4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0

Analysis

max time kernel
151s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 00:06 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe
Size

260KB
MD5

349815881bc9147ffc26843be2939ff0
SHA1

785f1230a94f7bb364fa713e402aeec31582a2ff
SHA256

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0
SHA512

a111de01daa7e683f9042f46411bba9e255a7fefb3aa28e0c16aae5dd818621c537148d1ad384958d4879c600adc35457b79a4fc6f6139caefb75b276e3f1b81
SSDEEP

6144:V4HtUUp7WQn6mr1R4bKLnXejKloO6JU1J7QnpXZ7Ta9kzU2/pn:VkJp6Qn6mr1R4bKLnXaKaO6O1JAptH

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	xeoujic.exe

Executes dropped EXE 1 IoCs

pid	Process
1160	xeoujic.exe

Loads dropped DLL 2 IoCs

pid	Process
1424	4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe
1424	4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /n"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /W"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /k"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /E"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /d"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /H"	xeoujic.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /u"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /B"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /y"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /T"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /s"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /a"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /U"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /v"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /O"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /M"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /q"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /L"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /Z"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /D"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /o"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /G"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /c"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /F"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /g"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /P"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /j"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /I"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /m"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /t"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /J"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /e"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /b"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /N"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /w"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /f"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /S"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /V"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /A"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /i"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /x"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /l"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /C"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /R"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /z"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /X"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /Y"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /K"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /r"	xeoujic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeoujic = "C:\\Users\\Admin\\xeoujic.exe /h"	xeoujic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe
1160	xeoujic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1424	4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe
1160	xeoujic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1160	1424	4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe	26
PID 1424 wrote to memory of 1160	1424	4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe	26
PID 1424 wrote to memory of 1160	1424	4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe	26
PID 1424 wrote to memory of 1160	1424	4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe	26

C:\Users\Admin\AppData\Local\Temp\4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe
"C:\Users\Admin\AppData\Local\Temp\4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\xeoujic.exe
  "C:\Users\Admin\xeoujic.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1160

Network

DNS

ns1.player1532.com

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe

Remote address:

8.8.8.8:53

Request

ns1.player1532.com

IN A

Response
DNS

ns1.videoall.org

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe

Remote address:

8.8.8.8:53

Request

ns1.videoall.org

IN A

Response
DNS

ns1.videoall.net

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe

Remote address:

8.8.8.8:53

Request

ns1.videoall.net

IN A

Response

No results found

8.8.8.8:53

ns1.player1532.com

dns

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe

64 B
137 B
1
1

DNS Request

ns1.player1532.com
8.8.8.8:53

ns1.videoall.org

dns

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe

62 B
144 B
1
1

DNS Request

ns1.videoall.org
8.8.8.8:53

ns1.videoall.net

dns

4c0a3da7191ac24df28654d79ce018510ac7cba1d4137daabdea7eba01c5d5f0.exe

62 B
135 B
1
1

DNS Request

ns1.videoall.net

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\xeoujic.exe

Filesize
260KB

MD5
651516dd2f87004c736ac74768a89b4c

SHA1
197d7bfcd74939460b08d0154d4ff4a0606bc6b6

SHA256
a6391f1772cf5ba96cb906339710480462d448a9da0c34bdab2feb2386841646

SHA512
35f2b4d8b8ad7bedb1d9050578ee7c3da26e62753941f1d592d63c8c1ba720ddcd540907a58a888f07fd74618c51afa6960d3ea8ab4898cf3bd574b28fdcd79b

Download Submit
C:\Users\Admin\xeoujic.exe

Filesize
260KB

MD5
651516dd2f87004c736ac74768a89b4c

SHA1
197d7bfcd74939460b08d0154d4ff4a0606bc6b6

SHA256
a6391f1772cf5ba96cb906339710480462d448a9da0c34bdab2feb2386841646

SHA512
35f2b4d8b8ad7bedb1d9050578ee7c3da26e62753941f1d592d63c8c1ba720ddcd540907a58a888f07fd74618c51afa6960d3ea8ab4898cf3bd574b28fdcd79b

Download Submit
\Users\Admin\xeoujic.exe

Filesize
260KB

MD5
651516dd2f87004c736ac74768a89b4c

SHA1
197d7bfcd74939460b08d0154d4ff4a0606bc6b6

SHA256
a6391f1772cf5ba96cb906339710480462d448a9da0c34bdab2feb2386841646

SHA512
35f2b4d8b8ad7bedb1d9050578ee7c3da26e62753941f1d592d63c8c1ba720ddcd540907a58a888f07fd74618c51afa6960d3ea8ab4898cf3bd574b28fdcd79b

Download Submit
\Users\Admin\xeoujic.exe

Filesize
260KB

MD5
651516dd2f87004c736ac74768a89b4c

SHA1
197d7bfcd74939460b08d0154d4ff4a0606bc6b6

SHA256
a6391f1772cf5ba96cb906339710480462d448a9da0c34bdab2feb2386841646

SHA512
35f2b4d8b8ad7bedb1d9050578ee7c3da26e62753941f1d592d63c8c1ba720ddcd540907a58a888f07fd74618c51afa6960d3ea8ab4898cf3bd574b28fdcd79b

Download Submit
memory/1424-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.