be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e

General

Target

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Size

184KB
MD5

15c27df8a2cbf7b65abbe7ec90a81d77
SHA1

908273bcc612135525a4fd7ca8f17fedfd2d3c96
SHA256

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e
SHA512

a0becae2a13f3a6bce4e1f72d2f2fd4e49588aeaf3a2831ee38263034ebbab172c2df08ade0ed1df0abc5feefbc347961e8d7f52450279d9d1480643ca3d4879
SSDEEP

3072:7K1cfl/BTyzcM+Knvmb7/D263i4qMbBQhAKIWOD2r1oX1/hcNcfAUane4RzsUZSq:kClpTFzKnvmb7/D26y4qMSyKbOD2r1oy

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exebioahu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bioahu.exe

Executes dropped EXE 1 IoCs

Processes:

bioahu.exe

pid process

3856 bioahu.exe

pid	process
3856	bioahu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

Adds Run key to start application 2 TTPs 37 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bioahu.exebe6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /B"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /Y"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /B"	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /L"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /i"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /A"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /C"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /c"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /q"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /T"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /R"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /J"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /F"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /u"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /W"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /w"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /s"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /x"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /H"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /j"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /G"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /d"	bioahu.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /P"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /m"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /V"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /t"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /a"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /p"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /U"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /g"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /y"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /b"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /I"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /Z"	bioahu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bioahu = "C:\\Users\\Admin\\bioahu.exe /X"	bioahu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exebioahu.exe

pid	process
2708	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
2708	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe
3856	bioahu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exebioahu.exe

pid process

2708 be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
3856 bioahu.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe

description	pid	process	target process
PID 2708 wrote to memory of 3856	2708	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe	bioahu.exe
PID 2708 wrote to memory of 3856	2708	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe	bioahu.exe
PID 2708 wrote to memory of 3856	2708	be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe	bioahu.exe

C:\Users\Admin\AppData\Local\Temp\be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe
"C:\Users\Admin\AppData\Local\Temp\be6115bebb74a041f68e1837da48e491c7a1c8564c1d64655f178063ae5aeb5e.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708

C:\Users\Admin\bioahu.exe
"C:\Users\Admin\bioahu.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\bioahu.exe

Filesize
184KB

MD5
faf85a7137b7914e852a0a69043a7374

SHA1
c7d918e17a4af07097c8c15dde0855657451463d

SHA256
6c54fe4c95b5d4f83f74fa6da0ab68300b2e3ac18b8ff85abb953cd7f913a409

SHA512
a47f6d9c391b5fc6ff3e47ee7f8b322150aadf8c573069bd7ad8a825fbaaa6b626e54f55cd4bb283ee4998090b5097d6559aece8b038345b65183a1277a8561d

Download Submit
C:\Users\Admin\bioahu.exe

Filesize
184KB

MD5
faf85a7137b7914e852a0a69043a7374

SHA1
c7d918e17a4af07097c8c15dde0855657451463d

SHA256
6c54fe4c95b5d4f83f74fa6da0ab68300b2e3ac18b8ff85abb953cd7f913a409

SHA512
a47f6d9c391b5fc6ff3e47ee7f8b322150aadf8c573069bd7ad8a825fbaaa6b626e54f55cd4bb283ee4998090b5097d6559aece8b038345b65183a1277a8561d

Download Submit
memory/3856-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads