30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403

General

Target

30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe
Size

248KB
MD5

4f0754bfb665bff121c620c94bbd5ea0
SHA1

04d89f4784b1d91c187f4541785342a38d6ffecd
SHA256

30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403
SHA512

5386b07b319c1a9dfc60aa454c6042a76bb2041b0634e1bdaae30ddaf374def000be3d3ad590a2cdf2563be6ab464ef71069f29935d0ff627dfbea7f8c9eeea6
SSDEEP

6144:9YM5CElofkFWQPtnRneqAKnvmb7/D269fgwMty0e6ndv0DEQ:935CLkFfnRnWKnvmb7/D26qndv0DV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exekoocou.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	koocou.exe

Executes dropped EXE 1 IoCs

Processes:

koocou.exe

pid process

4272 koocou.exe

pid	process
4272	koocou.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe

Adds Run key to start application 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

koocou.exe30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /k"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /g"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /u"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /x"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /n"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /r"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /E"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /K"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /B"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /D"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /G"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /M"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /o"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /e"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /j"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /y"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /X"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /O"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /s"	koocou.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /H"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /t"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /C"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /Z"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /p"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /v"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /d"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /a"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /L"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /J"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /A"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /N"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /m"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /T"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /P"	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /l"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /h"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /w"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /f"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /U"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /z"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /c"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /I"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /F"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /W"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /i"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /S"	koocou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koocou = "C:\\Users\\Admin\\koocou.exe /b"	koocou.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exekoocou.exe

pid	process
3164	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe
3164	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe
4272	koocou.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exekoocou.exe

pid process

3164 30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe
4272 koocou.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe

description	pid	process	target process
PID 3164 wrote to memory of 4272	3164	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe	koocou.exe
PID 3164 wrote to memory of 4272	3164	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe	koocou.exe
PID 3164 wrote to memory of 4272	3164	30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe	koocou.exe

C:\Users\Admin\AppData\Local\Temp\30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe
"C:\Users\Admin\AppData\Local\Temp\30b45ea2988dc969826e0bc73573d1cb931979821cfa15a97d866ab94f44d403.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164

C:\Users\Admin\koocou.exe
"C:\Users\Admin\koocou.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\koocou.exe

Filesize
248KB

MD5
de61dfd0af4e02827c3988c0797d2097

SHA1
a2a9349740b4bfaa3c3a602ab7cf848b7d1e5bbb

SHA256
eb9ce59f698f505b45c5e686f2e47cef5e923ab8d776969e7bc30fda8a8e7467

SHA512
6afdea0610027c20214fe5f682031eb38495ada0680dd3a1651285cc403b9a07c9960a8da7307743716803fc663ae4de682a61c418b8a69362635a82a64b02a1

Download Submit
C:\Users\Admin\koocou.exe

Filesize
248KB

MD5
de61dfd0af4e02827c3988c0797d2097

SHA1
a2a9349740b4bfaa3c3a602ab7cf848b7d1e5bbb

SHA256
eb9ce59f698f505b45c5e686f2e47cef5e923ab8d776969e7bc30fda8a8e7467

SHA512
6afdea0610027c20214fe5f682031eb38495ada0680dd3a1651285cc403b9a07c9960a8da7307743716803fc663ae4de682a61c418b8a69362635a82a64b02a1

Download Submit
memory/4272-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads