Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 05:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
120 seconds
Behavioral task
behavioral2
Sample
646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe
-
Size
88KB
-
MD5
61616fda06b8daf259c0a121d1789d70
-
SHA1
a624a79c505c9d4cd3ee6a9b2eac31e76b5b2240
-
SHA256
646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000
-
SHA512
e2c0a636097650ba6f208f3f25fec2add4c283ef35568a10066eb632e5fe2ec8894da99e17a1be562884705cc9f1813f9354bea843b752499253742231d17b0f
-
SSDEEP
768:sIUdWE7LeTqm+63K5a+gN2blw01sZoy4/naT8cIRMtZtUFjHLJgWiEEDZWGxLXle:sJ7LEq6OHg7ro/CQPipwgWiEwgql9Kj
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" ektiveax-easat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" ektiveax-easat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" ektiveax-easat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" ektiveax-easat.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142} ektiveax-easat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ektiveax-easat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142}\IsInstalled = "1" ektiveax-easat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142}\StubPath = "C:\\Windows\\system32\\ucmeavoh.exe" ektiveax-easat.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ektiveax-easat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ektiveax-easat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\imdoavex-umid.exe" ektiveax-easat.exe -
Executes dropped EXE 2 IoCs
pid Process 2192 ektiveax-easat.exe 1060 ektiveax-easat.exe -
Loads dropped DLL 3 IoCs
pid Process 2084 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe 2084 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe 2192 ektiveax-easat.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" ektiveax-easat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" ektiveax-easat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" ektiveax-easat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" ektiveax-easat.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger ektiveax-easat.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ektiveax-easat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ocnuces-obur.dll" ektiveax-easat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ektiveax-easat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ektiveax-easat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ektiveax-easat.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\imdoavex-umid.exe ektiveax-easat.exe File created C:\Windows\SysWOW64\ucmeavoh.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\aset32.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\ektiveax-easat.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\ektiveax-easat.exe 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe File opened for modification C:\Windows\SysWOW64\ucmeavoh.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\ocnuces-obur.dll ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe ektiveax-easat.exe File created C:\Windows\SysWOW64\ektiveax-easat.exe 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe File opened for modification C:\Windows\SysWOW64\rmass.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll ektiveax-easat.exe File created C:\Windows\SysWOW64\imdoavex-umid.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe ektiveax-easat.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe ektiveax-easat.exe File created C:\Windows\SysWOW64\ocnuces-obur.dll ektiveax-easat.exe -
resource yara_rule behavioral1/files/0x000c00000001226a-10.dat upx behavioral1/memory/2192-11-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2192-46-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1060-51-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe ektiveax-easat.exe File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe ektiveax-easat.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL ektiveax-easat.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll ektiveax-easat.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe ektiveax-easat.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe ektiveax-easat.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe ektiveax-easat.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe ektiveax-easat.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ektiveax-easat.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 1060 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe 2192 ektiveax-easat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2192 ektiveax-easat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2192 2084 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe 31 PID 2084 wrote to memory of 2192 2084 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe 31 PID 2084 wrote to memory of 2192 2084 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe 31 PID 2084 wrote to memory of 2192 2084 646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe 31 PID 2192 wrote to memory of 432 2192 ektiveax-easat.exe 5 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1060 2192 ektiveax-easat.exe 32 PID 2192 wrote to memory of 1060 2192 ektiveax-easat.exe 32 PID 2192 wrote to memory of 1060 2192 ektiveax-easat.exe 32 PID 2192 wrote to memory of 1060 2192 ektiveax-easat.exe 32 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21 PID 2192 wrote to memory of 1216 2192 ektiveax-easat.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe"C:\Users\Admin\AppData\Local\Temp\646f0410180fb0bb7ff882e0ec3d33dbc529c41e49282db85bd20b7676aa8000N.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\ektiveax-easat.exe"C:\Windows\SysWOW64\ektiveax-easat.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\ektiveax-easat.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD53a9d9a42d837c07e9316533bccd969ea
SHA114d43d38fcfb7a78fef0552df9c0be9ce1370a88
SHA256975479862cd774f2ce3d344fd3280e4af96c7915e9524785d9e9197c62866a06
SHA51235bc75f06c8b5d8ec905fbf713c4348dca73f7aaee2db4936d0b22ca58591d42fdf8d970b0eb9d5f04a6303516772e535486fcc6141c40057a18f1f7817eccb6
-
Filesize
89KB
MD5551e357f9c0e20708237e5845cbd0bc5
SHA198f07df3a9b0ef57dcfc7f59774b39909f280568
SHA256ac2b89e6513db2c3818bc4dc465ada06ad1705dbaec869dd6ff7bcbb5c2936c6
SHA5128c6fac0c0e735e434755606c0492bd3752efee8d765b5f09df8def08b3e0d66b563e44d4f7b4eccb8fcc0022b9f74a54ee7ca44a0e19924b6c5b829ae11806f4
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
-
Filesize
88KB
MD537cdca10818d891af5124883700e4c05
SHA1414af59a2dc3133bd1caff6d13842d993e20e4f8
SHA2560f3edf04d4f033c91f65074fe6558b15e667dc9c4529b6e299b32ffa37790c8b
SHA512feb0aa5865f4a81f359e96923e84b02611a95a97fcd442dcf32206575672d7134f1dd1244570c9be3e35e425cdb906356fc9bfc9f5074f03b63a5aeed4946a78