea918a78d26b7346aa9f8e4826040eb6a7cb979889fbb1d10c9a529563564e99b4e5bbb789171f30aa92d04061cd40cb694b07d48f9f554f356b0e24565
-
SSDEEP
12288:2TEYAsROAsrt/uxduo1jB0Y96qYRPLf0v4Y4qBDhVqtUe81lupcOzk/AXy:2wT7rC6qOPLfhUQUe81Ilkl
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2760-1-0x00000000005D0000-0x00000000006BA000-memory.dmp disable_win_def -
Detects Eternity stealer 1 IoCs
resource yara_rule behavioral1/memory/2760-1-0x00000000005D0000-0x00000000006BA000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection GrowtopiaProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" GrowtopiaProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" GrowtopiaProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" GrowtopiaProxy.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1020 dcd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" GrowtopiaProxy.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3944 powershell.exe 3944 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2760 GrowtopiaProxy.exe Token: SeDebugPrivilege 3944 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2760 wrote to memory of 1020 2760 GrowtopiaProxy.exe 86 PID 2760 wrote to memory of 1020 2760 GrowtopiaProxy.exe 86 PID 2760 wrote to memory of 1020 2760 GrowtopiaProxy.exe 86 PID 2760 wrote to memory of 3944 2760 GrowtopiaProxy.exe 88 PID 2760 wrote to memory of 3944 2760 GrowtopiaProxy.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\GrowtopiaProxy.exe"C:\Users\Admin\AppData\Local\Temp\GrowtopiaProxy.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
227KB
MD5b5ac46e446cead89892628f30a253a06
SHA1f4ad1044a7f77a1b02155c3a355a1bb4177076ca
SHA256def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669
SHA512bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87