c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03

General

Target

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Size

192KB
MD5

434e2a39f41f81234fc0dac306281235
SHA1

0ecca3085bad96894cf95d27bfd532e98d98cd07
SHA256

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03
SHA512

ca78a7dedacd8c41452ce416ac2cb73479cae5a39892d4c3970cdd3278d8618cbf7f4b06ae7007dac4c51fbe461db93a53a62660a81f1540772329c3700b8e44
SSDEEP

3072:6wBJ2pHh+RH5UL1iUG3KgKLKRKSdNIVqR5VxerayK/fObT/bGicFgvXb6jGJBXX:6wBJKHcRZSgKgKLKRKSdNIVqRTxEpK/u

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exentxul.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ntxul.exe

Executes dropped EXE 1 IoCs

Processes:

ntxul.exe

pid process

560 ntxul.exe

pid	process
560	ntxul.exe

Loads dropped DLL 2 IoCs

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

pid	process
1980	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
1980	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ntxul.exec0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /C"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /q"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /P"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /r"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /X"	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /u"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /f"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /k"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /c"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /z"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /X"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /j"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /U"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /e"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /m"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /s"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /Z"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /F"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /J"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /R"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /B"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /h"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /Y"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /n"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /p"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /D"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /w"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /i"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /V"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /l"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /a"	ntxul.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /K"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /b"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /E"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /N"	ntxul.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /d"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /x"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /o"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /L"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /O"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /S"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /y"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /G"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /T"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /I"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /t"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /Q"	ntxul.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntxul = "C:\\Users\\Admin\\ntxul.exe /A"	ntxul.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exentxul.exe

pid	process
1980	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe
560	ntxul.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exentxul.exe

pid process

1980 c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
560 ntxul.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe

description	pid	process	target process
PID 1980 wrote to memory of 560	1980	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe	ntxul.exe
PID 1980 wrote to memory of 560	1980	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe	ntxul.exe
PID 1980 wrote to memory of 560	1980	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe	ntxul.exe
PID 1980 wrote to memory of 560	1980	c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe	ntxul.exe

C:\Users\Admin\AppData\Local\Temp\c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe
"C:\Users\Admin\AppData\Local\Temp\c0a7b3d4fce6856e1c8f0361119cf0a8fb68739afcbb5dad2a5007124a2b1e03.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980

C:\Users\Admin\ntxul.exe
"C:\Users\Admin\ntxul.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\ntxul.exe

Filesize
192KB

MD5
6b26dc3df7ab662086d20dd9e03e0637

SHA1
c545676896d5b8f4a7179d4637d0601147da0304

SHA256
0d6a9a48bf8f8b1a02240f47543871be11cd2ef08d66a25d13a2b07d3afc2c19

SHA512
d1364ce536c7b6152ad6047919e15e94a0f64b76af0f18a53fa0b4b7d3cf9a4e0cfeccb593582b4b6b8c9da15fa319e25f58c592d970b991c3478e06215c7541

Download Submit
C:\Users\Admin\ntxul.exe

Filesize
192KB

MD5
6b26dc3df7ab662086d20dd9e03e0637

SHA1
c545676896d5b8f4a7179d4637d0601147da0304

SHA256
0d6a9a48bf8f8b1a02240f47543871be11cd2ef08d66a25d13a2b07d3afc2c19

SHA512
d1364ce536c7b6152ad6047919e15e94a0f64b76af0f18a53fa0b4b7d3cf9a4e0cfeccb593582b4b6b8c9da15fa319e25f58c592d970b991c3478e06215c7541

Download Submit
\Users\Admin\ntxul.exe

Filesize
192KB

MD5
6b26dc3df7ab662086d20dd9e03e0637

SHA1
c545676896d5b8f4a7179d4637d0601147da0304

SHA256
0d6a9a48bf8f8b1a02240f47543871be11cd2ef08d66a25d13a2b07d3afc2c19

SHA512
d1364ce536c7b6152ad6047919e15e94a0f64b76af0f18a53fa0b4b7d3cf9a4e0cfeccb593582b4b6b8c9da15fa319e25f58c592d970b991c3478e06215c7541

Download Submit
\Users\Admin\ntxul.exe

Filesize
192KB

MD5
6b26dc3df7ab662086d20dd9e03e0637

SHA1
c545676896d5b8f4a7179d4637d0601147da0304

SHA256
0d6a9a48bf8f8b1a02240f47543871be11cd2ef08d66a25d13a2b07d3afc2c19

SHA512
d1364ce536c7b6152ad6047919e15e94a0f64b76af0f18a53fa0b4b7d3cf9a4e0cfeccb593582b4b6b8c9da15fa319e25f58c592d970b991c3478e06215c7541

Download Submit
memory/560-59-0x0000000000000000-mapping.dmp

Download
memory/1980-56-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads