Analysis
-
max time kernel
119s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 08:33
Behavioral task
behavioral1
Sample
e1abbbb2c77bc61d5ef54369ed147590N.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
120 seconds
Behavioral task
behavioral2
Sample
e1abbbb2c77bc61d5ef54369ed147590N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
e1abbbb2c77bc61d5ef54369ed147590N.exe
-
Size
87KB
-
MD5
e1abbbb2c77bc61d5ef54369ed147590
-
SHA1
4e6934ab28c53502c493a15bf76c9d58a80556e5
-
SHA256
92cd279789d0d3eac1751b83c07f4fcb14aaeef6184e320605745bae93afb4c8
-
SHA512
f1912f61592fc7df10c683a39f8e30037198b221ae19f6848fd8e7dcc1546f8dece849d7ec23732b1670a91328d1ee3c7d6f3c397a0a693b810d9adb6dea8137
-
SSDEEP
768:3Og167GTCGTL9tCqwhX52pwTu5gV62i9wb4CWYLyAKfPXvByNGOLDd5FBEewN4WU:x0Y9WV32pau5gV62++Kf/vw/d5Uh4AW
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" unlekom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" unlekom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" unlekom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" unlekom.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B564957-4c50-554a-4B56-49574C50554a}\StubPath = "C:\\Windows\\system32\\eamboteam-eacid.exe" unlekom.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B564957-4c50-554a-4B56-49574C50554a} unlekom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B564957-4c50-554a-4B56-49574C50554a}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" unlekom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B564957-4c50-554a-4B56-49574C50554a}\IsInstalled = "1" unlekom.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe unlekom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" unlekom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\etbatoar.exe" unlekom.exe -
Executes dropped EXE 2 IoCs
pid Process 1404 unlekom.exe 3056 unlekom.exe -
resource yara_rule behavioral2/memory/992-0-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/992-7-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1404-8-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/files/0x00080000000234ae-6.dat upx behavioral2/memory/1404-42-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/3056-47-0x0000000000400000-0x0000000000418000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" unlekom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" unlekom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" unlekom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" unlekom.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger unlekom.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} unlekom.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify unlekom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" unlekom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\gboapin.dll" unlekom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" unlekom.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\eamboteam-eacid.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll unlekom.exe File opened for modification C:\Windows\SysWOW64\unlekom.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\eamboteam-eacid.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\gboapin.dll unlekom.exe File created C:\Windows\SysWOW64\gboapin.dll unlekom.exe File opened for modification C:\Windows\SysWOW64\aset32.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL unlekom.exe File opened for modification C:\Windows\SysWOW64\unlekom.exe e1abbbb2c77bc61d5ef54369ed147590N.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe unlekom.exe File created C:\Windows\SysWOW64\unlekom.exe e1abbbb2c77bc61d5ef54369ed147590N.exe File opened for modification C:\Windows\SysWOW64\etbatoar.exe unlekom.exe File created C:\Windows\SysWOW64\etbatoar.exe unlekom.exe File opened for modification C:\Windows\SysWOW64\rmass.exe unlekom.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe unlekom.exe File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe unlekom.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL unlekom.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll unlekom.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe unlekom.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe unlekom.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe unlekom.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe unlekom.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1abbbb2c77bc61d5ef54369ed147590N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unlekom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unlekom.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 3056 unlekom.exe 3056 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe 1404 unlekom.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 992 e1abbbb2c77bc61d5ef54369ed147590N.exe Token: SeDebugPrivilege 1404 unlekom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 992 wrote to memory of 1404 992 e1abbbb2c77bc61d5ef54369ed147590N.exe 83 PID 992 wrote to memory of 1404 992 e1abbbb2c77bc61d5ef54369ed147590N.exe 83 PID 992 wrote to memory of 1404 992 e1abbbb2c77bc61d5ef54369ed147590N.exe 83 PID 1404 wrote to memory of 608 1404 unlekom.exe 5 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3056 1404 unlekom.exe 84 PID 1404 wrote to memory of 3056 1404 unlekom.exe 84 PID 1404 wrote to memory of 3056 1404 unlekom.exe 84 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56 PID 1404 wrote to memory of 3520 1404 unlekom.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\e1abbbb2c77bc61d5ef54369ed147590N.exe"C:\Users\Admin\AppData\Local\Temp\e1abbbb2c77bc61d5ef54369ed147590N.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\unlekom.exe"C:\Windows\system32\unlekom.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\unlekom.exe--k33p4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD52a9e10aadd0b5cdba9ab80b8796ce89f
SHA1cc550f8592f305a04aad4c17990572f3d7a586ce
SHA256c7ee8d9497afada5b3caa21c788167243524c6bb198600176e9d9579c47999af
SHA512d0fcf881580c0ac3ecff20c179776bb1223b0986f0d8ea73e5a1130d0f098c0d79cc7546a14353779102b0bf9c23671030725309c54b642c7e95807ab3430fdc
-
Filesize
90KB
MD533e274dbdcc0c97f1e2d052bb5bd9cce
SHA1f090dca0c6c6452196c074eb787b60031d413c83
SHA256db9031c2349fd04cf75c71a3a137b948bbd2ffd4ea25cfeb43845ccbe7e2c993
SHA5125efa6b5f43b2f3cfc0d4f6ee7423956c6b1b476350025d7c58d0aa17ab7d3b237f5a91f31d70d8dae144c192d9b668ea3b6e2c98ca1e0d652e44a11b4eccc8ef
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
-
Filesize
87KB
MD5e1abbbb2c77bc61d5ef54369ed147590
SHA14e6934ab28c53502c493a15bf76c9d58a80556e5
SHA25692cd279789d0d3eac1751b83c07f4fcb14aaeef6184e320605745bae93afb4c8
SHA512f1912f61592fc7df10c683a39f8e30037198b221ae19f6848fd8e7dcc1546f8dece849d7ec23732b1670a91328d1ee3c7d6f3c397a0a693b810d9adb6dea8137