Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:19
Behavioral task
behavioral1
Sample
c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
120 seconds
Behavioral task
behavioral2
Sample
c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe
-
Size
36KB
-
MD5
7ed233dc64aea1a7f1b62fee35f198d0
-
SHA1
bf9f21d43bce585e706e366db65b878d6c56574e
-
SHA256
c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07b
-
SHA512
c955a104378c252b8f13ad2fe286e48b2213dc44db465592ecd6933270e6195e062c55f1f4c5733773dd493e7dc79d8f646d0263f3bdaa25a25b32ecb1f29ea7
-
SSDEEP
768:tQbuQRy2UjmUndnlTttxDn+3jiSkjRY6AB7kKfYoJ+ifBEewzKO5RA6Z:QuQRylaUDTDxDXjy6AB7koYy2TtZ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" evneroad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" evneroad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" evneroad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" evneroad.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A54534C-4c52-4648-5A54-534C4C524648} evneroad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A54534C-4c52-4648-5A54-534C4C524648}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" evneroad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A54534C-4c52-4648-5A54-534C4C524648}\IsInstalled = "1" evneroad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A54534C-4c52-4648-5A54-534C4C524648}\StubPath = "C:\\Windows\\system32\\abseahid-icom.exe" evneroad.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe evneroad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" evneroad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\akfereg.exe" evneroad.exe -
Executes dropped EXE 2 IoCs
pid Process 4920 evneroad.exe 2364 evneroad.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" evneroad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" evneroad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" evneroad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" evneroad.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger evneroad.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" evneroad.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} evneroad.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify evneroad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" evneroad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\asrukov-coab.dll" evneroad.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\evneroad.exe c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe File opened for modification C:\Windows\SysWOW64\asrukov-coab.dll evneroad.exe File created C:\Windows\SysWOW64\asrukov-coab.dll evneroad.exe File opened for modification C:\Windows\SysWOW64\rmass.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll evneroad.exe File opened for modification C:\Windows\SysWOW64\evneroad.exe evneroad.exe File created C:\Windows\SysWOW64\akfereg.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\abseahid-icom.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\evneroad.exe c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe File opened for modification C:\Windows\SysWOW64\akfereg.exe evneroad.exe File created C:\Windows\SysWOW64\abseahid-icom.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\aset32.exe evneroad.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL evneroad.exe -
resource yara_rule behavioral2/memory/3348-0-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/files/0x000c000000023b42-5.dat upx behavioral2/memory/3348-6-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/2364-17-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/4920-42-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL evneroad.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll evneroad.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe evneroad.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe evneroad.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe evneroad.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe evneroad.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe evneroad.exe File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe evneroad.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language evneroad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language evneroad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 2364 evneroad.exe 2364 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe 4920 evneroad.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3348 c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe Token: SeDebugPrivilege 4920 evneroad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3348 wrote to memory of 4920 3348 c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe 84 PID 3348 wrote to memory of 4920 3348 c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe 84 PID 3348 wrote to memory of 4920 3348 c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe 84 PID 4920 wrote to memory of 588 4920 evneroad.exe 5 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 2364 4920 evneroad.exe 85 PID 4920 wrote to memory of 2364 4920 evneroad.exe 85 PID 4920 wrote to memory of 2364 4920 evneroad.exe 85 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56 PID 4920 wrote to memory of 3452 4920 evneroad.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:588
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe"C:\Users\Admin\AppData\Local\Temp\c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07bN.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\evneroad.exe"C:\Windows\system32\evneroad.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\evneroad.exe--k33p4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD564b1f8c4972340460a7e7b22f232e214
SHA18574cdf6da63fb3bfca832cc9d9007836ca845f6
SHA2560b059af106723d2941683cf42675f5502043b26cf54637b48a2f9df49356329b
SHA512fc83f0870182c6b9598be6c1ad873693fa1e2037333634339174a1e7369a83dd0e2a8696b1945820e8769f689fb1db3a7294f182ca138d8f47f81cdbd1ac83ae
-
Filesize
39KB
MD5e1694d1a4f6bbd718c5c0b13ef417cdf
SHA11dcd3441d1302e5835f1a36a1622da4d0e10703a
SHA256a7a3ec1673a2148d363183ca72dd0b6006a20da0adbcbf43ebd766d1785656a8
SHA512c795841df54f659860cc3ad15939b866f831e676fcdfdef11d96d62385ec45829bdc26712a1afb2e70364f55cb8e27dd9ada6a7ca5e89325b75d9190f120fe99
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
-
Filesize
36KB
MD57ed233dc64aea1a7f1b62fee35f198d0
SHA1bf9f21d43bce585e706e366db65b878d6c56574e
SHA256c71e21c729a2ee01035966b6d1fbde69f426bac35a30597740378f2ef5d5e07b
SHA512c955a104378c252b8f13ad2fe286e48b2213dc44db465592ecd6933270e6195e062c55f1f4c5733773dd493e7dc79d8f646d0263f3bdaa25a25b32ecb1f29ea7