Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 00:23
Static task
static1
Behavioral task
behavioral1
Sample
23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
Resource
win7-20220901-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
-
Size
460KB
-
MD5
59e5709610450cd0910d414a37f0c004
-
SHA1
de8d36bfc5c392f62a6b6019b0607ff3b8408dbf
-
SHA256
23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c
-
SHA512
7d689f3edbaccc4087c2f33279a5fa956ae9d9c5b35d17c5f0475decd951097d627276661f8048a12cb0b62304fc79e268102a44768b2506595ddf39e458b2eb
-
SSDEEP
12288:zlSt6oIHNOhU5O5TYo4XqTig5GSR9CClDDL:zlSt69HNx6T/5xT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" iBdqphzke5.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoazo.exe -
Executes dropped EXE 6 IoCs
pid Process 1956 iBdqphzke5.exe 3604 astat.exe 4032 astat.exe 1696 xoazo.exe 4732 dstat.exe 2744 fstat.exe -
resource yara_rule behavioral2/memory/4032-145-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4032-148-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4032-149-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4032-162-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation iBdqphzke5.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /H" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /I" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /u" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /S" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /c" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /r" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /E" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /V" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /Q" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /p" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /U" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /D" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /o" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /L" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /a" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /s" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /M" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /W" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /B" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /w" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /y" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /l" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /R" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /z" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /A" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /x" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /b" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /N" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /g" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /i" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /f" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /k" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /t" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /Z" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /J" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /P" iBdqphzke5.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /T" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /e" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /m" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /d" xoazo.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ iBdqphzke5.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /K" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /X" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /j" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /F" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /O" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /n" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /G" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /Y" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /q" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /h" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /v" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /P" xoazo.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoazo = "C:\\Users\\Admin\\xoazo.exe /C" xoazo.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3604 set thread context of 4032 3604 astat.exe 85 PID 2744 set thread context of 4140 2744 fstat.exe 110 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2432 tasklist.exe 60 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1956 iBdqphzke5.exe 1956 iBdqphzke5.exe 4032 astat.exe 4032 astat.exe 1956 iBdqphzke5.exe 1956 iBdqphzke5.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 4032 astat.exe 4032 astat.exe 4032 astat.exe 4032 astat.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe 1696 xoazo.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2432 tasklist.exe Token: SeDebugPrivilege 2744 fstat.exe Token: SeDebugPrivilege 60 tasklist.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 1956 iBdqphzke5.exe 3604 astat.exe 1696 xoazo.exe 4732 dstat.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4800 wrote to memory of 1956 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 83 PID 4800 wrote to memory of 1956 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 83 PID 4800 wrote to memory of 1956 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 83 PID 4800 wrote to memory of 3604 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 84 PID 4800 wrote to memory of 3604 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 84 PID 4800 wrote to memory of 3604 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 84 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 3604 wrote to memory of 4032 3604 astat.exe 85 PID 1956 wrote to memory of 1696 1956 iBdqphzke5.exe 86 PID 1956 wrote to memory of 1696 1956 iBdqphzke5.exe 86 PID 1956 wrote to memory of 1696 1956 iBdqphzke5.exe 86 PID 1956 wrote to memory of 3548 1956 iBdqphzke5.exe 87 PID 1956 wrote to memory of 3548 1956 iBdqphzke5.exe 87 PID 1956 wrote to memory of 3548 1956 iBdqphzke5.exe 87 PID 3548 wrote to memory of 2432 3548 cmd.exe 89 PID 3548 wrote to memory of 2432 3548 cmd.exe 89 PID 3548 wrote to memory of 2432 3548 cmd.exe 89 PID 4800 wrote to memory of 4732 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 90 PID 4800 wrote to memory of 4732 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 90 PID 4800 wrote to memory of 4732 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 90 PID 4800 wrote to memory of 2744 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 106 PID 4800 wrote to memory of 2744 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 106 PID 4800 wrote to memory of 2744 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 106 PID 2744 wrote to memory of 4140 2744 fstat.exe 110 PID 2744 wrote to memory of 4140 2744 fstat.exe 110 PID 2744 wrote to memory of 4140 2744 fstat.exe 110 PID 2744 wrote to memory of 4140 2744 fstat.exe 110 PID 1696 wrote to memory of 4140 1696 xoazo.exe 110 PID 1696 wrote to memory of 4140 1696 xoazo.exe 110 PID 4800 wrote to memory of 856 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 113 PID 4800 wrote to memory of 856 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 113 PID 4800 wrote to memory of 856 4800 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe 113 PID 856 wrote to memory of 60 856 cmd.exe 115 PID 856 wrote to memory of 60 856 cmd.exe 115 PID 856 wrote to memory of 60 856 cmd.exe 115 PID 1696 wrote to memory of 60 1696 xoazo.exe 115 PID 1696 wrote to memory of 60 1696 xoazo.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe"C:\Users\Admin\AppData\Local\Temp\23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\iBdqphzke5.exeC:\Users\Admin\iBdqphzke5.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\xoazo.exe"C:\Users\Admin\xoazo.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del iBdqphzke5.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
-
-
C:\Users\Admin\astat.exeC:\Users\Admin\astat.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\astat.exe"C:\Users\Admin\astat.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4032
-
-
-
C:\Users\Admin\dstat.exeC:\Users\Admin\dstat.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4732
-
-
C:\Users\Admin\fstat.exeC:\Users\Admin\fstat.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:4140
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD587c6498966e3f85fac743c89050aa312
SHA105c165c34cbfa14e4925c33ace81992b0f50a2b5
SHA25630c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5
SHA512740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420
-
Filesize
60KB
MD587c6498966e3f85fac743c89050aa312
SHA105c165c34cbfa14e4925c33ace81992b0f50a2b5
SHA25630c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5
SHA512740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420
-
Filesize
60KB
MD587c6498966e3f85fac743c89050aa312
SHA105c165c34cbfa14e4925c33ace81992b0f50a2b5
SHA25630c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5
SHA512740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420
-
Filesize
36KB
MD5b6da847084e39e0cecf175c32c91b4bb
SHA1fbfd9494fabed5220cdf01866ff088fe7adc535b
SHA256065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe
SHA51259d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2
-
Filesize
36KB
MD5b6da847084e39e0cecf175c32c91b4bb
SHA1fbfd9494fabed5220cdf01866ff088fe7adc535b
SHA256065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe
SHA51259d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2
-
Filesize
271KB
MD534353cf7e1d1b10bcbbcae0745110535
SHA12fb471681daac6f6d66477b7772025da4f58c508
SHA256b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959
SHA5127404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6
-
Filesize
271KB
MD534353cf7e1d1b10bcbbcae0745110535
SHA12fb471681daac6f6d66477b7772025da4f58c508
SHA256b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959
SHA5127404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6
-
Filesize
244KB
MD5a4cdb62cf4866a17e742e7e9cc73d237
SHA130d94f8e872455ac569949ac4c768d0a0cdfbba7
SHA256c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32
SHA512c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671
-
Filesize
244KB
MD5a4cdb62cf4866a17e742e7e9cc73d237
SHA130d94f8e872455ac569949ac4c768d0a0cdfbba7
SHA256c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32
SHA512c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671
-
Filesize
244KB
MD564eecdf33cb7ab900a1961b02a98617f
SHA13043865e01dba561a585b8b8f4c27e6d1475d424
SHA256a02f2bc832a21f6f9912b68cf3fe46df7d366e895b4be0f60ed465ca7443a00e
SHA512727b05d6b978cbbb0e111c5a91fcec7d29fad2f3a8d7e4287c5575d369dca27b27708f1d3a79f02441355fc7436713febe818962db2e3fa63a8c428be0007683
-
Filesize
244KB
MD564eecdf33cb7ab900a1961b02a98617f
SHA13043865e01dba561a585b8b8f4c27e6d1475d424
SHA256a02f2bc832a21f6f9912b68cf3fe46df7d366e895b4be0f60ed465ca7443a00e
SHA512727b05d6b978cbbb0e111c5a91fcec7d29fad2f3a8d7e4287c5575d369dca27b27708f1d3a79f02441355fc7436713febe818962db2e3fa63a8c428be0007683