44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7

General

Target

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Size

252KB
MD5

3658efb3751becc47a57ef543a3d80b0
SHA1

41af972ef1392ab78c8ec855ee73d7465601a31a
SHA256

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7
SHA512

dcc9ee4c7abf780001f3310163480d5fcdd0bc57ca0301651fddd52f5143e554702c3cb739a15bfeda009328174b67514ded0e555c6e036e38d5c07bf58c822e
SSDEEP

3072:grAcHx7LaXusNvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKtjby:grCuCx/ZLA4PmG6de

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exexueruu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	xueruu.exe

Executes dropped EXE 1 IoCs

Processes:

xueruu.exe

pid process

1456 xueruu.exe

pid	process
1456	xueruu.exe

Loads dropped DLL 2 IoCs

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

pid	process
560	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
560	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

xueruu.exe44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /R"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /v"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /Q"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /W"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /s"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /p"	xueruu.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /s"	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /j"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /F"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /I"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /M"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /l"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /N"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /q"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /J"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /g"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /o"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /n"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /X"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /e"	xueruu.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /L"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /D"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /G"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /P"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /a"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /t"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /T"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /r"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /H"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /b"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /Z"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /Y"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /z"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /O"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /k"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /U"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /f"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /V"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /i"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /E"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /w"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /C"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /h"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /m"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /B"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /S"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /K"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /y"	xueruu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\xueruu = "C:\\Users\\Admin\\xueruu.exe /x"	xueruu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exexueruu.exe

pid	process
560	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe
1456	xueruu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exexueruu.exe

pid process

560 44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
1456 xueruu.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe

description	pid	process	target process
PID 560 wrote to memory of 1456	560	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe	xueruu.exe
PID 560 wrote to memory of 1456	560	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe	xueruu.exe
PID 560 wrote to memory of 1456	560	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe	xueruu.exe
PID 560 wrote to memory of 1456	560	44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe	xueruu.exe

C:\Users\Admin\AppData\Local\Temp\44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe
"C:\Users\Admin\AppData\Local\Temp\44fb7c7bf17a578aecd2cedcd19909ff1430f0dfde901e64389972291bd2b7d7.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560

C:\Users\Admin\xueruu.exe
"C:\Users\Admin\xueruu.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\xueruu.exe

Filesize
252KB

MD5
adccc28fae018a82d91765dd8e6c6e3a

SHA1
31caf39145a09b0a490141066ad9792c7adc3d7c

SHA256
7ec360428bb578db4f3f189b8900eb309e378f5a09ac9641c8b6471bafc84009

SHA512
33bbfbdc18912d4acf7c26cb5cd4ec4a5e69baa70fcb5a8a806ed32aeb95a138490540a1db268d764b64655603b5a0d4aea346f09c415752662fc6cdc87b73eb

Download Submit
C:\Users\Admin\xueruu.exe

Filesize
252KB

MD5
adccc28fae018a82d91765dd8e6c6e3a

SHA1
31caf39145a09b0a490141066ad9792c7adc3d7c

SHA256
7ec360428bb578db4f3f189b8900eb309e378f5a09ac9641c8b6471bafc84009

SHA512
33bbfbdc18912d4acf7c26cb5cd4ec4a5e69baa70fcb5a8a806ed32aeb95a138490540a1db268d764b64655603b5a0d4aea346f09c415752662fc6cdc87b73eb

Download Submit
\Users\Admin\xueruu.exe

Filesize
252KB

MD5
adccc28fae018a82d91765dd8e6c6e3a

SHA1
31caf39145a09b0a490141066ad9792c7adc3d7c

SHA256
7ec360428bb578db4f3f189b8900eb309e378f5a09ac9641c8b6471bafc84009

SHA512
33bbfbdc18912d4acf7c26cb5cd4ec4a5e69baa70fcb5a8a806ed32aeb95a138490540a1db268d764b64655603b5a0d4aea346f09c415752662fc6cdc87b73eb

Download Submit
\Users\Admin\xueruu.exe

Filesize
252KB

MD5
adccc28fae018a82d91765dd8e6c6e3a

SHA1
31caf39145a09b0a490141066ad9792c7adc3d7c

SHA256
7ec360428bb578db4f3f189b8900eb309e378f5a09ac9641c8b6471bafc84009

SHA512
33bbfbdc18912d4acf7c26cb5cd4ec4a5e69baa70fcb5a8a806ed32aeb95a138490540a1db268d764b64655603b5a0d4aea346f09c415752662fc6cdc87b73eb

Download Submit
memory/560-56-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/1456-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads