bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe
Size

524KB
MD5

2cbec03e40a5b039cf09284bf0ec34a8
SHA1

e0b356a51d9bb65421c9a8350baabf081d4c83c8
SHA256

bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b
SHA512

f04295847d0ea634a47efed3edbcfa9197d461843577c374f0d30af909f6179939f937076f2bac33e50267d2851a50bb675f7ab9a7e87f8394141ea501d05db7
SSDEEP

12288:dSFMFpuhRp8tmnkX4C4IosE/rSkU19Zt/kMM22:UF+u+gkX3o1jSkErM2

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

JB3O2vP3.execeaosu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	JB3O2vP3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ceaosu.exe

Executes dropped EXE 10 IoCs

Processes:

JB3O2vP3.exe2sun.exe2sun.exe2sun.exe2sun.exe2sun.exe2sun.execeaosu.exe3sun.exeX

pid process

4468 JB3O2vP3.exe
4336 2sun.exe
1376 2sun.exe
4928 2sun.exe
4216 2sun.exe
3448 2sun.exe
2648 2sun.exe
3584 ceaosu.exe
3672 3sun.exe
4244 X

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1376-145-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/1376-151-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/4928-150-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/1376-149-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/4928-154-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4928-156-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4216-157-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/4216-164-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3448-166-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/1376-165-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/1376-162-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/4928-168-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4216-167-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3448-172-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/4216-171-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3448-174-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/3448-184-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/1376-185-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

JB3O2vP3.exebc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	JB3O2vP3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe

Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 31.193.3.240
Destination IP 31.193.3.240

description	ioc
Destination IP	31.193.3.240
Destination IP	31.193.3.240

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ceaosu.exeJB3O2vP3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /W"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /H"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /f"	ceaosu.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /b"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /h"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /T"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /O"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /Q"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /i"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /j"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /U"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /R"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /G"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /M"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /q"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /C"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /N"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /J"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /z"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /A"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /X"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /o"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /x"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /Y"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /m"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /D"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /Z"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /p"	ceaosu.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	JB3O2vP3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /B"	JB3O2vP3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /V"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /u"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /w"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /I"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /e"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /d"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /v"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /l"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /E"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /n"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /s"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /t"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /g"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /c"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /P"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /K"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /y"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /B"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /a"	ceaosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceaosu = "C:\\Users\\Admin\\ceaosu.exe /k"	ceaosu.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2sun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2sun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2sun.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

2sun.exe

description	pid	process	target process
PID 4336 set thread context of 1376	4336	2sun.exe	2sun.exe
PID 4336 set thread context of 4928	4336	2sun.exe	2sun.exe
PID 4336 set thread context of 4216	4336	2sun.exe	2sun.exe
PID 4336 set thread context of 3448	4336	2sun.exe	2sun.exe
PID 4336 set thread context of 2648	4336	2sun.exe	2sun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3408 2648 WerFault.exe 2sun.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4916 tasklist.exe
2760 tasklist.exe

pid	pid_target	process	target process
3408	2648	WerFault.exe	2sun.exe

pid	process
4916	tasklist.exe
2760	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

JB3O2vP3.exe2sun.exe2sun.execeaosu.exe3sun.exeX

pid	process
4468	JB3O2vP3.exe
4468	JB3O2vP3.exe
4928	2sun.exe
4928	2sun.exe
4468	JB3O2vP3.exe
4468	JB3O2vP3.exe
4216	2sun.exe
4216	2sun.exe
4928	2sun.exe
4928	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
4216	2sun.exe
4216	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
4928	2sun.exe
4928	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
4928	2sun.exe
4928	2sun.exe
4928	2sun.exe
4928	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
3672	3sun.exe
3672	3sun.exe
4244	X
4244	X
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
4928	2sun.exe
4928	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
4928	2sun.exe
4928	2sun.exe
4928	2sun.exe
4928	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
3584	ceaosu.exe
4928	2sun.exe
4928	2sun.exe
4928	2sun.exe
4928	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
4928	2sun.exe
4928	2sun.exe
3584	ceaosu.exe
3584	ceaosu.exe
4928	2sun.exe
4928	2sun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2424 Explorer.EXE

pid	process
2424	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

tasklist.exe3sun.exeExplorer.EXEtasklist.exe

description	pid	process
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	3672	3sun.exe
Token: SeDebugPrivilege	3672	3sun.exe
Token: SeShutdownPrivilege	2424	Explorer.EXE
Token: SeCreatePagefilePrivilege	2424	Explorer.EXE
Token: SeShutdownPrivilege	2424	Explorer.EXE
Token: SeCreatePagefilePrivilege	2424	Explorer.EXE
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeShutdownPrivilege	2424	Explorer.EXE
Token: SeCreatePagefilePrivilege	2424	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exeJB3O2vP3.exe2sun.exe2sun.exe2sun.execeaosu.exe

pid process

4676 bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe
4468 JB3O2vP3.exe
4336 2sun.exe
1376 2sun.exe
3448 2sun.exe
3584 ceaosu.exe

pid	process
4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe
4468	JB3O2vP3.exe
4336	2sun.exe
1376	2sun.exe
3448	2sun.exe
3584	ceaosu.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe2sun.exeJB3O2vP3.execmd.execeaosu.exe3sun.exeXcmd.exe

description	pid	process	target process
PID 4676 wrote to memory of 4468	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	JB3O2vP3.exe
PID 4676 wrote to memory of 4468	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	JB3O2vP3.exe
PID 4676 wrote to memory of 4468	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	JB3O2vP3.exe
PID 4676 wrote to memory of 4336	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	2sun.exe
PID 4676 wrote to memory of 4336	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	2sun.exe
PID 4676 wrote to memory of 4336	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 1376	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4928	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 4216	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 3448	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 2648	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 2648	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 2648	4336	2sun.exe	2sun.exe
PID 4336 wrote to memory of 2648	4336	2sun.exe	2sun.exe
PID 4468 wrote to memory of 3584	4468	JB3O2vP3.exe	ceaosu.exe
PID 4468 wrote to memory of 3584	4468	JB3O2vP3.exe	ceaosu.exe
PID 4468 wrote to memory of 3584	4468	JB3O2vP3.exe	ceaosu.exe
PID 4468 wrote to memory of 216	4468	JB3O2vP3.exe	cmd.exe
PID 4468 wrote to memory of 216	4468	JB3O2vP3.exe	cmd.exe
PID 4468 wrote to memory of 216	4468	JB3O2vP3.exe	cmd.exe
PID 4676 wrote to memory of 3672	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	3sun.exe
PID 4676 wrote to memory of 3672	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	3sun.exe
PID 4676 wrote to memory of 3672	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	3sun.exe
PID 216 wrote to memory of 2760	216	cmd.exe	tasklist.exe
PID 216 wrote to memory of 2760	216	cmd.exe	tasklist.exe
PID 216 wrote to memory of 2760	216	cmd.exe	tasklist.exe
PID 3584 wrote to memory of 2760	3584	ceaosu.exe	tasklist.exe
PID 3584 wrote to memory of 2760	3584	ceaosu.exe	tasklist.exe
PID 3672 wrote to memory of 4244	3672	3sun.exe	X
PID 3672 wrote to memory of 4244	3672	3sun.exe	X
PID 4244 wrote to memory of 2424	4244	X	Explorer.EXE
PID 4676 wrote to memory of 664	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	cmd.exe
PID 4676 wrote to memory of 664	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	cmd.exe
PID 4676 wrote to memory of 664	4676	bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe	cmd.exe
PID 664 wrote to memory of 4916	664	cmd.exe	tasklist.exe
PID 664 wrote to memory of 4916	664	cmd.exe	tasklist.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Users\Admin\AppData\Local\Temp\bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe
"C:\Users\Admin\AppData\Local\Temp\bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676

C:\Users\Admin\JB3O2vP3.exe
C:\Users\Admin\JB3O2vP3.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468

C:\Users\Admin\ceaosu.exe
"C:\Users\Admin\ceaosu.exe"
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del JB3O2vP3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Users\Admin\2sun.exe
C:\Users\Admin\2sun.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336

C:\Users\Admin\2sun.exe
"C:\Users\Admin\2sun.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1376

C:\Users\Admin\2sun.exe
"C:\Users\Admin\2sun.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4928

C:\Users\Admin\2sun.exe
"C:\Users\Admin\2sun.exe"
4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4216

C:\Users\Admin\2sun.exe
"C:\Users\Admin\2sun.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Users\Admin\2sun.exe
"C:\Users\Admin\2sun.exe"
4⤵
- Executes dropped EXE
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 80
5⤵
- Program crash
PID:3408

C:\Users\Admin\3sun.exe
C:\Users\Admin\3sun.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Local\2aebb42b\X
*0*bc*589e18eb*31.193.3.240:53
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del bc31b9a0a04cdbb2db963b14dd35bab87b46bfa1b70626ee1fabc1654ee4093b.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2648 -ip 2648
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2sun.exe

Filesize
128KB

MD5
cba16c1a489b02c4ff5720c68f35f787

SHA1
bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

SHA256
0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

SHA512
00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

Download Submit
C:\Users\Admin\2sun.exe

Filesize
128KB

MD5
cba16c1a489b02c4ff5720c68f35f787

SHA1
bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

SHA256
0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

SHA512
00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

Download Submit
C:\Users\Admin\2sun.exe

Filesize
128KB

MD5
cba16c1a489b02c4ff5720c68f35f787

SHA1
bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

SHA256
0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

SHA512
00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

Download Submit
C:\Users\Admin\2sun.exe

Filesize
128KB

MD5
cba16c1a489b02c4ff5720c68f35f787

SHA1
bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

SHA256
0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

SHA512
00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

Download Submit
C:\Users\Admin\2sun.exe

Filesize
128KB

MD5
cba16c1a489b02c4ff5720c68f35f787

SHA1
bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

SHA256
0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

SHA512
00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

Download Submit
C:\Users\Admin\2sun.exe

Filesize
128KB

MD5
cba16c1a489b02c4ff5720c68f35f787

SHA1
bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

SHA256
0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

SHA512
00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

Download Submit
C:\Users\Admin\2sun.exe

Filesize
128KB

MD5
cba16c1a489b02c4ff5720c68f35f787

SHA1
bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

SHA256
0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

SHA512
00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

Download Submit
C:\Users\Admin\3sun.exe

Filesize
278KB

MD5
345cbbd3a56a313f804b997f8cbecb2b

SHA1
9978d6f5bca8ab1486573ff073661e7cfd40c365

SHA256
492c8cf86fcfa07fcf5716b17593a9ec265c5aa919c2fe563a34ece1580b055c

SHA512
5cdb8b00ab0d653a34b3d1b2871ebeb0badfe223779dce775adf00d577a2931f77c1e6d92cda719e32a8683f6f729179f128472efdf6ec0ac18cbdbcfbbc237d

Download Submit
C:\Users\Admin\3sun.exe

Filesize
278KB

MD5
345cbbd3a56a313f804b997f8cbecb2b

SHA1
9978d6f5bca8ab1486573ff073661e7cfd40c365

SHA256
492c8cf86fcfa07fcf5716b17593a9ec265c5aa919c2fe563a34ece1580b055c

SHA512
5cdb8b00ab0d653a34b3d1b2871ebeb0badfe223779dce775adf00d577a2931f77c1e6d92cda719e32a8683f6f729179f128472efdf6ec0ac18cbdbcfbbc237d

Download Submit
C:\Users\Admin\AppData\Local\2aebb42b\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
C:\Users\Admin\AppData\Local\2aebb42b\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
C:\Users\Admin\JB3O2vP3.exe

