65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

Target

keygen-step-4d.exe
Size

4.6MB
MD5

563107b1df2a00f4ec868acd9e08a205
SHA1

9cb9c91d66292f5317aa50d92e38834861e9c9b7
SHA256

bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9
SHA512

99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1

Score

8^/10

Malware Config

Executes dropped EXE 2 IoCs

pid	Process
1556	xiuhuali.exe
2768	JoSetp.exe

Drops file in Program Files directory 3 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1556	xiuhuali.exe
1556	xiuhuali.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1556	3456	keygen-step-4d.exe	75
PID 3456 wrote to memory of 1556	3456	keygen-step-4d.exe	75
PID 3456 wrote to memory of 1556	3456	keygen-step-4d.exe	75
PID 1556 wrote to memory of 2748	1556	xiuhuali.exe	77
PID 1556 wrote to memory of 2748	1556	xiuhuali.exe	77
PID 1556 wrote to memory of 2748	1556	xiuhuali.exe	77
PID 3456 wrote to memory of 2768	3456	keygen-step-4d.exe	78
PID 3456 wrote to memory of 2768	3456	keygen-step-4d.exe	78

C:\Users\Admin\AppData\Local\Temp\keygen-step-4d.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
    3⤵
    PID:2748
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
  2⤵
  - Executes dropped EXE
  PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2896

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2748-127-0x00000000011F0000-0x000000000124C000-memory.dmp

Filesize
368KB

Download
memory/2748-126-0x0000000000F91000-0x0000000001092000-memory.dmp

Filesize
1.0MB

Download
memory/2768-128-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2768-133-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/2768-138-0x0000000002470000-0x000000000248C000-memory.dmp

Filesize
112KB

Download
memory/2768-141-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download