3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca

General

Target

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
Size

260KB
MD5

587b62c75a5e59edcc4f453bbdcc7060
SHA1

b8a0cde96ed38eddf2af02c1bbc82c1a6a97afee
SHA256

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca
SHA512

94f86aab5e91eac68d461413dee0785ad3d46a04221c97e075396aa73eeefefda951208f3aefa38b0c2718ae6405bafb123a686d49da0635dd9f8da5e9470b28
SSDEEP

6144:hxUaKrjOsVnJi8Z2W7U/qmpHd68KW5/D6qurNmKzksc:hmqCJb0rsc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

rnquet.exe3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rnquet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

Executes dropped EXE 1 IoCs

Processes:

rnquet.exe

pid process

796 rnquet.exe

pid	process
796	rnquet.exe

Loads dropped DLL 2 IoCs

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

pid	process
1708	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
1708	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

Adds Run key to start application 2 TTPs 47 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rnquet.exe3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /U"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /K"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /z"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /u"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /k"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /M"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /G"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /d"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /V"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /F"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /n"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /w"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /p"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /t"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /m"	rnquet.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /E"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /Z"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /X"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /Q"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /C"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /W"	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /h"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /A"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /i"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /J"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /H"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /x"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /e"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /l"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /B"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /q"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /g"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /s"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /c"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /f"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /j"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /P"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /S"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /N"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /O"	rnquet.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /r"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /W"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /R"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /a"	rnquet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnquet = "C:\\Users\\Admin\\rnquet.exe /I"	rnquet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exernquet.exe

pid	process
1708	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe
796	rnquet.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exernquet.exe

pid process

1708 3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
796 rnquet.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

description	pid	process	target process
PID 1708 wrote to memory of 796	1708	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe	rnquet.exe
PID 1708 wrote to memory of 796	1708	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe	rnquet.exe
PID 1708 wrote to memory of 796	1708	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe	rnquet.exe
PID 1708 wrote to memory of 796	1708	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe	rnquet.exe

C:\Users\Admin\AppData\Local\Temp\3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
"C:\Users\Admin\AppData\Local\Temp\3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\rnquet.exe
"C:\Users\Admin\rnquet.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\rnquet.exe
Filesize
260KB

MD5
2971c06b0f9d107cb9829aaa92f41442

SHA1
bc94ae30cf40ff8fc70ac8b4f988e2d03865f32d

SHA256
9b696f403e1e223f97697c06f463596b5110a6187afd146f16edd0696acac710

SHA512
80c35502d86cd112ee792518e78e37a54c2dd9a150c6f3ab04125c779706d18686ebf2cc2647d35134ea36305c2f1a75a70e0bad842b1a752d9ca2c22d656907

Download Submit
C:\Users\Admin\rnquet.exe
Filesize
260KB

MD5
2971c06b0f9d107cb9829aaa92f41442

SHA1
bc94ae30cf40ff8fc70ac8b4f988e2d03865f32d

SHA256
9b696f403e1e223f97697c06f463596b5110a6187afd146f16edd0696acac710

SHA512
80c35502d86cd112ee792518e78e37a54c2dd9a150c6f3ab04125c779706d18686ebf2cc2647d35134ea36305c2f1a75a70e0bad842b1a752d9ca2c22d656907

Download Submit
\Users\Admin\rnquet.exe
Filesize
260KB

MD5
2971c06b0f9d107cb9829aaa92f41442

SHA1
bc94ae30cf40ff8fc70ac8b4f988e2d03865f32d

SHA256
9b696f403e1e223f97697c06f463596b5110a6187afd146f16edd0696acac710

SHA512
80c35502d86cd112ee792518e78e37a54c2dd9a150c6f3ab04125c779706d18686ebf2cc2647d35134ea36305c2f1a75a70e0bad842b1a752d9ca2c22d656907

Download Submit
\Users\Admin\rnquet.exe
Filesize
260KB

MD5
2971c06b0f9d107cb9829aaa92f41442

SHA1
bc94ae30cf40ff8fc70ac8b4f988e2d03865f32d

SHA256
9b696f403e1e223f97697c06f463596b5110a6187afd146f16edd0696acac710

SHA512
80c35502d86cd112ee792518e78e37a54c2dd9a150c6f3ab04125c779706d18686ebf2cc2647d35134ea36305c2f1a75a70e0bad842b1a752d9ca2c22d656907

Download Submit
memory/796-59-0x0000000000000000-mapping.dmp

Download
memory/1708-56-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads