Analysis
-
max time kernel
170s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:19
Static task
static1
Behavioral task
behavioral1
Sample
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe
Resource
win10v2004-20221111-en
General
-
Target
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe
-
Size
296KB
-
MD5
353155b807cc4d8450a45b3882a6ac9e
-
SHA1
1d48c05bedc48d3959ca5781d06ec60408c0449d
-
SHA256
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7
-
SHA512
cc3cdaa1160ed4aeb5b40ed00a4998aabaa91c1e9a6dce3a5b668d25f3b584d13ca9139937b4c72434c4bcd988990bbbddfb928f33952fdbf8fa5f9a75cf6630
-
SSDEEP
6144:ykpD1y0FXrKnvmb7/D26OJYPsMiqDJlJNwHG6s20EBb4jHX3QA/hwNGhWhThPvMz:yaD1y0F7Knvmb7/D265DJlJNwHG6JTbk
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exexoeige.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoeige.exe -
Executes dropped EXE 1 IoCs
Processes:
xoeige.exepid process 4296 xoeige.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe -
Adds Run key to start application 2 TTPs 53 IoCs
Processes:
xoeige.exe0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /M" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /s" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /w" xoeige.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /Z" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /I" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /A" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /r" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /Y" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /j" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /Q" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /x" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /b" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /R" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /K" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /U" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /T" xoeige.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /C" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /q" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /E" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /J" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /v" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /i" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /k" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /N" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /n" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /g" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /X" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /m" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /u" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /o" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /O" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /y" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /S" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /D" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /z" 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /e" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /p" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /t" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /B" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /P" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /d" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /L" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /a" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /l" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /f" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /V" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /W" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /G" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /H" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /z" xoeige.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeige = "C:\\Users\\Admin\\xoeige.exe /h" xoeige.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exexoeige.exepid process 1840 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe 1840 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe 4296 xoeige.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exexoeige.exepid process 1840 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe 4296 xoeige.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exedescription pid process target process PID 1840 wrote to memory of 4296 1840 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe xoeige.exe PID 1840 wrote to memory of 4296 1840 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe xoeige.exe PID 1840 wrote to memory of 4296 1840 0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe xoeige.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe"C:\Users\Admin\AppData\Local\Temp\0b257679291dd09d99e67095e17cbe2e204157d482435c213278397e42bf7ba7.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\xoeige.exe"C:\Users\Admin\xoeige.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\xoeige.exeFilesize
296KB
MD56af100e6a7bf2e84af62808a96621d57
SHA1d4743431143117fa4596eccd902601167c93e208
SHA25656ac9437b3d59143df84bd60213110539630849b20f7bde56478b67f345fe86d
SHA512496b96a52862733ecdeffce89d9093905c870e3ae2e57ac7d75798ab72ba858d689a9fe135c4c7cfd39598132732b69f42ecb2dcc129d13bbec3c0d7c11a2126
-
C:\Users\Admin\xoeige.exeFilesize
296KB
MD56af100e6a7bf2e84af62808a96621d57
SHA1d4743431143117fa4596eccd902601167c93e208
SHA25656ac9437b3d59143df84bd60213110539630849b20f7bde56478b67f345fe86d
SHA512496b96a52862733ecdeffce89d9093905c870e3ae2e57ac7d75798ab72ba858d689a9fe135c4c7cfd39598132732b69f42ecb2dcc129d13bbec3c0d7c11a2126
-
memory/4296-134-0x0000000000000000-mapping.dmp