Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2024 20:57
Behavioral task
behavioral1
Sample
BirlikProxy.exe
Resource
win7-20240903-en
General
-
Target
BirlikProxy.exe
-
Size
1.5MB
-
MD5
a4fa9334e4b91569e951e86a4c4dfe25
-
SHA1
4a64997f0688fb4040c624643ce03753a24dc6f6
-
SHA256
ae2f20d5d4201cd5f7efce0835e93ab5c9ac11f4a819d73a1e3721d7b37286a4
-
SHA512
4ec34c9d6e0fd28dac4ef15a2b44a6788db19b0d61a9214f887f4b5f2bade8827c28ad70ba980a27d9bb2c04707e09aaa29722eedd6561ac5c7cecd9e4fff6e0
-
SSDEEP
24576:swT7rC6qr+eycj8I9WZe/FYQgGhcxKbC+eycj8I9:drC6qr+e3Ke/uVYC+e3
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3624-1-0x0000000000EB0000-0x0000000000FE6000-memory.dmp disable_win_def -
Detects Eternity stealer 1 IoCs
resource yara_rule behavioral2/memory/3624-1-0x0000000000EB0000-0x0000000000FE6000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection BirlikProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" BirlikProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" BirlikProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" BirlikProxy.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 3456 dcd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" BirlikProxy.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2000 powershell.exe 2000 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3624 BirlikProxy.exe Token: SeDebugPrivilege 2000 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3624 wrote to memory of 3456 3624 BirlikProxy.exe 82 PID 3624 wrote to memory of 3456 3624 BirlikProxy.exe 82 PID 3624 wrote to memory of 3456 3624 BirlikProxy.exe 82 PID 3624 wrote to memory of 2000 3624 BirlikProxy.exe 83 PID 3624 wrote to memory of 2000 3624 BirlikProxy.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\BirlikProxy.exe"C:\Users\Admin\AppData\Local\Temp\BirlikProxy.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
227KB
MD5b5ac46e446cead89892628f30a253a06
SHA1f4ad1044a7f77a1b02155c3a355a1bb4177076ca
SHA256def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669
SHA512bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87