2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b

General

Target

2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe
Size

260KB
MD5

5747e1a808e070a884a78b672f661b00
SHA1

29a67bb88034f42f5e35b4d5d1c6f40f69b36fd2
SHA256

2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b
SHA512

f312179f2439ad691f9b9bdfae89edece04a89412b2c90229d5df32fc7cc90d7e1820781abaa366e65deb8669755d3f77947b899a4d3969c81e2f972a8bb6e5e
SSDEEP

6144:nd7IgTSrMaIl/jcLijfHFEHWzXvjT85R:npNTSrMaIqLlI/H85R

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

saagier.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	saagier.exe

Executes dropped EXE 1 IoCs

Processes:

saagier.exe

pid process

1528 saagier.exe

Loads dropped DLL 2 IoCs

Processes:

2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe

pid	process
1460	2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe
1460	2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

saagier.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /N"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /G"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /E"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /p"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /v"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /S"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /t"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /P"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /b"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /a"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /V"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /u"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /D"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /J"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /W"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /I"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /d"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /m"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /O"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /R"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /n"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /f"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /h"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /i"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /w"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /z"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /q"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /Y"	saagier.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /g"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /o"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /T"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /M"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /H"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /y"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /F"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /s"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /j"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /U"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /X"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /k"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /A"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /l"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /r"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /B"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /K"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /C"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /Q"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /c"	saagier.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\saagier = "C:\\Users\\Admin\\saagier.exe /Z"	saagier.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

saagier.exe

pid	process
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe
1528	saagier.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exesaagier.exe

pid process

1460 2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe
1528 saagier.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe

description	pid	process	target process
PID 1460 wrote to memory of 1528	1460	2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe	saagier.exe
PID 1460 wrote to memory of 1528	1460	2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe	saagier.exe
PID 1460 wrote to memory of 1528	1460	2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe	saagier.exe
PID 1460 wrote to memory of 1528	1460	2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe	saagier.exe

C:\Users\Admin\AppData\Local\Temp\2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe
"C:\Users\Admin\AppData\Local\Temp\2c0b1452a2040ef98befc67dafa820318bf681a83b283f6907cbe8ae4819bd7b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\saagier.exe
"C:\Users\Admin\saagier.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\saagier.exe

Filesize
260KB

MD5
6ac0069bd59ee22ee1e14f0f6a2724d9

SHA1
494e20ec95d0a010fe3ec4756d3b7816b103658f

SHA256
d5b735ff2220bead73f0a392891eed68337e198a92f6bb25f5dd3f1e484d6c24

SHA512
c72f3f9bd8c2342c1779840cc84c9f7eebd6546fc2ed5705b9fee961ff60386072f1cda1fec78d0fad98077ebcef1e276fb8f23f46daa33e660d4793ec34ad05

Download Submit
C:\Users\Admin\saagier.exe

Filesize
260KB

MD5
6ac0069bd59ee22ee1e14f0f6a2724d9

SHA1
494e20ec95d0a010fe3ec4756d3b7816b103658f

SHA256
d5b735ff2220bead73f0a392891eed68337e198a92f6bb25f5dd3f1e484d6c24

SHA512
c72f3f9bd8c2342c1779840cc84c9f7eebd6546fc2ed5705b9fee961ff60386072f1cda1fec78d0fad98077ebcef1e276fb8f23f46daa33e660d4793ec34ad05

Download Submit
\Users\Admin\saagier.exe

Filesize
260KB

MD5
6ac0069bd59ee22ee1e14f0f6a2724d9

SHA1
494e20ec95d0a010fe3ec4756d3b7816b103658f

SHA256
d5b735ff2220bead73f0a392891eed68337e198a92f6bb25f5dd3f1e484d6c24

SHA512
c72f3f9bd8c2342c1779840cc84c9f7eebd6546fc2ed5705b9fee961ff60386072f1cda1fec78d0fad98077ebcef1e276fb8f23f46daa33e660d4793ec34ad05

Download Submit
\Users\Admin\saagier.exe

Filesize
260KB

MD5
6ac0069bd59ee22ee1e14f0f6a2724d9

SHA1
494e20ec95d0a010fe3ec4756d3b7816b103658f

SHA256
d5b735ff2220bead73f0a392891eed68337e198a92f6bb25f5dd3f1e484d6c24

SHA512
c72f3f9bd8c2342c1779840cc84c9f7eebd6546fc2ed5705b9fee961ff60386072f1cda1fec78d0fad98077ebcef1e276fb8f23f46daa33e660d4793ec34ad05

Download Submit
memory/1460-56-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1528-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads