Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 01:20
Behavioral task
behavioral1
Sample
a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe
- Size 34KB
- Sample241114-bqeqdawkel
- SHA256 a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e
- MD5 43641196e0d4c8995133d4d3c721a0c4
- SHA1 422ef769e8eaf0ef26ebb71b43d3f762a25dadce
- SHA512 eb00d08f1dbcf2aed302d4499d6589ff1e5f73ad7986804668d0c2a0b0c1009e2f4c556a386e4340a789098f32604e6f3c4ac286a3a66c72ae94a96a2e4f681b
- SSDEEP 768:tQbuQRy2UjmUndnlTttxDn+3jiSkjRY6AB7kKfYoJ+ifBEewzKOwkV:QuQRylaUDTDxDXjy6AB7koYy2TT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" issefeh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" issefeh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" issefeh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" issefeh.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594841-534f-4c53-4759-4841534F4c53} issefeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594841-534f-4c53-4759-4841534F4c53}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" issefeh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594841-534f-4c53-4759-4841534F4c53}\IsInstalled = "1" issefeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594841-534f-4c53-4759-4841534F4c53}\StubPath = "C:\\Windows\\system32\\unlirik.exe" issefeh.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe issefeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" issefeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oxmearoax-oufom.exe" issefeh.exe - Executes dropped EXE 2 IoCs
pid Process 3884 issefeh.exe 2204 issefeh.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" issefeh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" issefeh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" issefeh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" issefeh.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger issefeh.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} issefeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify issefeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" issefeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\uvbecood.dll" issefeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" issefeh.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL issefeh.exe File created C:\Windows\SysWOW64\oxmearoax-oufom.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\aset32.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\unlirik.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\uvbecood.dll issefeh.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll issefeh.exe File opened for modification C:\Windows\SysWOW64\rmass.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe issefeh.exe File created C:\Windows\SysWOW64\unlirik.exe issefeh.exe File created C:\Windows\SysWOW64\uvbecood.dll issefeh.exe File opened for modification C:\Windows\SysWOW64\issefeh.exe issefeh.exe File opened for modification C:\Windows\SysWOW64\issefeh.exe a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe File created C:\Windows\SysWOW64\issefeh.exe a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe File opened for modification C:\Windows\SysWOW64\oxmearoax-oufom.exe issefeh.exe -
resource yara_rule behavioral2/memory/3608-0-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/3608-7-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/files/0x000c000000023ba7-5.dat upx behavioral2/memory/2204-18-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/3884-43-0x0000000000400000-0x0000000000417000-memory.dmp upx - Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe issefeh.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe issefeh.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe issefeh.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe issefeh.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe issefeh.exe File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe issefeh.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL issefeh.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll issefeh.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language issefeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language issefeh.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 2204 issefeh.exe 2204 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe 3884 issefeh.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3608 a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe Token: SeDebugPrivilege 3884 issefeh.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3608 wrote to memory of 3884 3608 a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe 83 PID 3608 wrote to memory of 3884 3608 a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe 83 PID 3608 wrote to memory of 3884 3608 a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe 83 PID 3884 wrote to memory of 2204 3884 issefeh.exe 84 PID 3884 wrote to memory of 2204 3884 issefeh.exe 84 PID 3884 wrote to memory of 2204 3884 issefeh.exe 84 PID 3884 wrote to memory of 592 3884 issefeh.exe 5 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56 PID 3884 wrote to memory of 3484 3884 issefeh.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:592
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe"C:\Users\Admin\AppData\Local\Temp\a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\issefeh.exe"C:\Windows\system32\issefeh.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\issefeh.exe--k33p4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2204
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\issefeh.exe
- Size 34KB
- SHA256 a81b318fbfd733366340305a6f77bd73e879049b26d1a5e42c3e59f424fe822e
- MD5 43641196e0d4c8995133d4d3c721a0c4
- SHA1 422ef769e8eaf0ef26ebb71b43d3f762a25dadce
- SHA512 eb00d08f1dbcf2aed302d4499d6589ff1e5f73ad7986804668d0c2a0b0c1009e2f4c556a386e4340a789098f32604e6f3c4ac286a3a66c72ae94a96a2e4f681b
- SSDEEP 768:tQbuQRy2UjmUndnlTttxDn+3jiSkjRY6AB7kKfYoJ+ifBEewzKOwkV:QuQRylaUDTDxDXjy6AB7koYy2TT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\oxmearoax-oufom.exe
- Size 37KB
- SHA256 a141ebd75f87ab6f313bcd3f135593f7ffe89e1de2984550fd587924f49503a7
- MD5 57f2c38551635b60b2279fbdb3066602
- SHA1 b96eec99d8eb667e06d36fb48da77e3e95d9f24f
- SHA512 699b1e0c2cd7a308ee79a6d68b7c7e97a459e47dd0508790251e74ab133ac957ebb4d188dffa298029e697bc08b003fd36fe2157e3a6886c950c4991e9430fa4
- SSDEEP 768:hrzEmnD170FjG4EoPNHmKdWexeorMuLC3VmQz78FB:hNnD170pGx4NH/xr7LzQHY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\unlirik.exe
- Size 36KB
- SHA256 db3b5db27054d6a0a56fed966ebab40fa4d4458ac8c5704b197afcf131f7bc44
- MD5 e7a1fbed67fc3033d1b5cc03310738ca
- SHA1 9ccd88d01d67c707da5f761df7bf1e207b7ca057
- SHA512 0eca117ba3e16b4c308aac48a0aee875c0ab99286f43c0113abcf5c8c11f52e03883e29d345e61735c9011ea546c9915495b9aa302b43f4170775f83cd455d7a
- SSDEEP 768:sIUWIr7v53HU0AqZNYlKM5f0gtZoAVHa9O7EeZ/nwMYtXug4SyGWdNvuaUdAfnNX:spb5XUofWHtWG6GZZfwMYtX/kfWaiAfN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\uvbecood.dll
- Size 5KB
- SHA256 fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
- MD5 c8521a5fdd1c9387d536f599d850b195
- SHA1 a543080665107b7e32bcc1ed19dbfbc1d2931356
- SHA512 541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
- SSDEEP 48:6sz+I0qeE/6JbPXvJFR7YEpk1Kcxc2GZJOFl:H/bvkLfzREEC1KAD
- MD5 SHA1 SHA512 SSDEEP