52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688

General

Target

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
Size

240KB
MD5

34e01d581c9569bb2d7b44b8e6e65770
SHA1

4ede2c34b01ea01b74bbbbb93d326f1f7cd50720
SHA256

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688
SHA512

972c5be5f9f776295e77c2f2575fbcb58dc30cd1d9709177639c3e7eea1ba1354d2a03b6a759f6fa7874bcf7bd39da49983bde0067165c24d4fb44c2ef999043
SSDEEP

3072:kG5UnRW+zbfMjS2BXeWBFcAfqTEBRjefrfRLfN561PHuh0x2YW6:kSaFD2peScAfA0jCfr567J

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

qoeuri.exe52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qoeuri.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

Executes dropped EXE 1 IoCs

Processes:

qoeuri.exe

pid process

1332 qoeuri.exe

pid	process
1332	qoeuri.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

qoeuri.exe52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /v"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /c"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /d"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /o"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /k"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /t"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /e"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /i"	qoeuri.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /u"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /s"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /w"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /x"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /q"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /p"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /m"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /g"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /l"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /r"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /y"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /a"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /x"	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /h"	qoeuri.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /f"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /z"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /n"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /j"	qoeuri.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeuri = "C:\\Users\\Admin\\qoeuri.exe /b"	qoeuri.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exeqoeuri.exe

pid	process
3704	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
3704	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe
1332	qoeuri.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exeqoeuri.exe

pid process

3704 52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
1332 qoeuri.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe

description	pid	process	target process
PID 3704 wrote to memory of 1332	3704	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe	qoeuri.exe
PID 3704 wrote to memory of 1332	3704	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe	qoeuri.exe
PID 3704 wrote to memory of 1332	3704	52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe	qoeuri.exe

C:\Users\Admin\AppData\Local\Temp\52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe
"C:\Users\Admin\AppData\Local\Temp\52a6d88eb089fe91b6ba0ae0e7f408ee2c9784dd5688b6630adf34e7cf63a688.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704

C:\Users\Admin\qoeuri.exe
"C:\Users\Admin\qoeuri.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\qoeuri.exe

Filesize
240KB

MD5
d447b15305ed5032e26e26c564f86d63

SHA1
880ae8dc8af4de5f7193cc33a66cc207a2e66bdd

SHA256
e9094612a5b79bc31b02f5a7053bba78f2056d7838fccaca5336014d8c5ada70

SHA512
9c7ce583c15318c15569b255e35b69a8d5b50cb69966bf6ebb8a7af789278bcd7b46e863905963239444be3d896bf541c54f1529dde01e0085ce3ffc9b37369a

Download Submit
C:\Users\Admin\qoeuri.exe

Filesize
240KB

MD5
d447b15305ed5032e26e26c564f86d63

SHA1
880ae8dc8af4de5f7193cc33a66cc207a2e66bdd

SHA256
e9094612a5b79bc31b02f5a7053bba78f2056d7838fccaca5336014d8c5ada70

SHA512
9c7ce583c15318c15569b255e35b69a8d5b50cb69966bf6ebb8a7af789278bcd7b46e863905963239444be3d896bf541c54f1529dde01e0085ce3ffc9b37369a

Download Submit
memory/1332-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads