be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e

General

Target

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Size

184KB
MD5

15c27df8a2cbf7b65abbe7ec90a81d77
SHA1

908273bcc612135525a4fd7ca8f17fedfd2d3c96
SHA256

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e
SHA512

a0becae2a13f3a6bce4e1f72d2f2fd4e49588aeaf3a2831ee38263034ebbab172c2df08ade0ed1df0abc5feefbc347961e8d7f52450279d9d1480643ca3d4879
SSDEEP

3072:7K1cfl/BTyzcM+Knvmb7/D263i4qMbBQhAKIWOD2r1oX1/hcNcfAUane4RzsUZSq:kClpTFzKnvmb7/D26y4qMSyKbOD2r1oy

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exesueepi.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	sueepi.exe

Executes dropped EXE 1 IoCs

Processes:

sueepi.exe

pid process

868 sueepi.exe

pid	process
868	sueepi.exe

Loads dropped DLL 2 IoCs

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

pid	process
952	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
952	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

Adds Run key to start application 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sueepi.exebe6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /G"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /L"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /h"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /g"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /j"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /r"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /d"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /N"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /C"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /v"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /R"	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /H"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /U"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /c"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /V"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /R"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /f"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /F"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /y"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /x"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /A"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /K"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /b"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /T"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /S"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /a"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /m"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /k"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /l"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /q"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /n"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /z"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /t"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /p"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /Z"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /u"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /M"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /B"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /E"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /D"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /P"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /X"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /e"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /s"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /Q"	sueepi.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /w"	sueepi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\sueepi = "C:\\Users\\Admin\\sueepi.exe /Y"	sueepi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exesueepi.exe

pid	process
952	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe
868	sueepi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exesueepi.exe

pid process

952 be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
868 sueepi.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

description	pid	process	target process
PID 952 wrote to memory of 868	952	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe	sueepi.exe
PID 952 wrote to memory of 868	952	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe	sueepi.exe
PID 952 wrote to memory of 868	952	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe	sueepi.exe
PID 952 wrote to memory of 868	952	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe	sueepi.exe

C:\Users\Admin\AppData\Local\Temp\be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
"C:\Users\Admin\AppData\Local\Temp\be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\sueepi.exe
"C:\Users\Admin\sueepi.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sueepi.exe

Filesize
184KB

MD5
570257349fb613f9915371361f717108

SHA1
bc1a5d8a542487950d20965dfafd0cca4424f149

SHA256
5d0614b7948da52b950c243fddae871b5a69abbf18da9a6fb5c5d4be5d3c09f4

SHA512
ddff440937d9a98449c1d1972ea566cea71db6ab94190aca46958bb2856f11b4bf7178a9a24c9a91d0b22ad37708b353a3d36689e0786bfd60e3c27477d92044

Download Submit
C:\Users\Admin\sueepi.exe

Filesize
184KB

MD5
570257349fb613f9915371361f717108

SHA1
bc1a5d8a542487950d20965dfafd0cca4424f149

SHA256
5d0614b7948da52b950c243fddae871b5a69abbf18da9a6fb5c5d4be5d3c09f4

SHA512
ddff440937d9a98449c1d1972ea566cea71db6ab94190aca46958bb2856f11b4bf7178a9a24c9a91d0b22ad37708b353a3d36689e0786bfd60e3c27477d92044

Download Submit
\Users\Admin\sueepi.exe

Filesize
184KB

MD5
570257349fb613f9915371361f717108

SHA1
bc1a5d8a542487950d20965dfafd0cca4424f149

SHA256
5d0614b7948da52b950c243fddae871b5a69abbf18da9a6fb5c5d4be5d3c09f4

SHA512
ddff440937d9a98449c1d1972ea566cea71db6ab94190aca46958bb2856f11b4bf7178a9a24c9a91d0b22ad37708b353a3d36689e0786bfd60e3c27477d92044

Download Submit
\Users\Admin\sueepi.exe

Filesize
184KB

MD5
570257349fb613f9915371361f717108

SHA1
bc1a5d8a542487950d20965dfafd0cca4424f149

SHA256
5d0614b7948da52b950c243fddae871b5a69abbf18da9a6fb5c5d4be5d3c09f4

SHA512
ddff440937d9a98449c1d1972ea566cea71db6ab94190aca46958bb2856f11b4bf7178a9a24c9a91d0b22ad37708b353a3d36689e0786bfd60e3c27477d92044

Download Submit
memory/868-59-0x0000000000000000-mapping.dmp

Download
memory/952-56-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads