52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688

General

Target

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
Size

240KB
MD5

34e01d581c9569bb2d7b44b8e6e65770
SHA1

4ede2c34b01ea01b74bbbbb93d326f1f7cd50720
SHA256

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688
SHA512

972c5be5f9f776295e77c2f2575fbcb58dc30cd1d9709177639c3e7eea1ba1354d2a03b6a759f6fa7874bcf7bd39da49983bde0067165c24d4fb44c2ef999043
SSDEEP

3072:kG5UnRW+zbfMjS2BXeWBFcAfqTEBRjefrfRLfN561PHuh0x2YW6:kSaFD2peScAfA0jCfr567J

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exeliotit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	liotit.exe

Executes dropped EXE 1 IoCs

Processes:

liotit.exe

pid process

1204 liotit.exe

pid	process
1204	liotit.exe

Loads dropped DLL 2 IoCs

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

pid	process
1424	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
1424	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

liotit.exe52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /x"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /k"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /w"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /y"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /e"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /b"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /g"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /a"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /p"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /i"	liotit.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /q"	liotit.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /o"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /r"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /n"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /d"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /z"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /v"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /h"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /c"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /o"	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /s"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /m"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /l"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /u"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /t"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /j"	liotit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\liotit = "C:\\Users\\Admin\\liotit.exe /f"	liotit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exeliotit.exe

pid	process
1424	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe
1204	liotit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exeliotit.exe

pid process

1424 52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
1204 liotit.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

description	pid	process	target process
PID 1424 wrote to memory of 1204	1424	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe	liotit.exe
PID 1424 wrote to memory of 1204	1424	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe	liotit.exe
PID 1424 wrote to memory of 1204	1424	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe	liotit.exe
PID 1424 wrote to memory of 1204	1424	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe	liotit.exe

C:\Users\Admin\AppData\Local\Temp\52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
"C:\Users\Admin\AppData\Local\Temp\52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424

C:\Users\Admin\liotit.exe
"C:\Users\Admin\liotit.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\liotit.exe
Filesize
240KB

MD5
168797124678928602374d7d1eae85ac

SHA1
58890e82d44420deb7554fef95c332c93ed66b54

SHA256
63aa1d0ad82b2dacfe87bc13a7dafe713140e2ec4ed066f5221fbc5abef16cd9

SHA512
fa12a285d139b672ea1aa8ec0c6f9cc620e1588a639056056ecedb09dbde9a7a86d64c6bf3aea2e19f05c0c4303569f1297fb7d62c2b5ad5a868ec2028652549

Download Submit
C:\Users\Admin\liotit.exe
Filesize
240KB

MD5
168797124678928602374d7d1eae85ac

SHA1
58890e82d44420deb7554fef95c332c93ed66b54

SHA256
63aa1d0ad82b2dacfe87bc13a7dafe713140e2ec4ed066f5221fbc5abef16cd9

SHA512
fa12a285d139b672ea1aa8ec0c6f9cc620e1588a639056056ecedb09dbde9a7a86d64c6bf3aea2e19f05c0c4303569f1297fb7d62c2b5ad5a868ec2028652549

Download Submit
\Users\Admin\liotit.exe
Filesize
240KB

MD5
168797124678928602374d7d1eae85ac

SHA1
58890e82d44420deb7554fef95c332c93ed66b54

SHA256
63aa1d0ad82b2dacfe87bc13a7dafe713140e2ec4ed066f5221fbc5abef16cd9

SHA512
fa12a285d139b672ea1aa8ec0c6f9cc620e1588a639056056ecedb09dbde9a7a86d64c6bf3aea2e19f05c0c4303569f1297fb7d62c2b5ad5a868ec2028652549

Download Submit
\Users\Admin\liotit.exe
Filesize
240KB

MD5
168797124678928602374d7d1eae85ac

SHA1
58890e82d44420deb7554fef95c332c93ed66b54

SHA256
63aa1d0ad82b2dacfe87bc13a7dafe713140e2ec4ed066f5221fbc5abef16cd9

SHA512
fa12a285d139b672ea1aa8ec0c6f9cc620e1588a639056056ecedb09dbde9a7a86d64c6bf3aea2e19f05c0c4303569f1297fb7d62c2b5ad5a868ec2028652549

Download Submit
memory/1204-59-0x0000000000000000-mapping.dmp

Download
memory/1424-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads