Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:52
Static task
static1
Behavioral task
behavioral1
Sample
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe
Resource
win10v2004-20220901-en
General
-
Target
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe
-
Size
156KB
-
MD5
52013a290b36ae28fbdc7f152a6814f0
-
SHA1
657d07ce3d2aebafb04a67f277f5d6701edefa1b
-
SHA256
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4
-
SHA512
5d17506ea894be73090e68bc17986a1cdfc52407846c7a7b42f39d0db244f938646d76f3653af20e12fce760622fee86d2e770dff5f527a35ba80f96c78cefec
-
SSDEEP
3072:awBMPJ4T2vaHfQmuKM7U6L9sxsHrl3B0mhQjUqvGH4oQZiEbgy:nBy4Sva/QVK+SxsHrl3B0mhPq+JW/
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
moate.exe8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" moate.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe -
Executes dropped EXE 1 IoCs
Processes:
moate.exepid process 1660 moate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe -
Adds Run key to start application 2 TTPs 53 IoCs
Processes:
moate.exe8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /H" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /B" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /b" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /Y" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /x" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /t" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /Q" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /J" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /X" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /o" moate.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /z" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /M" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /O" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /R" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /d" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /m" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /T" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /f" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /G" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /e" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /w" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /c" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /I" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /E" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /D" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /j" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /S" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /F" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /Z" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /r" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /a" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /I" 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /U" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /W" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /u" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /A" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /V" moate.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /v" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /l" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /P" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /s" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /L" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /g" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /i" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /n" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /q" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /N" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /h" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /p" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /k" moate.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moate = "C:\\Users\\Admin\\moate.exe /y" moate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exemoate.exepid process 476 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe 476 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe 1660 moate.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exemoate.exepid process 476 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe 1660 moate.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exedescription pid process target process PID 476 wrote to memory of 1660 476 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe moate.exe PID 476 wrote to memory of 1660 476 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe moate.exe PID 476 wrote to memory of 1660 476 8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe moate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe"C:\Users\Admin\AppData\Local\Temp\8b9d7b8060bb947a1e0f9eae2e565e72c56a22792ded865eacf2318f844318b4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\moate.exe"C:\Users\Admin\moate.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\moate.exeFilesize
156KB
MD5bef5fd9ca814c44123594a5297c0d752
SHA1063eed87daed5f3a1cac44d5ce01e77664fa61e8
SHA256d5a758bd692b9cc863cbed51e92b31d31546fb39fd8a4dc7aae487d9439a7b54
SHA51297d16a961b0e7cc59af1f070c9fd4bebeb8bee27834d03999a445b18fdf8928726cef03258b5e6e12b1654d54f8f4e5c98c67adffa55faf0e1f4c728c1be4c33
-
C:\Users\Admin\moate.exeFilesize
156KB
MD5bef5fd9ca814c44123594a5297c0d752
SHA1063eed87daed5f3a1cac44d5ce01e77664fa61e8
SHA256d5a758bd692b9cc863cbed51e92b31d31546fb39fd8a4dc7aae487d9439a7b54
SHA51297d16a961b0e7cc59af1f070c9fd4bebeb8bee27834d03999a445b18fdf8928726cef03258b5e6e12b1654d54f8f4e5c98c67adffa55faf0e1f4c728c1be4c33
-
memory/1660-134-0x0000000000000000-mapping.dmp