e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c

Analysis

max time kernel
152s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
Size

124KB
MD5

53bb1401b62473906e50b2f0de55d370
SHA1

86be2edec1479f513ae3408c9c60879ed0b36cf2
SHA256

e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c
SHA512

87065878fb5dda42a46f8079e45cd0c5d77b90af68e7e57dcb4207e56177b01fe0455d33e65d24a8bb3ed9abc2a1f8eed0c87f46f343ce6524eda3792f75773d
SSDEEP

1536:YIszx5YeL1hRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:zG/YEhkFoN3Oo1+FvfSW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

jiugu.exemiaeke.exemosuv.exeguefuf.exesoelo.exephjob.exezaidoa.exekyveoc.exeduare.exee1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exenouluo.exemyhauj.exediube.exeqyroat.exehoekeo.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jiugu.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	miaeke.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	mosuv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	guefuf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	soelo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	phjob.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zaidoa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kyveoc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	duare.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nouluo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	myhauj.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	diube.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qyroat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hoekeo.exe

Executes dropped EXE 15 IoCs

Processes:

nouluo.exesoelo.exemyhauj.exejiugu.exephjob.exediube.exemiaeke.exemosuv.exeguefuf.exezaidoa.exeqyroat.exehoekeo.exekyveoc.exeduare.exenrqev.exe

pid	process
3968	nouluo.exe
3656	soelo.exe
1932	myhauj.exe
3360	jiugu.exe
672	phjob.exe
880	diube.exe
2688	miaeke.exe
4184	mosuv.exe
3780	guefuf.exe
4072	zaidoa.exe
2112	qyroat.exe
4616	hoekeo.exe
4700	kyveoc.exe
4864	duare.exe
176	nrqev.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nouluo.exezaidoa.exekyveoc.exephjob.exeguefuf.exeqyroat.exemosuv.exesoelo.exemyhauj.exejiugu.exediube.exemiaeke.exehoekeo.exeduare.exee1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	nouluo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	zaidoa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	kyveoc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	phjob.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	guefuf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	qyroat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	mosuv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	soelo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	myhauj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	jiugu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	diube.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	miaeke.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	hoekeo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	duare.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

guefuf.exehoekeo.exediube.exezaidoa.exesoelo.exejiugu.exekyveoc.exeduare.exeqyroat.exephjob.exenouluo.exemyhauj.exemosuv.exemiaeke.exee1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaidoa = "C:\\Users\\Admin\\zaidoa.exe /K"	guefuf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kyveoc = "C:\\Users\\Admin\\kyveoc.exe /f"	hoekeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miaeke = "C:\\Users\\Admin\\miaeke.exe /J"	diube.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	zaidoa.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	soelo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\phjob = "C:\\Users\\Admin\\phjob.exe /g"	jiugu.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	hoekeo.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	kyveoc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duare = "C:\\Users\\Admin\\duare.exe /e"	kyveoc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nrqev = "C:\\Users\\Admin\\nrqev.exe /d"	duare.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyroat = "C:\\Users\\Admin\\qyroat.exe /K"	zaidoa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoekeo = "C:\\Users\\Admin\\hoekeo.exe /o"	qyroat.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	phjob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diube = "C:\\Users\\Admin\\diube.exe /a"	phjob.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	duare.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nouluo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiugu = "C:\\Users\\Admin\\jiugu.exe /I"	myhauj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guefuf = "C:\\Users\\Admin\\guefuf.exe /h"	mosuv.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	qyroat.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	myhauj.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	jiugu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mosuv = "C:\\Users\\Admin\\mosuv.exe /b"	miaeke.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	mosuv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nouluo = "C:\\Users\\Admin\\nouluo.exe /R"	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\myhauj = "C:\\Users\\Admin\\myhauj.exe /l"	soelo.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	miaeke.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	diube.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	guefuf.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soelo = "C:\\Users\\Admin\\soelo.exe /G"	nouluo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exenouluo.exesoelo.exemyhauj.exejiugu.exephjob.exediube.exemiaeke.exemosuv.exeguefuf.exezaidoa.exeqyroat.exehoekeo.exekyveoc.exeduare.exe

pid	process
1580	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
1580	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
3968	nouluo.exe
3968	nouluo.exe
3656	soelo.exe
3656	soelo.exe
1932	myhauj.exe
1932	myhauj.exe
3360	jiugu.exe
3360	jiugu.exe
672	phjob.exe
672	phjob.exe
880	diube.exe
880	diube.exe
2688	miaeke.exe
2688	miaeke.exe
4184	mosuv.exe
4184	mosuv.exe
3780	guefuf.exe
3780	guefuf.exe
4072	zaidoa.exe
4072	zaidoa.exe
2112	qyroat.exe
2112	qyroat.exe
4616	hoekeo.exe
4616	hoekeo.exe
4700	kyveoc.exe
4700	kyveoc.exe
4864	duare.exe
4864	duare.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

pid	process
1580	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
3968	nouluo.exe
3656	soelo.exe
1932	myhauj.exe
3360	jiugu.exe
672	phjob.exe
880	diube.exe
2688	miaeke.exe
4184	mosuv.exe
3780	guefuf.exe
4072	zaidoa.exe
2112	qyroat.exe
4616	hoekeo.exe
4700	kyveoc.exe
4864	duare.exe
176	nrqev.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

description	pid	process	target process
PID 1580 wrote to memory of 3968	1580	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe	nouluo.exe
PID 1580 wrote to memory of 3968	1580	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe	nouluo.exe
PID 1580 wrote to memory of 3968	1580	e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe	nouluo.exe
PID 3968 wrote to memory of 3656	3968	nouluo.exe	soelo.exe
PID 3968 wrote to memory of 3656	3968	nouluo.exe	soelo.exe
PID 3968 wrote to memory of 3656	3968	nouluo.exe	soelo.exe
PID 3656 wrote to memory of 1932	3656	soelo.exe	myhauj.exe
PID 3656 wrote to memory of 1932	3656	soelo.exe	myhauj.exe
PID 3656 wrote to memory of 1932	3656	soelo.exe	myhauj.exe
PID 1932 wrote to memory of 3360	1932	myhauj.exe	jiugu.exe
PID 1932 wrote to memory of 3360	1932	myhauj.exe	jiugu.exe
PID 1932 wrote to memory of 3360	1932	myhauj.exe	jiugu.exe
PID 3360 wrote to memory of 672	3360	jiugu.exe	phjob.exe
PID 3360 wrote to memory of 672	3360	jiugu.exe	phjob.exe
PID 3360 wrote to memory of 672	3360	jiugu.exe	phjob.exe
PID 672 wrote to memory of 880	672	phjob.exe	diube.exe
PID 672 wrote to memory of 880	672	phjob.exe	diube.exe
PID 672 wrote to memory of 880	672	phjob.exe	diube.exe
PID 880 wrote to memory of 2688	880	diube.exe	miaeke.exe
PID 880 wrote to memory of 2688	880	diube.exe	miaeke.exe
PID 880 wrote to memory of 2688	880	diube.exe	miaeke.exe
PID 2688 wrote to memory of 4184	2688	miaeke.exe	mosuv.exe
PID 2688 wrote to memory of 4184	2688	miaeke.exe	mosuv.exe
PID 2688 wrote to memory of 4184	2688	miaeke.exe	mosuv.exe
PID 4184 wrote to memory of 3780	4184	mosuv.exe	guefuf.exe
PID 4184 wrote to memory of 3780	4184	mosuv.exe	guefuf.exe
PID 4184 wrote to memory of 3780	4184	mosuv.exe	guefuf.exe
PID 3780 wrote to memory of 4072	3780	guefuf.exe	zaidoa.exe
PID 3780 wrote to memory of 4072	3780	guefuf.exe	zaidoa.exe
PID 3780 wrote to memory of 4072	3780	guefuf.exe	zaidoa.exe
PID 4072 wrote to memory of 2112	4072	zaidoa.exe	qyroat.exe
PID 4072 wrote to memory of 2112	4072	zaidoa.exe	qyroat.exe
PID 4072 wrote to memory of 2112	4072	zaidoa.exe	qyroat.exe
PID 2112 wrote to memory of 4616	2112	qyroat.exe	hoekeo.exe
PID 2112 wrote to memory of 4616	2112	qyroat.exe	hoekeo.exe
PID 2112 wrote to memory of 4616	2112	qyroat.exe	hoekeo.exe
PID 4616 wrote to memory of 4700	4616	hoekeo.exe	kyveoc.exe
PID 4616 wrote to memory of 4700	4616	hoekeo.exe	kyveoc.exe
PID 4616 wrote to memory of 4700	4616	hoekeo.exe	kyveoc.exe
PID 4700 wrote to memory of 4864	4700	kyveoc.exe	duare.exe
PID 4700 wrote to memory of 4864	4700	kyveoc.exe	duare.exe
PID 4700 wrote to memory of 4864	4700	kyveoc.exe	duare.exe
PID 4864 wrote to memory of 176	4864	duare.exe	nrqev.exe
PID 4864 wrote to memory of 176	4864	duare.exe	nrqev.exe
PID 4864 wrote to memory of 176	4864	duare.exe	nrqev.exe

C:\Users\Admin\AppData\Local\Temp\e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe
"C:\Users\Admin\AppData\Local\Temp\e1849a4536153ef45b2a5ad196854ebf6ae6d8e9ee918eea253f08f62acc730c.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\nouluo.exe
"C:\Users\Admin\nouluo.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\soelo.exe
"C:\Users\Admin\soelo.exe"
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656

C:\Users\Admin\myhauj.exe
"C:\Users\Admin\myhauj.exe"
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\jiugu.exe
"C:\Users\Admin\jiugu.exe"
5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360

C:\Users\Admin\phjob.exe
"C:\Users\Admin\phjob.exe"
6⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672

C:\Users\Admin\diube.exe
"C:\Users\Admin\diube.exe"
7⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880

C:\Users\Admin\miaeke.exe
"C:\Users\Admin\miaeke.exe"
8⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688

C:\Users\Admin\mosuv.exe
"C:\Users\Admin\mosuv.exe"
9⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184

C:\Users\Admin\guefuf.exe
"C:\Users\Admin\guefuf.exe"
10⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780

C:\Users\Admin\zaidoa.exe
"C:\Users\Admin\zaidoa.exe"
11⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072

C:\Users\Admin\qyroat.exe
"C:\Users\Admin\qyroat.exe"
12⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112

C:\Users\Admin\hoekeo.exe
"C:\Users\Admin\hoekeo.exe"
13⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616

C:\Users\Admin\kyveoc.exe
"C:\Users\Admin\kyveoc.exe"
14⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700

C:\Users\Admin\duare.exe
"C:\Users\Admin\duare.exe"
15⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864

C:\Users\Admin\nrqev.exe
"C:\Users\Admin\nrqev.exe"
16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\diube.exe

Filesize
124KB

MD5
b2bc0bcb6d884a9f8a477c5593d4ea16

SHA1
b385e8c7de71e87fe8fbe9ce976f900fe0c5160c

SHA256
e22afb2181aaddb22872116d15b2784fe41a2f78343cb83a0f231c71b931a4bb

SHA512
45059b2e2466275577dfd9a9818850fd75a4a16336ab9042cf650fabee52eba564cf2e9a777b37ebb7cec2ba1744e9ad6ae6a1f3ced3f6f1a891f191584c1bdd

Download Submit
C:\Users\Admin\diube.exe

Filesize
124KB

MD5
b2bc0bcb6d884a9f8a477c5593d4ea16

SHA1
b385e8c7de71e87fe8fbe9ce976f900fe0c5160c

SHA256
e22afb2181aaddb22872116d15b2784fe41a2f78343cb83a0f231c71b931a4bb

SHA512
45059b2e2466275577dfd9a9818850fd75a4a16336ab9042cf650fabee52eba564cf2e9a777b37ebb7cec2ba1744e9ad6ae6a1f3ced3f6f1a891f191584c1bdd

Download Submit
C:\Users\Admin\duare.exe

Filesize
124KB

MD5
9dda18dd268d35c07339e87785f886aa

SHA1
341f7e9f9ac8beb8232822c361b03fb4892fff22

SHA256
3f1f725ae460ee707a5d26df87a5b1c85968b187422baf1e8d281500952da2a6

SHA512
6830179eb66a9c22a257656f8e296acd411aa560fd76496e7960476ab0b23e0b83e83a986f98a997c7ba37a8596c80809550882528fc104e3b064015d0574739

Download Submit
C:\Users\Admin\duare.exe

Filesize
124KB

MD5
9dda18dd268d35c07339e87785f886aa

SHA1
341f7e9f9ac8beb8232822c361b03fb4892fff22

SHA256
3f1f725ae460ee707a5d26df87a5b1c85968b187422baf1e8d281500952da2a6

SHA512
6830179eb66a9c22a257656f8e296acd411aa560fd76496e7960476ab0b23e0b83e83a986f98a997c7ba37a8596c80809550882528fc104e3b064015d0574739

Download Submit
C:\Users\Admin\guefuf.exe

Filesize
124KB

MD5
273817137c68e0ec7129d24ef7af4b36

SHA1
7417452260956287051d41339ae83d2bd2f17baa

SHA256
2fd22ef389503572a0ec56f9e46ea03b7113db496c896efb41377a16f723aced

SHA512
96136c6e161733f7b6be902f1e1e975d8da8e6629ecb656d68eeef0ef317d0071556ff0a0ffee633134daf12d841b54082b82447048dbb8c30c3932fbda217af

Download Submit
C:\Users\Admin\guefuf.exe

Filesize
124KB

MD5
273817137c68e0ec7129d24ef7af4b36

SHA1
7417452260956287051d41339ae83d2bd2f17baa

SHA256
2fd22ef389503572a0ec56f9e46ea03b7113db496c896efb41377a16f723aced

SHA512
96136c6e161733f7b6be902f1e1e975d8da8e6629ecb656d68eeef0ef317d0071556ff0a0ffee633134daf12d841b54082b82447048dbb8c30c3932fbda217af

Download Submit
C:\Users\Admin\hoekeo.exe

Filesize
124KB

MD5
86b1050607d0d59b7485c18668a2fd8e

SHA1
e23d1fb20b74e78ce88a40a1886acd48ac3d6f0a

SHA256
1ea60143ad5dc951dbe5c488b8ce996f5f7f470994d59b2aef086047df6dd46a

SHA512
8be2aa1a093cda4daa0911d5ccd285af7ddbca8aad622c393b8debcae1121b727636e9c21432d5dac617bf25dc4d5d98a82ae644b962a3efcfb71a40645a1e8f

Download Submit
C:\Users\Admin\hoekeo.exe

Filesize
124KB

MD5
86b1050607d0d59b7485c18668a2fd8e

SHA1
e23d1fb20b74e78ce88a40a1886acd48ac3d6f0a

SHA256
1ea60143ad5dc951dbe5c488b8ce996f5f7f470994d59b2aef086047df6dd46a

SHA512
8be2aa1a093cda4daa0911d5ccd285af7ddbca8aad622c393b8debcae1121b727636e9c21432d5dac617bf25dc4d5d98a82ae644b962a3efcfb71a40645a1e8f

Download Submit
C:\Users\Admin\jiugu.exe

Filesize
124KB

MD5
a3bd581c3da0caad6ac29cce3438cfe9

SHA1
5b538422d3f25bc5ec8bd7f441da27388cbe0704

SHA256
35d0fc60fa7c292143db4cc4bb8149e19409aed8dc64bcbb62e56d8f430406c0

SHA512
9f9b1e1f2c57a53cafc504b4d783bf96d6c1d4b6a05e3adb6e9a897653d0c55cb8f5c99e5d9e83bdca05d52e494d995a927f9e07e62534fe1a1543507eb90b93

Download Submit
C:\Users\Admin\jiugu.exe

Filesize
124KB

MD5
a3bd581c3da0caad6ac29cce3438cfe9

SHA1
5b538422d3f25bc5ec8bd7f441da27388cbe0704

SHA256
35d0fc60fa7c292143db4cc4bb8149e19409aed8dc64bcbb62e56d8f430406c0

SHA512
9f9b1e1f2c57a53cafc504b4d783bf96d6c1d4b6a05e3adb6e9a897653d0c55cb8f5c99e5d9e83bdca05d52e494d995a927f9e07e62534fe1a1543507eb90b93

Download Submit
C:\Users\Admin\kyveoc.exe

Filesize
124KB

MD5
33c3fbe0784498d1c7a9c273729c84c8

SHA1
0db6bd7d4f778e699b1d681ab0d3b2b6322ba43a

SHA256
b585a1602d180d425dafae2fdfa4d1bf99a2b8a8ec8f337de93fcc26b208785c

SHA512
0476b526ebe174e969714c8542ab3db5831fd432c594cc7d13e050ca3c6ff9c7ece91cb4d954d2bda0cbc708e175429c1e33386790a43260afb026e18b273470

Download Submit
C:\Users\Admin\kyveoc.exe

Filesize
124KB

MD5
33c3fbe0784498d1c7a9c273729c84c8

SHA1
0db6bd7d4f778e699b1d681ab0d3b2b6322ba43a

SHA256
b585a1602d180d425dafae2fdfa4d1bf99a2b8a8ec8f337de93fcc26b208785c

SHA512
0476b526ebe174e969714c8542ab3db5831fd432c594cc7d13e050ca3c6ff9c7ece91cb4d954d2bda0cbc708e175429c1e33386790a43260afb026e18b273470

Download Submit
C:\Users\Admin\miaeke.exe

Filesize
124KB

MD5
6fa02230021d3bf972faffacb69477d5

SHA1
068c094f028a4d1a94f1f70413f8f66042a64708

SHA256
82fe2c4218a35336596c0d63faba4eda8fac09a1770a8c47d984f4ce785ba60e

SHA512
1d41a8c1f481106e593b3dc107383605a6d225d20df0fc219e5c299b411d66f98fc73d1432d449beb9d7f0977d16b13d61183506d805100ce391de8c3a7c4f8c

Download Submit
C:\Users\Admin\miaeke.exe

Filesize
124KB

MD5
6fa02230021d3bf972faffacb69477d5

SHA1
068c094f028a4d1a94f1f70413f8f66042a64708

SHA256
82fe2c4218a35336596c0d63faba4eda8fac09a1770a8c47d984f4ce785ba60e

SHA512
1d41a8c1f481106e593b3dc107383605a6d225d20df0fc219e5c299b411d66f98fc73d1432d449beb9d7f0977d16b13d61183506d805100ce391de8c3a7c4f8c

Download Submit
C:\Users\Admin\mosuv.exe

Filesize
124KB

MD5
7311ab1b2b350326d93766c670173035

SHA1
7c4b2f7bb4922ef5962fe532a7047e4b565ca7b3

SHA256
eee4e0ba3a8e26c8f47b3f75f18297e697a5826a11a319c2f1f7f9b540ec34f6

SHA512
68787ff6bb9698b078aba130457c591ac485d1d145053f79ea81146c3525b0a72c175f7dd9460cd87ee393f44a9550a6bb2653fa4708033077bb147a32adf271

Download Submit
C:\Users\Admin\mosuv.exe

Filesize
124KB

MD5
7311ab1b2b350326d93766c670173035

SHA1
7c4b2f7bb4922ef5962fe532a7047e4b565ca7b3

SHA256
eee4e0ba3a8e26c8f47b3f75f18297e697a5826a11a319c2f1f7f9b540ec34f6

SHA512
68787ff6bb9698b078aba130457c591ac485d1d145053f79ea81146c3525b0a72c175f7dd9460cd87ee393f44a9550a6bb2653fa4708033077bb147a32adf271

Download Submit
C:\Users\Admin\myhauj.exe

Filesize
124KB

MD5
af9ba139ed81399b404dc890b316ed52

SHA1
e6cdcaf9309ca55127de29fe822013213497bed6

SHA256
94be60c7205df815a41e18636fff71855d3cf20fefd054bcfccc65e6c7cd7707

SHA512
ca030ec474c53898aebc40312dba0ccd93320225798f28201187d63d91a15f0e1ccc4356e81ffd32ecd6203bdd25da37accb904755aba8728e749c54a4c15048

Download Submit
C:\Users\Admin\myhauj.exe

Filesize
124KB

MD5
af9ba139ed81399b404dc890b316ed52

SHA1
e6cdcaf9309ca55127de29fe822013213497bed6

SHA256
94be60c7205df815a41e18636fff71855d3cf20fefd054bcfccc65e6c7cd7707

SHA512
ca030ec474c53898aebc40312dba0ccd93320225798f28201187d63d91a15f0e1ccc4356e81ffd32ecd6203bdd25da37accb904755aba8728e749c54a4c15048

Download Submit
C:\Users\Admin\nouluo.exe

Filesize
124KB

MD5
32be925de8ec520ab12eb202d6a83c5b

SHA1
bb14c4ed5c28806bc7ca456f3836bd22029b90bf

SHA256
31df97d4eb73d16c933dd2e3074dbe857032f83c8a7a6c904d8b1e857e3fc414

SHA512
7f9072baf1cf5e7fa71bcb774018b01f14140b2016997bc6627ee264680b52d10377cda1aa9e1c4af033a03ad5c735555dc9723331cce0569150098ab747f0cd

Download Submit
C:\Users\Admin\nouluo.exe

Filesize
124KB

MD5
32be925de8ec520ab12eb202d6a83c5b

SHA1
bb14c4ed5c28806bc7ca456f3836bd22029b90bf

SHA256
31df97d4eb73d16c933dd2e3074dbe857032f83c8a7a6c904d8b1e857e3fc414

SHA512
7f9072baf1cf5e7fa71bcb774018b01f14140b2016997bc6627ee264680b52d10377cda1aa9e1c4af033a03ad5c735555dc9723331cce0569150098ab747f0cd

Download Submit
C:\Users\Admin\nrqev.exe

Filesize
124KB

MD5
2a42a97ffb2c95be2292fb8d7e2f0be4

SHA1
a7bea0b38dfce09f8f0cf9b4bca06dd1dacaef6a

SHA256
ac5e51e280398ff88cf1753d9040ceaf4a21da257907c7d8c1c4cb629fe18ad6

SHA512
4d6fc37354592fcba6748f03bd1c232277c808e258526490d12321370145e378838f47dba1ae1e9be9a1f8b4b57746a945c3fbf8fc6e837100c32a049118e767

Download Submit
C:\Users\Admin\nrqev.exe

Filesize
124KB

MD5
2a42a97ffb2c95be2292fb8d7e2f0be4

SHA1
a7bea0b38dfce09f8f0cf9b4bca06dd1dacaef6a

SHA256
ac5e51e280398ff88cf1753d9040ceaf4a21da257907c7d8c1c4cb629fe18ad6

SHA512
4d6fc37354592fcba6748f03bd1c232277c808e258526490d12321370145e378838f47dba1ae1e9be9a1f8b4b57746a945c3fbf8fc6e837100c32a049118e767

Download Submit
C:\Users\Admin\phjob.exe

Filesize
124KB

MD5
7342a2edb825fd21876b0169c8e591ad

SHA1
e53a5f053d6caee86b324a55181ec5ea0f53d5fe

SHA256
7ebcac3cbd1e43eae927829a5d7e1b4b79127c066311192b94308e21dfcc77cb

SHA512
cfbbe9ea835aa6ff170c5d2e22b1831757619c027463b34eeacb464de277da4b2f1a18f85e36cf67025a0b7c3b859fce06ae39eadfa8d319edf4669cfbf85c42

Download Submit
C:\Users\Admin\phjob.exe

Filesize
124KB

MD5
7342a2edb825fd21876b0169c8e591ad

SHA1
e53a5f053d6caee86b324a55181ec5ea0f53d5fe

SHA256
7ebcac3cbd1e43eae927829a5d7e1b4b79127c066311192b94308e21dfcc77cb

SHA512
cfbbe9ea835aa6ff170c5d2e22b1831757619c027463b34eeacb464de277da4b2f1a18f85e36cf67025a0b7c3b859fce06ae39eadfa8d319edf4669cfbf85c42

Download Submit
C:\Users\Admin\qyroat.exe

Filesize
124KB

MD5
29ee1415e94e701936a7cb286f67a6fa

SHA1
f484faa17076421a54f8b52b3e10259aeef3c005

SHA256
d8c6e0ef8cda8f9342acbe0df9020c4a40fe2be03677e6d2cc592b39a21c9745

SHA512
7fa27cebef0c70faae3182e204901747c485b2651ec9bdb93e2dc19b678a37864ffb847a67e8c0c899608769adbb60f480cc2765b6ebd25d0b6c74ac658c77b7

Download Submit
C:\Users\Admin\qyroat.exe

Filesize
124KB

MD5
29ee1415e94e701936a7cb286f67a6fa

SHA1
f484faa17076421a54f8b52b3e10259aeef3c005

SHA256
d8c6e0ef8cda8f9342acbe0df9020c4a40fe2be03677e6d2cc592b39a21c9745

SHA512
7fa27cebef0c70faae3182e204901747c485b2651ec9bdb93e2dc19b678a37864ffb847a67e8c0c899608769adbb60f480cc2765b6ebd25d0b6c74ac658c77b7

Download Submit
C:\Users\Admin\soelo.exe

Filesize
124KB

MD5
d6a734ec2829bd9fa5af5c86c65c5791

SHA1
347a5a6e7f1ca96df2210289aaa8d190d9e54f43

SHA256
c14615879bbf753f071197bf5c32b1061043744519708a546b10c10b46dda684

SHA512
1737170545dff3ebae3046e384db4d33462e3e39f0ef7d833cf9e99a85283f83b0d454cc26c8af274d8ddfd748b84d60d7f3363960f82c7b1065d20d59c85231

Download Submit
C:\Users\Admin\soelo.exe

Filesize
124KB

MD5
d6a734ec2829bd9fa5af5c86c65c5791

SHA1
347a5a6e7f1ca96df2210289aaa8d190d9e54f43

SHA256
c14615879bbf753f071197bf5c32b1061043744519708a546b10c10b46dda684

SHA512
1737170545dff3ebae3046e384db4d33462e3e39f0ef7d833cf9e99a85283f83b0d454cc26c8af274d8ddfd748b84d60d7f3363960f82c7b1065d20d59c85231

Download Submit
C:\Users\Admin\zaidoa.exe

Filesize
124KB

MD5
c86b872d06b67393a247e0439064d9cb

SHA1
76c0d45d43925e6f028774e2ba351b46ad67bf31

SHA256
8b467b6ca156cec10bcbfd2923582f84706fabe1b2f213dc835679f85bdd7226

SHA512
3f5966a2ef92344815345dea670e488856a292c09e7a008d7c155312e65671890581d8d759952fe88d8caa2b421b9398de533afc3717e32bc25d92454aecd89d

Download Submit
C:\Users\Admin\zaidoa.exe

Filesize
124KB

MD5
c86b872d06b67393a247e0439064d9cb

SHA1
76c0d45d43925e6f028774e2ba351b46ad67bf31

SHA256
8b467b6ca156cec10bcbfd2923582f84706fabe1b2f213dc835679f85bdd7226

SHA512
3f5966a2ef92344815345dea670e488856a292c09e7a008d7c155312e65671890581d8d759952fe88d8caa2b421b9398de533afc3717e32bc25d92454aecd89d

Download Submit
memory/176-204-0x0000000000000000-mapping.dmp

Download
memory/672-154-0x0000000000000000-mapping.dmp

Download
memory/880-159-0x0000000000000000-mapping.dmp

Download
memory/1932-144-0x0000000000000000-mapping.dmp

Download
memory/2112-184-0x0000000000000000-mapping.dmp

Download
memory/2688-164-0x0000000000000000-mapping.dmp

Download
memory/3360-149-0x0000000000000000-mapping.dmp

Download
memory/3656-139-0x0000000000000000-mapping.dmp

Download
memory/3780-174-0x0000000000000000-mapping.dmp

Download
memory/3968-134-0x0000000000000000-mapping.dmp

Download
memory/4072-179-0x0000000000000000-mapping.dmp

Download
memory/4184-169-0x0000000000000000-mapping.dmp

Download
memory/4616-189-0x0000000000000000-mapping.dmp

Download
memory/4700-194-0x0000000000000000-mapping.dmp

Download
memory/4864-199-0x0000000000000000-mapping.dmp

Download