Analysis
-
max time kernel
152s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:45
Static task
static1
Behavioral task
behavioral1
Sample
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe
Resource
win10v2004-20221111-en
General
-
Target
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe
-
Size
180KB
-
MD5
5afa821c64f2dcd9bbe95c64f929fc5c
-
SHA1
35c423c30d3ba3e494abc558f3f06bff81268c37
-
SHA256
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050
-
SHA512
71216f4cb346f6bae0a88d3111c0c5dc446b7e04cf0acec7d1bf3d4f6601bf7232cf630b4c58dc8a50f559e83cc42b332f7456694bb96f23363ece11a75dce03
-
SSDEEP
3072:6IMGdYRLoeEdRos/eaqFnqWDb+uTyLDC6s5sSYqGlC6YViZj5HQXZmmJ0yCFiox+:VtcKPpm2lC6YViZj5HQXZmmJ0yCF9Bx/
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exekoitui.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" koitui.exe -
Executes dropped EXE 1 IoCs
Processes:
koitui.exepid process 1272 koitui.exe -
Loads dropped DLL 2 IoCs
Processes:
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exepid process 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe -
Adds Run key to start application 2 TTPs 49 IoCs
Processes:
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exekoitui.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /u" e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /g" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /t" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /P" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /C" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /X" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /n" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /Z" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /j" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /z" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /T" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /l" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /w" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /u" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /N" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /b" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /D" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /y" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /I" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /e" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /E" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /F" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /f" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /Q" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /H" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /o" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /G" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /W" koitui.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /M" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /i" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /q" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /K" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /k" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /A" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /L" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /U" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /V" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /R" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /v" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /J" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /Y" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /c" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /O" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /B" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /h" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /S" koitui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\koitui = "C:\\Users\\Admin\\koitui.exe /p" koitui.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exekoitui.exepid process 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe 1272 koitui.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exekoitui.exepid process 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe 1272 koitui.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exedescription pid process target process PID 2044 wrote to memory of 1272 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe koitui.exe PID 2044 wrote to memory of 1272 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe koitui.exe PID 2044 wrote to memory of 1272 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe koitui.exe PID 2044 wrote to memory of 1272 2044 e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe koitui.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe"C:\Users\Admin\AppData\Local\Temp\e73b6e84389fb3c5a96634010b6ae3de1480701d04aa442a642a5f4639050050.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\koitui.exe"C:\Users\Admin\koitui.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\koitui.exeFilesize
180KB
MD5b5b6c0042bd88ff02453b62f8b5ffc17
SHA126674886c07df0042a79d0a995aca4f1b26bbcfc
SHA25666bad2a367a238ea658ecbf827e29ee91eb3b4f7a9cd874d84b1d539330ba558
SHA5121ababad8c77967957512f6ef3b1079a48323b463ed8c0635455bfcdec3f4f000ba8e4b7a3596355cf085f10a4a2691e7cd34dda4dd38563e2765bcc345854383
-
C:\Users\Admin\koitui.exeFilesize
180KB
MD5b5b6c0042bd88ff02453b62f8b5ffc17
SHA126674886c07df0042a79d0a995aca4f1b26bbcfc
SHA25666bad2a367a238ea658ecbf827e29ee91eb3b4f7a9cd874d84b1d539330ba558
SHA5121ababad8c77967957512f6ef3b1079a48323b463ed8c0635455bfcdec3f4f000ba8e4b7a3596355cf085f10a4a2691e7cd34dda4dd38563e2765bcc345854383
-
\Users\Admin\koitui.exeFilesize
180KB
MD5b5b6c0042bd88ff02453b62f8b5ffc17
SHA126674886c07df0042a79d0a995aca4f1b26bbcfc
SHA25666bad2a367a238ea658ecbf827e29ee91eb3b4f7a9cd874d84b1d539330ba558
SHA5121ababad8c77967957512f6ef3b1079a48323b463ed8c0635455bfcdec3f4f000ba8e4b7a3596355cf085f10a4a2691e7cd34dda4dd38563e2765bcc345854383
-
\Users\Admin\koitui.exeFilesize
180KB
MD5b5b6c0042bd88ff02453b62f8b5ffc17
SHA126674886c07df0042a79d0a995aca4f1b26bbcfc
SHA25666bad2a367a238ea658ecbf827e29ee91eb3b4f7a9cd874d84b1d539330ba558
SHA5121ababad8c77967957512f6ef3b1079a48323b463ed8c0635455bfcdec3f4f000ba8e4b7a3596355cf085f10a4a2691e7cd34dda4dd38563e2765bcc345854383
-
memory/1272-59-0x0000000000000000-mapping.dmp
-
memory/2044-56-0x0000000076651000-0x0000000076653000-memory.dmpFilesize
8KB