Filesize
228KB

MD5
290d691efc05b13247d2f6d8952a215b

SHA1
a885524eae321c2d025dd8e2fe4c8dd76dfb0ca0

SHA256
43b951fb64328c15a0592d228e90f05be14b4f18a902c35b5c0451020e1d82be

SHA512
8dfdcdd93b47db1b490a80fd1c483e5f10d18d782f34562bf7313039040c69878fb1d6ad22f1b3d6e48dcc8db507c430f11b1a976b48f9cd1769400fba4c150e

Download Submit
C:\Users\Admin\JB3O2vP3.exe

Filesize
228KB

MD5
290d691efc05b13247d2f6d8952a215b

SHA1
a885524eae321c2d025dd8e2fe4c8dd76dfb0ca0

SHA256
43b951fb64328c15a0592d228e90f05be14b4f18a902c35b5c0451020e1d82be

SHA512
8dfdcdd93b47db1b490a80fd1c483e5f10d18d782f34562bf7313039040c69878fb1d6ad22f1b3d6e48dcc8db507c430f11b1a976b48f9cd1769400fba4c150e

Download Submit
C:\Users\Admin\ceaosu.exe

Filesize
228KB

MD5
359d10b5df9f7d4c409f55652418bf28

SHA1
9c714d2223639a79d0b3b723b9bb8df6dc8e2ced

SHA256
54291a19008c58dcd0fae93b1851d6ea8a592a0b54f9485d1ecbc5bb2d35f8fe

SHA512
c2d89fddd6306f36b6abe83eaa77f280e29a2bdc6594d4fbe134e52db2bce0e3a681b02741c4078f4781b8279593653c736ca30366d2694a86c19603ebd9f6fa

Download Submit
C:\Users\Admin\ceaosu.exe

Filesize
228KB

MD5
359d10b5df9f7d4c409f55652418bf28

SHA1
9c714d2223639a79d0b3b723b9bb8df6dc8e2ced

SHA256
54291a19008c58dcd0fae93b1851d6ea8a592a0b54f9485d1ecbc5bb2d35f8fe

SHA512
c2d89fddd6306f36b6abe83eaa77f280e29a2bdc6594d4fbe134e52db2bce0e3a681b02741c4078f4781b8279593653c736ca30366d2694a86c19603ebd9f6fa

Download Submit
memory/216-183-0x0000000000000000-mapping.dmp

Download
memory/664-197-0x0000000000000000-mapping.dmp

Download
memory/1376-162-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1376-149-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1376-145-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1376-144-0x0000000000000000-mapping.dmp

Download
memory/1376-165-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1376-151-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1376-185-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2648-173-0x0000000000000000-mapping.dmp

Download
memory/2760-189-0x0000000000000000-mapping.dmp

Download
memory/3448-166-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3448-172-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3448-184-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3448-174-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3448-163-0x0000000000000000-mapping.dmp

Download
memory/3584-178-0x0000000000000000-mapping.dmp

Download
memory/3672-190-0x0000000030670000-0x00000000306C1000-memory.dmp

Filesize
324KB

Download
memory/3672-186-0x0000000000000000-mapping.dmp

Download
memory/3672-196-0x00000000008EF000-0x0000000000924000-memory.dmp

Filesize
212KB

Download
memory/3672-195-0x0000000030670000-0x00000000306C1000-memory.dmp

Filesize
324KB

Download
memory/3672-191-0x00000000008EF000-0x0000000000924000-memory.dmp

Filesize
212KB

Download
memory/4216-171-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4216-167-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4216-155-0x0000000000000000-mapping.dmp

Download
memory/4216-164-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4216-157-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4244-192-0x0000000000000000-mapping.dmp

Download
memory/4336-139-0x0000000000000000-mapping.dmp

Download
memory/4468-134-0x0000000000000000-mapping.dmp

Download
memory/4916-198-0x0000000000000000-mapping.dmp

Download
memory/4928-148-0x0000000000000000-mapping.dmp

Download
memory/4928-154-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4928-150-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4928-168-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4928-156-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download