1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9

General

Target

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Size

252KB
MD5

29b3352042d3cbf20bcb23361f771930
SHA1

fc8621ea3dffded92acf59165efb17a72f37735d
SHA256

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9
SHA512

c766b93ec62bf5a44609330f165bf631a76469b3b7a3b3b4efbce600d61b91fd4f96535d8a141afe30924ee0e48a2512eb8a4b3c7e074c3ac4ad07ad03093d3e
SSDEEP

6144:8X7CGWUsbNZeoq6AvFPpWlyfeWgdx1XxcNoX+poNd8m3RZWuAzgGk:8RWUsbbeoq6AFpWlyfeWgdx1Xxq4+pob

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exefoeli.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	foeli.exe

Executes dropped EXE 1 IoCs

Processes:

foeli.exe

pid process

3960 foeli.exe

pid	process
3960	foeli.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

Adds Run key to start application 2 TTPs 55 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

foeli.exe1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run\	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /U"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /W"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /o"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /Z"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /d"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /n"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /M"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /Q"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /G"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /X"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /j"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /K"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /F"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /O"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /s"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /E"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /y"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /k"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /c"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /u"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /q"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /f"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /w"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /r"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /C"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /T"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /i"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /b"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /t"	foeli.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run\	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /l"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /S"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /D"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /B"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /m"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /A"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /g"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /P"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /V"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /v"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /R"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /x"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /J"	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /L"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /J"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /H"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /I"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /p"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /e"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /h"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /z"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /Y"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /N"	foeli.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foeli = "C:\\Users\\Admin\\foeli.exe /a"	foeli.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exefoeli.exe

pid	process
1820	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
1820	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe
3960	foeli.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exefoeli.exe

pid process

1820 1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
3960 foeli.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe

description	pid	process	target process
PID 1820 wrote to memory of 3960	1820	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe	foeli.exe
PID 1820 wrote to memory of 3960	1820	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe	foeli.exe
PID 1820 wrote to memory of 3960	1820	1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe	foeli.exe

C:\Users\Admin\AppData\Local\Temp\1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe
"C:\Users\Admin\AppData\Local\Temp\1323b7f77059e5c17adfac00b27218e100442c588f89c3b6b47178ddb38ee9c9.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\foeli.exe
  "C:\Users\Admin\foeli.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\foeli.exe

Filesize
252KB

MD5
02e873c5661788cf0db6c724037c2424

SHA1
108620f848021a12e9df28ce008964f8c03a2822

SHA256
8c7dbc37ce60a6c4ef3e4e7553bf8396acf72b3c55223284bc013bed1e82707e

SHA512
7ef4489ebfa47d8e7238232f6cd10901d89746ba1243e0f2523b17d57d07ad13d24660a6951520b1e103a3333efd4eef327f595372919cd3d3309ef08ea7a8b7

Download Submit
C:\Users\Admin\foeli.exe

Filesize
252KB

MD5
02e873c5661788cf0db6c724037c2424

SHA1
108620f848021a12e9df28ce008964f8c03a2822

SHA256
8c7dbc37ce60a6c4ef3e4e7553bf8396acf72b3c55223284bc013bed1e82707e

SHA512
7ef4489ebfa47d8e7238232f6cd10901d89746ba1243e0f2523b17d57d07ad13d24660a6951520b1e103a3333efd4eef327f595372919cd3d3309ef08ea7a8b7

Download Submit
memory/3960-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads