38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a

General

Target

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
Size

320KB
MD5

273452cebea874b621804a48be0e05a0
SHA1

904e0880313cab25e09f90ebdfb4e43bd100f9aa
SHA256

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a
SHA512

c6cfe7c24da8805d3a518b1d84325e62d2cc4a1fedcb73ec9b3eaece642d8b08201121e3bf1a668b9f8d1c840923ec0e15487d1db5d21c7b332bcd89efb12830
SSDEEP

6144:mIIcFeEK/fObT/bGibErxUyF+fmYYdPMAaiSn:mIIcFeEK/fObT/bGiPo+eYYt/LSn

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exekueko.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kueko.exe

Executes dropped EXE 1 IoCs

Processes:

kueko.exe

pid process

1984 kueko.exe

pid	process
1984	kueko.exe

Loads dropped DLL 2 IoCs

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

pid	process
1128	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
1128	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

Adds Run key to start application 2 TTPs 47 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kueko.exe38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /d"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /I"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /W"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /C"	kueko.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /T"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /A"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /w"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /E"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /o"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /D"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /l"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /k"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /N"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /X"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /u"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /b"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /c"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /M"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /R"	kueko.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /x"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /g"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /h"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /n"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /Z"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /p"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /e"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /v"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /G"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /F"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /B"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /K"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /J"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /t"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /V"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /H"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /O"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /f"	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /a"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /y"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /z"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /i"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /s"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /U"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /j"	kueko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueko = "C:\\Users\\Admin\\kueko.exe /S"	kueko.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exekueko.exe

pid	process
1128	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe
1984	kueko.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exekueko.exe

pid process

1128 38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
1984 kueko.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

description	pid	process	target process
PID 1128 wrote to memory of 1984	1128	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe	kueko.exe
PID 1128 wrote to memory of 1984	1128	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe	kueko.exe
PID 1128 wrote to memory of 1984	1128	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe	kueko.exe
PID 1128 wrote to memory of 1984	1128	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe	kueko.exe

C:\Users\Admin\AppData\Local\Temp\38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
"C:\Users\Admin\AppData\Local\Temp\38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128

C:\Users\Admin\kueko.exe
"C:\Users\Admin\kueko.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\kueko.exe

Filesize
320KB

MD5
5287eb6cfbe17707a517571cf7ce1c7a

SHA1
af64f65f12ed00955c4b6b90437a9edba760cd65

SHA256
cc4a9347b34d1694e8418e4ef5d835eaa43b731459dacb1e25e206eb25c1f83c

SHA512
c0bc9baf738e895c700be2b2ff5f20402fbc0ffa4400a270d8a929faeaaac86f6ac7422fb345164ec81ac70a41ef0c1b735745a0d27f72201bae258f2dc70780

Download Submit
C:\Users\Admin\kueko.exe

Filesize
320KB

MD5
5287eb6cfbe17707a517571cf7ce1c7a

SHA1
af64f65f12ed00955c4b6b90437a9edba760cd65

SHA256
cc4a9347b34d1694e8418e4ef5d835eaa43b731459dacb1e25e206eb25c1f83c

SHA512
c0bc9baf738e895c700be2b2ff5f20402fbc0ffa4400a270d8a929faeaaac86f6ac7422fb345164ec81ac70a41ef0c1b735745a0d27f72201bae258f2dc70780

Download Submit
\Users\Admin\kueko.exe

Filesize
320KB

MD5
5287eb6cfbe17707a517571cf7ce1c7a

SHA1
af64f65f12ed00955c4b6b90437a9edba760cd65

SHA256
cc4a9347b34d1694e8418e4ef5d835eaa43b731459dacb1e25e206eb25c1f83c

SHA512
c0bc9baf738e895c700be2b2ff5f20402fbc0ffa4400a270d8a929faeaaac86f6ac7422fb345164ec81ac70a41ef0c1b735745a0d27f72201bae258f2dc70780

Download Submit
\Users\Admin\kueko.exe

Filesize
320KB

MD5
5287eb6cfbe17707a517571cf7ce1c7a

SHA1
af64f65f12ed00955c4b6b90437a9edba760cd65

SHA256
cc4a9347b34d1694e8418e4ef5d835eaa43b731459dacb1e25e206eb25c1f83c

SHA512
c0bc9baf738e895c700be2b2ff5f20402fbc0ffa4400a270d8a929faeaaac86f6ac7422fb345164ec81ac70a41ef0c1b735745a0d27f72201bae258f2dc70780

Download Submit
memory/1128-56-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1128-58-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1128-57-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1128-66-0x0000000002C80000-0x0000000002CD6000-memory.dmp

Filesize
344KB

Download
memory/1128-67-0x0000000002C80000-0x0000000002CD6000-memory.dmp

Filesize
344KB

Download
memory/1128-70-0x0000000002C80000-0x0000000002CD6000-memory.dmp

Filesize
344KB

Download
memory/1984-61-0x0000000000000000-mapping.dmp

Download
memory/1984-68-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1984-71-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads