c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02

Analysis

max time kernel
283s
max time network
338s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Size

255KB
MD5

61507aec123d36be1cb4764fd14de856
SHA1

dddf303620edc157641ff233dcb2e8dd8f84ab14
SHA256

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02
SHA512

81c89fa6d62c54e6b60114d06623c0f9065a5d8ed44987f02344e842cc0103e48e72e7ed5420fb44cdd6bec919b108ddf1260ce56a704b5402bdb85a1d668d1f
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJy:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIv

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

mobcjzhsen.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	mobcjzhsen.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

mobcjzhsen.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	mobcjzhsen.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

mobcjzhsen.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	mobcjzhsen.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

mobcjzhsen.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	mobcjzhsen.exe

Executes dropped EXE 5 IoCs

Processes:

mobcjzhsen.exeskdhmblhrplieuw.exeesodfumn.exebwqkfrxqeqftu.exeesodfumn.exe

pid process

3592 mobcjzhsen.exe
4936 skdhmblhrplieuw.exe
4564 esodfumn.exe
1388 bwqkfrxqeqftu.exe
852 esodfumn.exe

pid	process
3592	mobcjzhsen.exe
4936	skdhmblhrplieuw.exe
4564	esodfumn.exe
1388	bwqkfrxqeqftu.exe
852	esodfumn.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4072-132-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4072-133-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\mobcjzhsen.exe	upx
C:\Windows\SysWOW64\mobcjzhsen.exe	upx
behavioral2/memory/3592-137-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\skdhmblhrplieuw.exe	upx
C:\Windows\SysWOW64\skdhmblhrplieuw.exe	upx
C:\Windows\SysWOW64\esodfumn.exe	upx
C:\Windows\SysWOW64\esodfumn.exe	upx
C:\Windows\SysWOW64\bwqkfrxqeqftu.exe	upx
C:\Windows\SysWOW64\bwqkfrxqeqftu.exe	upx
behavioral2/memory/4936-147-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4564-148-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/1388-149-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4936-150-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/1388-151-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\esodfumn.exe	upx
behavioral2/memory/852-154-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/852-156-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4072-157-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

mobcjzhsen.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	mobcjzhsen.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

skdhmblhrplieuw.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\banhtmtk = "skdhmblhrplieuw.exe"	skdhmblhrplieuw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "bwqkfrxqeqftu.exe"	skdhmblhrplieuw.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	skdhmblhrplieuw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ljvihbvp = "mobcjzhsen.exe"	skdhmblhrplieuw.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

mobcjzhsen.exeesodfumn.exeesodfumn.exe

description	ioc	process
File opened (read-only)	\??\e:	mobcjzhsen.exe
File opened (read-only)	\??\o:	mobcjzhsen.exe
File opened (read-only)	\??\e:	esodfumn.exe
File opened (read-only)	\??\e:	esodfumn.exe
File opened (read-only)	\??\l:	esodfumn.exe
File opened (read-only)	\??\r:	esodfumn.exe
File opened (read-only)	\??\t:	esodfumn.exe
File opened (read-only)	\??\k:	mobcjzhsen.exe
File opened (read-only)	\??\z:	mobcjzhsen.exe
File opened (read-only)	\??\g:	esodfumn.exe
File opened (read-only)	\??\s:	esodfumn.exe
File opened (read-only)	\??\a:	esodfumn.exe
File opened (read-only)	\??\h:	esodfumn.exe
File opened (read-only)	\??\i:	esodfumn.exe
File opened (read-only)	\??\j:	mobcjzhsen.exe
File opened (read-only)	\??\i:	mobcjzhsen.exe
File opened (read-only)	\??\w:	esodfumn.exe
File opened (read-only)	\??\m:	esodfumn.exe
File opened (read-only)	\??\n:	esodfumn.exe
File opened (read-only)	\??\a:	mobcjzhsen.exe
File opened (read-only)	\??\b:	mobcjzhsen.exe
File opened (read-only)	\??\k:	esodfumn.exe
File opened (read-only)	\??\w:	esodfumn.exe
File opened (read-only)	\??\p:	esodfumn.exe
File opened (read-only)	\??\j:	esodfumn.exe
File opened (read-only)	\??\h:	mobcjzhsen.exe
File opened (read-only)	\??\l:	mobcjzhsen.exe
File opened (read-only)	\??\t:	mobcjzhsen.exe
File opened (read-only)	\??\b:	esodfumn.exe
File opened (read-only)	\??\g:	mobcjzhsen.exe
File opened (read-only)	\??\u:	esodfumn.exe
File opened (read-only)	\??\x:	esodfumn.exe
File opened (read-only)	\??\r:	mobcjzhsen.exe
File opened (read-only)	\??\z:	esodfumn.exe
File opened (read-only)	\??\q:	mobcjzhsen.exe
File opened (read-only)	\??\v:	mobcjzhsen.exe
File opened (read-only)	\??\i:	esodfumn.exe
File opened (read-only)	\??\y:	esodfumn.exe
File opened (read-only)	\??\z:	esodfumn.exe
File opened (read-only)	\??\m:	mobcjzhsen.exe
File opened (read-only)	\??\n:	mobcjzhsen.exe
File opened (read-only)	\??\x:	mobcjzhsen.exe
File opened (read-only)	\??\f:	esodfumn.exe
File opened (read-only)	\??\p:	esodfumn.exe
File opened (read-only)	\??\v:	esodfumn.exe
File opened (read-only)	\??\w:	mobcjzhsen.exe
File opened (read-only)	\??\b:	esodfumn.exe
File opened (read-only)	\??\n:	esodfumn.exe
File opened (read-only)	\??\v:	esodfumn.exe
File opened (read-only)	\??\y:	esodfumn.exe
File opened (read-only)	\??\q:	esodfumn.exe
File opened (read-only)	\??\g:	esodfumn.exe
File opened (read-only)	\??\u:	esodfumn.exe
File opened (read-only)	\??\x:	esodfumn.exe
File opened (read-only)	\??\h:	esodfumn.exe
File opened (read-only)	\??\a:	esodfumn.exe
File opened (read-only)	\??\j:	esodfumn.exe
File opened (read-only)	\??\l:	esodfumn.exe
File opened (read-only)	\??\r:	esodfumn.exe
File opened (read-only)	\??\q:	esodfumn.exe
File opened (read-only)	\??\f:	mobcjzhsen.exe
File opened (read-only)	\??\p:	mobcjzhsen.exe
File opened (read-only)	\??\s:	mobcjzhsen.exe
File opened (read-only)	\??\o:	esodfumn.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

mobcjzhsen.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	mobcjzhsen.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	mobcjzhsen.exe

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4072-132-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4072-133-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/3592-137-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4936-147-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4564-148-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/1388-149-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4936-150-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/1388-151-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/852-154-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/852-156-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4072-157-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exemobcjzhsen.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\skdhmblhrplieuw.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
File created	C:\Windows\SysWOW64\bwqkfrxqeqftu.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
File opened for modification	C:\Windows\SysWOW64\bwqkfrxqeqftu.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
File created	C:\Windows\SysWOW64\mobcjzhsen.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
File created	C:\Windows\SysWOW64\skdhmblhrplieuw.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
File opened for modification	C:\Windows\SysWOW64\esodfumn.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	mobcjzhsen.exe
File opened for modification	C:\Windows\SysWOW64\mobcjzhsen.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
File created	C:\Windows\SysWOW64\esodfumn.exe	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe

Drops file in Windows directory 1 IoCs

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe

description ioc process

File opened for modification C:\Windows\mydoc.rtf c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe

Modifies registry class 20 IoCs

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exemobcjzhsen.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCDFABFF910F191837D3B4386973999B38D038D4364034BE1CB459E09D4"	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1839C60915ECDAB3B9C07CE9ECE534BB"	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	mobcjzhsen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	mobcjzhsen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	mobcjzhsen.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B02947E1399F53C8B9D73298D7C8"	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FD6BC6FF1D21D1D278D0D38B7F906A"	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	mobcjzhsen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	mobcjzhsen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	mobcjzhsen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	mobcjzhsen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	mobcjzhsen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	mobcjzhsen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334E2C779C5283256A3677A1702E2DDD7DF464D7"	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E88FCFB4F58851A9145D65A7E9DBC97E137584667416243D691"	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	mobcjzhsen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	mobcjzhsen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	mobcjzhsen.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exemobcjzhsen.exeskdhmblhrplieuw.exeesodfumn.exebwqkfrxqeqftu.exe

pid	process
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
4564	esodfumn.exe
4564	esodfumn.exe
4564	esodfumn.exe
4564	esodfumn.exe
4564	esodfumn.exe
4564	esodfumn.exe
4564	esodfumn.exe
4564	esodfumn.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
4936	skdhmblhrplieuw.exe
4936	skdhmblhrplieuw.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exemobcjzhsen.exeesodfumn.exeskdhmblhrplieuw.exebwqkfrxqeqftu.exeesodfumn.exe

pid	process
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
4564	esodfumn.exe
4936	skdhmblhrplieuw.exe
4564	esodfumn.exe
4936	skdhmblhrplieuw.exe
4564	esodfumn.exe
4936	skdhmblhrplieuw.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
852	esodfumn.exe
852	esodfumn.exe
852	esodfumn.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exemobcjzhsen.exeesodfumn.exeskdhmblhrplieuw.exebwqkfrxqeqftu.exeesodfumn.exe

pid	process
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
3592	mobcjzhsen.exe
4564	esodfumn.exe
4936	skdhmblhrplieuw.exe
4564	esodfumn.exe
4936	skdhmblhrplieuw.exe
4564	esodfumn.exe
4936	skdhmblhrplieuw.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
1388	bwqkfrxqeqftu.exe
852	esodfumn.exe
852	esodfumn.exe
852	esodfumn.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exemobcjzhsen.exe

description	pid	process	target process
PID 4072 wrote to memory of 3592	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	mobcjzhsen.exe
PID 4072 wrote to memory of 3592	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	mobcjzhsen.exe
PID 4072 wrote to memory of 3592	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	mobcjzhsen.exe
PID 4072 wrote to memory of 4936	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	skdhmblhrplieuw.exe
PID 4072 wrote to memory of 4936	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	skdhmblhrplieuw.exe
PID 4072 wrote to memory of 4936	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	skdhmblhrplieuw.exe
PID 4072 wrote to memory of 4564	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	esodfumn.exe
PID 4072 wrote to memory of 4564	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	esodfumn.exe
PID 4072 wrote to memory of 4564	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	esodfumn.exe
PID 4072 wrote to memory of 1388	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	bwqkfrxqeqftu.exe
PID 4072 wrote to memory of 1388	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	bwqkfrxqeqftu.exe
PID 4072 wrote to memory of 1388	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	bwqkfrxqeqftu.exe
PID 3592 wrote to memory of 852	3592	mobcjzhsen.exe	esodfumn.exe
PID 3592 wrote to memory of 852	3592	mobcjzhsen.exe	esodfumn.exe
PID 3592 wrote to memory of 852	3592	mobcjzhsen.exe	esodfumn.exe
PID 4072 wrote to memory of 4424	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	WINWORD.EXE
PID 4072 wrote to memory of 4424	4072	c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe
"C:\Users\Admin\AppData\Local\Temp\c980b65d5c2d27a0a19d53dbc384fddfca37a2a81c2db9c55564a757939cfc02.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\mobcjzhsen.exe
mobcjzhsen.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\esodfumn.exe
C:\Windows\system32\esodfumn.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:852

C:\Windows\SysWOW64\skdhmblhrplieuw.exe
skdhmblhrplieuw.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4936

C:\Windows\SysWOW64\esodfumn.exe
esodfumn.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4564

C:\Windows\SysWOW64\bwqkfrxqeqftu.exe
bwqkfrxqeqftu.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1388

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
2⤵
PID:4424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bwqkfrxqeqftu.exe

Filesize
255KB

MD5
da4873e14dd28f4646a35720d9e92434

SHA1
18761b05644d95b7249d6659348a1be9602c9f34

SHA256
0bdd9ee9b181274ff9e7effd63488f5887c7f85c0afa1a9c3cb6f3d4b5d9d70f

SHA512
44920f1c12f251eb66552943f9be7dd1cb56f4f748789c09d05fb145854c8459633056b182127698f65a7909ae62ada9406a186ea9279b4c177cc954bc955872

Download Submit
C:\Windows\SysWOW64\bwqkfrxqeqftu.exe

Filesize
255KB

MD5
da4873e14dd28f4646a35720d9e92434

SHA1
18761b05644d95b7249d6659348a1be9602c9f34

SHA256
0bdd9ee9b181274ff9e7effd63488f5887c7f85c0afa1a9c3cb6f3d4b5d9d70f

SHA512
44920f1c12f251eb66552943f9be7dd1cb56f4f748789c09d05fb145854c8459633056b182127698f65a7909ae62ada9406a186ea9279b4c177cc954bc955872

Download Submit
C:\Windows\SysWOW64\esodfumn.exe

Filesize
255KB

MD5
d3d37d3d23712f2b6cc88f444f81bee7

SHA1
d065ddcca7b2f619ee1131c92ba66e55a601de35

SHA256
6787e82e4428af3ead0ba316fcf0e67e4072221ec935dc73dbf6133cd4f5de8b

SHA512
ab651821dbd7b0d48c25b0f80361d7449f9a9aff0e4254a295155977bb3035a55045eca4edbf6230b1734d19ec074c8771b74e3915596e210231c3431cb61f59

Download Submit
C:\Windows\SysWOW64\esodfumn.exe

Filesize
255KB

MD5
d3d37d3d23712f2b6cc88f444f81bee7

SHA1
d065ddcca7b2f619ee1131c92ba66e55a601de35

SHA256
6787e82e4428af3ead0ba316fcf0e67e4072221ec935dc73dbf6133cd4f5de8b

SHA512
ab651821dbd7b0d48c25b0f80361d7449f9a9aff0e4254a295155977bb3035a55045eca4edbf6230b1734d19ec074c8771b74e3915596e210231c3431cb61f59

Download Submit
C:\Windows\SysWOW64\esodfumn.exe

Filesize
255KB

MD5
d3d37d3d23712f2b6cc88f444f81bee7

SHA1
d065ddcca7b2f619ee1131c92ba66e55a601de35

SHA256
6787e82e4428af3ead0ba316fcf0e67e4072221ec935dc73dbf6133cd4f5de8b

SHA512
ab651821dbd7b0d48c25b0f80361d7449f9a9aff0e4254a295155977bb3035a55045eca4edbf6230b1734d19ec074c8771b74e3915596e210231c3431cb61f59

Download Submit
C:\Windows\SysWOW64\mobcjzhsen.exe

Filesize
255KB

MD5
df9c36fe6a7ab911ea1bacecfe1777e3

SHA1
0b780dfffe6024491814f38e4bc98f921432e537

SHA256
87d96948e0d3fe989b021ed46d9e5b509a381ceb266ca1bbdead65d1a179efb3

SHA512
029346f2b539e9a5a77c8bb6f9d59f436d22756f5201a66c4ac4e0688ef1cdc746546a682e6f348747abd9a71e7fbb6cfd761f3ca2c6465044825a456c83872e

Download Submit
C:\Windows\SysWOW64\mobcjzhsen.exe

Filesize
255KB

MD5
df9c36fe6a7ab911ea1bacecfe1777e3

SHA1
0b780dfffe6024491814f38e4bc98f921432e537

SHA256
87d96948e0d3fe989b021ed46d9e5b509a381ceb266ca1bbdead65d1a179efb3

SHA512
029346f2b539e9a5a77c8bb6f9d59f436d22756f5201a66c4ac4e0688ef1cdc746546a682e6f348747abd9a71e7fbb6cfd761f3ca2c6465044825a456c83872e

Download Submit
C:\Windows\SysWOW64\skdhmblhrplieuw.exe

Filesize
255KB

MD5
ad522ed93c111b55236bcd0adaa146ca

SHA1
ea865bcf4b786a9b96ce1929c20b241dc60bb325

SHA256
01547104137987563df23a384eb1a7410cb5870ff06e4f58dcad726c43c6b337

SHA512
adc578604823a4c2c7f0aac6a2d996a97f48640d5ae930dc421c08219ff5f7cef5b41a3d268341771709d89eeeb301b1c442aa57f2a747b5f898059206d06767

Download Submit
C:\Windows\SysWOW64\skdhmblhrplieuw.exe

Filesize
255KB

MD5
ad522ed93c111b55236bcd0adaa146ca

SHA1
ea865bcf4b786a9b96ce1929c20b241dc60bb325

SHA256
01547104137987563df23a384eb1a7410cb5870ff06e4f58dcad726c43c6b337

SHA512
adc578604823a4c2c7f0aac6a2d996a97f48640d5ae930dc421c08219ff5f7cef5b41a3d268341771709d89eeeb301b1c442aa57f2a747b5f898059206d06767

Download Submit
memory/852-156-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/852-152-0x0000000000000000-mapping.dmp

Download
memory/852-154-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1388-149-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1388-151-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1388-144-0x0000000000000000-mapping.dmp

Download
memory/3592-137-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/3592-134-0x0000000000000000-mapping.dmp

Download
memory/4072-157-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4072-132-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4072-133-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4424-155-0x0000000000000000-mapping.dmp

Download
memory/4564-148-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4564-141-0x0000000000000000-mapping.dmp

Download
memory/4936-138-0x0000000000000000-mapping.dmp

Download
memory/4936-150-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4936-147-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download