65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

Target

keygen-step-4.exe
Size

4.6MB
MD5

563107b1df2a00f4ec868acd9e08a205
SHA1

9cb9c91d66292f5317aa50d92e38834861e9c9b7
SHA256

bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9
SHA512

99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

xiuhuali.exeJoSetp.exe

pid process

2696 xiuhuali.exe
220 JoSetp.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1188 rundll32.exe

pid	process
2696	xiuhuali.exe
220	JoSetp.exe

pid	process
1188	rundll32.exe

Drops file in Program Files directory 3 IoCs

Processes:

xiuhuali.exe

description	ioc	process
File created	C:\Program Files\install.dll	xiuhuali.exe
File created	C:\Program Files\libEGL.dll	xiuhuali.exe
File created	C:\Program Files\install.dat	xiuhuali.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

xiuhuali.exe

pid process

2696 xiuhuali.exe
2696 xiuhuali.exe

pid	process
2696	xiuhuali.exe
2696	xiuhuali.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

keygen-step-4.exexiuhuali.exe

description	pid	process	target process
PID 3924 wrote to memory of 2696	3924	keygen-step-4.exe	xiuhuali.exe
PID 3924 wrote to memory of 2696	3924	keygen-step-4.exe	xiuhuali.exe
PID 3924 wrote to memory of 2696	3924	keygen-step-4.exe	xiuhuali.exe
PID 2696 wrote to memory of 1188	2696	xiuhuali.exe	rundll32.exe
PID 2696 wrote to memory of 1188	2696	xiuhuali.exe	rundll32.exe
PID 2696 wrote to memory of 1188	2696	xiuhuali.exe	rundll32.exe
PID 3924 wrote to memory of 220	3924	keygen-step-4.exe	JoSetp.exe
PID 3924 wrote to memory of 220	3924	keygen-step-4.exe	JoSetp.exe

C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3924

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
3⤵
- Loads dropped DLL
PID:1188

C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
2⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\install.dat
MD5
313b7813c2b3d426f0420148cb24a2d8

SHA1
91cbbcbcfb4d40c4becc4bf6e101cef22d42292b

SHA256
703dfa4e341c0a04a182b9ae00b49da344bd8fdf0f17a5d0a7af2025ac71d2a8

SHA512
1355c614dbd9e3874c45f20ebbb412b2fe04a2d4ecfcd2379610c20a79cc951d1f1e555eb6d6e95d783a72ebe5b07fb6013b0e43f42fb53599e692115e620be4

Download Submit
C:\Program Files\install.dll
MD5
fe60ddbeab6e50c4f490ddf56b52057c

SHA1
6a71fdf73761a1192fd9c6961f66754a63d6db17

SHA256
9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

SHA512
0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
MD5
3b1b318df4d314a35dce9e8fd89e5121

SHA1
55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

SHA256
4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

SHA512
f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
MD5
3b1b318df4d314a35dce9e8fd89e5121

SHA1
55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

SHA256
4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

SHA512
f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
MD5
e72eb3a565d7b5b83c7ff6fad519c6c9

SHA1
1a2668a26b01828eec1415aa614743abb0a4fb70

SHA256
8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

SHA512
71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
MD5
e72eb3a565d7b5b83c7ff6fad519c6c9

SHA1
1a2668a26b01828eec1415aa614743abb0a4fb70

SHA256
8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

SHA512
71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

Download Submit
\Program Files\install.dll
MD5
fe60ddbeab6e50c4f490ddf56b52057c

SHA1
6a71fdf73761a1192fd9c6961f66754a63d6db17

SHA256
9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

SHA512
0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

Download Submit
memory/220-120-0x0000000000000000-mapping.dmp

Download
memory/220-126-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/220-129-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/220-130-0x00000000012F0000-0x000000000130C000-memory.dmp

Filesize
112KB

Download
memory/220-136-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/1188-119-0x0000000000000000-mapping.dmp

Download
memory/1188-128-0x0000000003F46000-0x0000000004047000-memory.dmp

Filesize
1.0MB

Download
memory/2228-133-0x00007FF78BA54060-mapping.dmp

Download
memory/2696-116-0x0000000000000000-mapping.dmp

Download