87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a

General

Target

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
Size

88KB
MD5

a33a0aedfa094aadd074015b2207db86
SHA1

dcb5102ef86fa89b31adedcdee1991616b4ce389
SHA256

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a
SHA512

6d30a62b77a502971b09457eb2ff48441364b6c6c851b249d7d3ff9f7107a76b976720e0594745fb7c1af8163a62c0fe7ce7a53dbf2ea5dfd2a3be5ea73e55ff
SSDEEP

768:fDFIzMsddaqnObOasGEwU8Z1Rbe2kjEQJQ1H7a8zFkzqcwuHW:JIYZiCU8Z1QjEQJecwuHW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

diuaxin.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	diuaxin.exe

Executes dropped EXE 1 IoCs

Processes:

diuaxin.exe

pid process

1560 diuaxin.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

diuaxin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /O"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /r"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /D"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /t"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /K"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /A"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /L"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /S"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /F"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /g"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /v"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /U"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /G"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /V"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /f"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /h"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /M"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /q"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /X"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /N"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /B"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /d"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /x"	diuaxin.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /R"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /C"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /y"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /P"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /n"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /e"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /I"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /o"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /W"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /E"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /z"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /l"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /j"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /Z"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /i"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /s"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /H"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /Q"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /w"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /u"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /p"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /J"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /Y"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /m"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /k"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /T"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /a"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /b"	diuaxin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diuaxin = "C:\\Users\\Admin\\diuaxin.exe /c"	diuaxin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

diuaxin.exe

pid	process
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe
1560	diuaxin.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exediuaxin.exe

pid process

360 87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
1560 diuaxin.exe

pid	process
360	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
1560	diuaxin.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exediuaxin.exe

description	pid	process	target process
PID 360 wrote to memory of 1560	360	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe	diuaxin.exe
PID 360 wrote to memory of 1560	360	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe	diuaxin.exe
PID 360 wrote to memory of 1560	360	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe	diuaxin.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1560 wrote to memory of 360	1560	diuaxin.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe

C:\Users\Admin\AppData\Local\Temp\87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
"C:\Users\Admin\AppData\Local\Temp\87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360

C:\Users\Admin\diuaxin.exe
"C:\Users\Admin\diuaxin.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\diuaxin.exe

Filesize
88KB

MD5
e90e6516bb02b0e72b61760c56fe27e4

SHA1
ed608e1ccb237f7e9fe24ec3b230e2f068e17563

SHA256
037ac2b720fffb9b79a14170f9581bbc0a978a61dcfaed1c94f0dc7a42375cbd

SHA512
6cbaaa6b98e088a2ff3ea04340aea8e8a332f63488e22915f3a06181daa58f511ed12904b5b314bbf6373a0591df42859d668085a135c9ecc12fd4725c86b88e

Download Submit
C:\Users\Admin\diuaxin.exe

Filesize
88KB

MD5
e90e6516bb02b0e72b61760c56fe27e4

SHA1
ed608e1ccb237f7e9fe24ec3b230e2f068e17563

SHA256
037ac2b720fffb9b79a14170f9581bbc0a978a61dcfaed1c94f0dc7a42375cbd

SHA512
6cbaaa6b98e088a2ff3ea04340aea8e8a332f63488e22915f3a06181daa58f511ed12904b5b314bbf6373a0591df42859d668085a135c9ecc12fd4725c86b88e

Download Submit
memory/1560-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads