Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-10-2024 20:57

General

  • Target

    BirlikProxy.exe

  • Size

    1.5MB

  • MD5

    a4fa9334e4b91569e951e86a4c4dfe25

  • SHA1

    4a64997f0688fb4040c624643ce03753a24dc6f6

  • SHA256

    ae2f20d5d4201cd5f7efce0835e93ab5c9ac11f4a819d73a1e3721d7b37286a4

  • SHA512

    4ec34c9d6e0fd28dac4ef15a2b44a6788db19b0d61a9214f887f4b5f2bade8827c28ad70ba980a27d9bb2c04707e09aaa29722eedd6561ac5c7cecd9e4fff6e0

  • SSDEEP

    24576:swT7rC6qr+eycj8I9WZe/FYQgGhcxKbC+eycj8I9:drC6qr+e3Ke/uVYC+e3

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Eternity stealer 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BirlikProxy.exe
    "C:\Users\Admin\AppData\Local\Temp\BirlikProxy.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security modification
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3456
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kmzf0tcf.zva.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\dcd.exe

    Filesize

    227KB

    MD5

    b5ac46e446cead89892628f30a253a06

    SHA1

    f4ad1044a7f77a1b02155c3a355a1bb4177076ca

    SHA256

    def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

    SHA512

    bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

  • memory/2000-19-0x0000026B42F90000-0x0000026B42FB2000-memory.dmp

    Filesize

    136KB

  • memory/2000-29-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/2000-28-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/2000-25-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/2000-24-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-4-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-11-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-12-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-13-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-10-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-6-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB

  • memory/3624-0-0x00007FFAF6973000-0x00007FFAF6975000-memory.dmp

    Filesize

    8KB

  • memory/3624-3-0x00000000032F0000-0x000000000332E000-memory.dmp

    Filesize

    248KB

  • memory/3624-2-0x0000000003340000-0x0000000003390000-memory.dmp

    Filesize

    320KB

  • memory/3624-1-0x0000000000EB0000-0x0000000000FE6000-memory.dmp

    Filesize

    1.2MB

  • memory/3624-30-0x00007FFAF6970000-0x00007FFAF7431000-memory.dmp

    Filesize

    10.8MB