e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809

General

Target

e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe
Size

224KB
MD5

162df08bc5502d0a9cc27255cdd31470
SHA1

54e8c37a862e595d4822a6c11c8565a04e5aa718
SHA256

e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809
SHA512

700a45da72cbfb200122be7e66f965b16753bbd07eae61da3a48007680f55debd2f37373eb1aace78da4ed4590693482ac364887a70cd67a8528f187414b10c4
SSDEEP

3072:zXyqNsMoBuVjCZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbaxb:2qN5VjKp4LnbmlrZW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

dauca.exee63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dauca.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe

Executes dropped EXE 1 IoCs

Processes:

dauca.exe

pid process

1908 dauca.exe

pid	process
1908	dauca.exe

Loads dropped DLL 2 IoCs

Processes:

e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe

pid	process
1228	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe
1228	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exedauca.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /z"	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /u"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /d"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /p"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /s"	dauca.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /b"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /a"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /v"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /o"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /z"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /i"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /f"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /y"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /n"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /w"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /c"	dauca.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /e"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /t"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /x"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /r"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /q"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /h"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /g"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /m"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /l"	dauca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dauca = "C:\\Users\\Admin\\dauca.exe /k"	dauca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exedauca.exe

pid	process
1228	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe
1908	dauca.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exedauca.exe

pid process

1228 e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe
1908 dauca.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe

description	pid	process	target process
PID 1228 wrote to memory of 1908	1228	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe	dauca.exe
PID 1228 wrote to memory of 1908	1228	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe	dauca.exe
PID 1228 wrote to memory of 1908	1228	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe	dauca.exe
PID 1228 wrote to memory of 1908	1228	e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe	dauca.exe

C:\Users\Admin\AppData\Local\Temp\e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe
"C:\Users\Admin\AppData\Local\Temp\e63efcd2aa2fdbf5268f50baebab34e2d43491d8edfe0f7c85b46299e0246809.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\dauca.exe
"C:\Users\Admin\dauca.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\dauca.exe

Filesize
224KB

MD5
608c66ce72b5a0c9c0f87e45cc1f60a9

SHA1
cb9de289e15b01799fbc9f15f545c1c53cf74204

SHA256
c805a848a0c901df6f662f9f3954de918b41b77c90f255a326c6314604ab67dd

SHA512
90e42fe220487845d7ab8f665e048ffb6d8935e55dffabc0c47738af67cdb93d02ee9318789c20e51b365718b8b5d57a49c991744180c0fadf68d5e9384c077c

Download Submit
C:\Users\Admin\dauca.exe

Filesize
224KB

MD5
608c66ce72b5a0c9c0f87e45cc1f60a9

SHA1
cb9de289e15b01799fbc9f15f545c1c53cf74204

SHA256
c805a848a0c901df6f662f9f3954de918b41b77c90f255a326c6314604ab67dd

SHA512
90e42fe220487845d7ab8f665e048ffb6d8935e55dffabc0c47738af67cdb93d02ee9318789c20e51b365718b8b5d57a49c991744180c0fadf68d5e9384c077c

Download Submit
\Users\Admin\dauca.exe

Filesize
224KB

MD5
608c66ce72b5a0c9c0f87e45cc1f60a9

SHA1
cb9de289e15b01799fbc9f15f545c1c53cf74204

SHA256
c805a848a0c901df6f662f9f3954de918b41b77c90f255a326c6314604ab67dd

SHA512
90e42fe220487845d7ab8f665e048ffb6d8935e55dffabc0c47738af67cdb93d02ee9318789c20e51b365718b8b5d57a49c991744180c0fadf68d5e9384c077c

Download Submit
\Users\Admin\dauca.exe

Filesize
224KB

MD5
608c66ce72b5a0c9c0f87e45cc1f60a9

SHA1
cb9de289e15b01799fbc9f15f545c1c53cf74204

SHA256
c805a848a0c901df6f662f9f3954de918b41b77c90f255a326c6314604ab67dd

SHA512
90e42fe220487845d7ab8f665e048ffb6d8935e55dffabc0c47738af67cdb93d02ee9318789c20e51b365718b8b5d57a49c991744180c0fadf68d5e9384c077c

Download Submit
memory/1228-56-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1908-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads