9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2

Analysis

max time kernel
157s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
Size

124KB
MD5

02d04165e9a1f939010782168cb23bd0
SHA1

657250e9f3c0f0a8cba5145a6cbe5e38156b100b
SHA256

9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2
SHA512

dc91675aa67ff3f61b7b96d29c3d7b381d431e8b1a1196cd501f4ba98061000ea77fe13f7a00d3360821e4fcc897d94ee82b09b2775fd3c0f104c2252c0cf44a
SSDEEP

1536:yGszJ5YyTx+hRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:zGnYQshkFoN3Oo1+FvfSW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	moeza.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lialuq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jiano.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	catab.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	doros.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nhbiip.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nqguon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	puixe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wldez.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	leimi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yeonov.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jiopoa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	leuoq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	boiulan.exe

Executes dropped EXE 15 IoCs

pid	Process
1372	nqguon.exe
2608	puixe.exe
4808	moeza.exe
2672	wldez.exe
1232	jiopoa.exe
3152	leuoq.exe
4908	boiulan.exe
4888	lialuq.exe
3464	jiano.exe
5052	catab.exe
456	leimi.exe
4076	doros.exe
3932	nhbiip.exe
1468	yeonov.exe
2052	dieoqaz.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	jiopoa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	leuoq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	boiulan.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	puixe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	moeza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	leimi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	yeonov.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wldez.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	lialuq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	doros.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	catab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	nhbiip.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	nqguon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	jiano.exe

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	jiano.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	leimi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dieoqaz = "C:\\Users\\Admin\\dieoqaz.exe /u"	yeonov.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yeonov.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	puixe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\moeza = "C:\\Users\\Admin\\moeza.exe /i"	puixe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boiulan = "C:\\Users\\Admin\\boiulan.exe /P"	leuoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\catab = "C:\\Users\\Admin\\catab.exe /u"	jiano.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nqguon = "C:\\Users\\Admin\\nqguon.exe /b"	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nqguon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nhbiip = "C:\\Users\\Admin\\nhbiip.exe /M"	doros.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiopoa = "C:\\Users\\Admin\\jiopoa.exe /P"	wldez.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	boiulan.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	lialuq.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	doros.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeonov = "C:\\Users\\Admin\\yeonov.exe /i"	nhbiip.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wldez = "C:\\Users\\Admin\\wldez.exe /Y"	moeza.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	leuoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doros = "C:\\Users\\Admin\\doros.exe /d"	leimi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lialuq = "C:\\Users\\Admin\\lialuq.exe /v"	boiulan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiano = "C:\\Users\\Admin\\jiano.exe /i"	lialuq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leimi = "C:\\Users\\Admin\\leimi.exe /h"	catab.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nhbiip.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	moeza.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	wldez.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	jiopoa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puixe = "C:\\Users\\Admin\\puixe.exe /k"	nqguon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leuoq = "C:\\Users\\Admin\\leuoq.exe /n"	jiopoa.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	catab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3760	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
3760	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
1372	nqguon.exe
1372	nqguon.exe
2608	puixe.exe
2608	puixe.exe
4808	moeza.exe
4808	moeza.exe
2672	wldez.exe
2672	wldez.exe
1232	jiopoa.exe
1232	jiopoa.exe
3152	leuoq.exe
3152	leuoq.exe
4908	boiulan.exe
4908	boiulan.exe
4888	lialuq.exe
4888	lialuq.exe
3464	jiano.exe
3464	jiano.exe
5052	catab.exe
5052	catab.exe
456	leimi.exe
456	leimi.exe
4076	doros.exe
4076	doros.exe
3932	nhbiip.exe
3932	nhbiip.exe
1468	yeonov.exe
1468	yeonov.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3760	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
1372	nqguon.exe
2608	puixe.exe
4808	moeza.exe
2672	wldez.exe
1232	jiopoa.exe
3152	leuoq.exe
4908	boiulan.exe
4888	lialuq.exe
3464	jiano.exe
5052	catab.exe
456	leimi.exe
4076	doros.exe
3932	nhbiip.exe
1468	yeonov.exe
2052	dieoqaz.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1372	3760	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe	88
PID 3760 wrote to memory of 1372	3760	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe	88
PID 3760 wrote to memory of 1372	3760	9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe	88
PID 1372 wrote to memory of 2608	1372	nqguon.exe	89
PID 1372 wrote to memory of 2608	1372	nqguon.exe	89
PID 1372 wrote to memory of 2608	1372	nqguon.exe	89
PID 2608 wrote to memory of 4808	2608	puixe.exe	90
PID 2608 wrote to memory of 4808	2608	puixe.exe	90
PID 2608 wrote to memory of 4808	2608	puixe.exe	90
PID 4808 wrote to memory of 2672	4808	moeza.exe	92
PID 4808 wrote to memory of 2672	4808	moeza.exe	92
PID 4808 wrote to memory of 2672	4808	moeza.exe	92
PID 4808 wrote to memory of 2672	4808	moeza.exe	92
PID 4808 wrote to memory of 2672	4808	moeza.exe	92
PID 2672 wrote to memory of 1232	2672	wldez.exe	93
PID 2672 wrote to memory of 1232	2672	wldez.exe	93
PID 2672 wrote to memory of 1232	2672	wldez.exe	93
PID 1232 wrote to memory of 3152	1232	jiopoa.exe	96
PID 1232 wrote to memory of 3152	1232	jiopoa.exe	96
PID 1232 wrote to memory of 3152	1232	jiopoa.exe	96
PID 1232 wrote to memory of 2672	1232	jiopoa.exe	92
PID 1232 wrote to memory of 2672	1232	jiopoa.exe	92
PID 3152 wrote to memory of 4908	3152	leuoq.exe	97
PID 3152 wrote to memory of 4908	3152	leuoq.exe	97
PID 3152 wrote to memory of 4908	3152	leuoq.exe	97
PID 3152 wrote to memory of 2672	3152	leuoq.exe	92
PID 3152 wrote to memory of 2672	3152	leuoq.exe	92
PID 4908 wrote to memory of 4888	4908	boiulan.exe	103
PID 4908 wrote to memory of 4888	4908	boiulan.exe	103
PID 4908 wrote to memory of 4888	4908	boiulan.exe	103
PID 4888 wrote to memory of 3464	4888	lialuq.exe	106
PID 4888 wrote to memory of 3464	4888	lialuq.exe	106
PID 4888 wrote to memory of 3464	4888	lialuq.exe	106
PID 3464 wrote to memory of 5052	3464	jiano.exe	107
PID 3464 wrote to memory of 5052	3464	jiano.exe	107
PID 3464 wrote to memory of 5052	3464	jiano.exe	107
PID 5052 wrote to memory of 456	5052	catab.exe	109
PID 5052 wrote to memory of 456	5052	catab.exe	109
PID 5052 wrote to memory of 456	5052	catab.exe	109
PID 5052 wrote to memory of 456	5052	catab.exe	109
PID 5052 wrote to memory of 456	5052	catab.exe	109
PID 456 wrote to memory of 4076	456	leimi.exe	110
PID 456 wrote to memory of 4076	456	leimi.exe	110
PID 456 wrote to memory of 4076	456	leimi.exe	110
PID 456 wrote to memory of 4076	456	leimi.exe	110
PID 456 wrote to memory of 4076	456	leimi.exe	110
PID 4076 wrote to memory of 3932	4076	doros.exe	112
PID 4076 wrote to memory of 3932	4076	doros.exe	112
PID 4076 wrote to memory of 3932	4076	doros.exe	112
PID 4076 wrote to memory of 456	4076	doros.exe	109
PID 4076 wrote to memory of 456	4076	doros.exe	109
PID 3932 wrote to memory of 1468	3932	nhbiip.exe	113
PID 3932 wrote to memory of 1468	3932	nhbiip.exe	113
PID 3932 wrote to memory of 1468	3932	nhbiip.exe	113
PID 1468 wrote to memory of 2052	1468	yeonov.exe	114
PID 1468 wrote to memory of 2052	1468	yeonov.exe	114
PID 1468 wrote to memory of 2052	1468	yeonov.exe	114

C:\Users\Admin\AppData\Local\Temp\9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe
"C:\Users\Admin\AppData\Local\Temp\9e179f85c206090bf03600691f4988e542cd377f3a06d043f772f5406eaee6c2.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\nqguon.exe
  "C:\Users\Admin\nqguon.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Users\Admin\puixe.exe
    "C:\Users\Admin\puixe.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\moeza.exe
      "C:\Users\Admin\moeza.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Checks computer location settings
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Users\Admin\wldez.exe
        
        "C:\Users\Admin\wldez.exe"
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Users\Admin\jiopoa.exe
        
        "C:\Users\Admin\jiopoa.exe"
        6⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Users\Admin\leuoq.exe
        
        "C:\Users\Admin\leuoq.exe"
        7⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Users\Admin\boiulan.exe
        
        "C:\Users\Admin\boiulan.exe"
        8⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Users\Admin\lialuq.exe
        
        "C:\Users\Admin\lialuq.exe"
        9⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Users\Admin\jiano.exe
        
        "C:\Users\Admin\jiano.exe"
        10⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Users\Admin\catab.exe
        
        "C:\Users\Admin\catab.exe"
        11⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Users\Admin\leimi.exe
        
        "C:\Users\Admin\leimi.exe"
        12⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Users\Admin\doros.exe
        
        "C:\Users\Admin\doros.exe"
        13⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Users\Admin\nhbiip.exe
        
        "C:\Users\Admin\nhbiip.exe"
        14⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Users\Admin\yeonov.exe
        
        "C:\Users\Admin\yeonov.exe"
        15⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Users\Admin\dieoqaz.exe
        
        "C:\Users\Admin\dieoqaz.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\boiulan.exe

Filesize
124KB

MD5
7c4337fcbce4bffdb6106968de81cc91

SHA1
907ecfbd93557033fef4a3cf5393f80dafe78dd0

SHA256
b851fd1099138afec883b67335d7e4ee8b83537a3db0324eb9c4b90c60e43622

SHA512
72f93b0e1cd1ca2f4f2f76a0811488afd59ae5306acebdafb5ee1f0bcf24bd56bf2d01294e5e38aeefb8c772c90a43cec2f542b5b06a5a773db5c181dbe9b047

Download Submit
C:\Users\Admin\boiulan.exe

Filesize
124KB

MD5
7c4337fcbce4bffdb6106968de81cc91

SHA1
907ecfbd93557033fef4a3cf5393f80dafe78dd0

SHA256
b851fd1099138afec883b67335d7e4ee8b83537a3db0324eb9c4b90c60e43622

SHA512
72f93b0e1cd1ca2f4f2f76a0811488afd59ae5306acebdafb5ee1f0bcf24bd56bf2d01294e5e38aeefb8c772c90a43cec2f542b5b06a5a773db5c181dbe9b047

Download Submit
C:\Users\Admin\catab.exe

Filesize
124KB

MD5
50e6b096166d00506c0ffd6bd13ec860

SHA1
4e41d77511a25b1f7bf098a5232d3b56f018d2b9

SHA256
0330e88bc3c5ddc6a6a58bc8b456d855049a9ab2aabf43d3ac39360a0324ba45

SHA512
a1adc7388833070a5401062e3d221b18314d44f2c7ca231f5a366b1e1307d96058ab774615267b20fd7a21ff1f114b26e359e7a342908a2a62fd8b22b61a6815

Download Submit
C:\Users\Admin\catab.exe

Filesize
124KB

MD5
50e6b096166d00506c0ffd6bd13ec860

SHA1
4e41d77511a25b1f7bf098a5232d3b56f018d2b9

SHA256
0330e88bc3c5ddc6a6a58bc8b456d855049a9ab2aabf43d3ac39360a0324ba45

SHA512
a1adc7388833070a5401062e3d221b18314d44f2c7ca231f5a366b1e1307d96058ab774615267b20fd7a21ff1f114b26e359e7a342908a2a62fd8b22b61a6815

Download Submit
C:\Users\Admin\dieoqaz.exe

Filesize
124KB

MD5
acca6518ca2654595ee8178750e67586

SHA1
76459f6fc783d1a535a06d2a049cf94c48645c0b

SHA256
129519b5d4714b7f07ed60976e64a61409a634e65832bd29b8c6b63474a79946

SHA512
96f1e0f99e89e6b544177465d1664074d8e8ef2027e9885095b1d463dfd156b0699147577fbf5e54d3a2b83b74eaa6a5bd0f7e87128c478a571c912783ddb19e

Download Submit
C:\Users\Admin\dieoqaz.exe

Filesize
124KB

MD5
acca6518ca2654595ee8178750e67586

SHA1
76459f6fc783d1a535a06d2a049cf94c48645c0b

SHA256
129519b5d4714b7f07ed60976e64a61409a634e65832bd29b8c6b63474a79946

SHA512
96f1e0f99e89e6b544177465d1664074d8e8ef2027e9885095b1d463dfd156b0699147577fbf5e54d3a2b83b74eaa6a5bd0f7e87128c478a571c912783ddb19e

Download Submit
C:\Users\Admin\doros.exe

Filesize
124KB

MD5
cac709fc1fcd89a1025d9a26cd756072

SHA1
985aac44a9f7214742f56db3b17ccf1feb3103ec

SHA256
b9af0811585cc13f2d3fc9b72ba24a391688f1ebcbd5ea39b2142e6ae630749b

SHA512
8826630a4e2660a5496f2d7d02dae189a7990a7ef471b9328cdcfa86f09599393c427fd2caf0977ddc89b3a30a25116045033d541608332a9f7116bcc1fc6118

Download Submit
C:\Users\Admin\doros.exe

Filesize
124KB

MD5
cac709fc1fcd89a1025d9a26cd756072

SHA1
985aac44a9f7214742f56db3b17ccf1feb3103ec

SHA256
b9af0811585cc13f2d3fc9b72ba24a391688f1ebcbd5ea39b2142e6ae630749b

SHA512
8826630a4e2660a5496f2d7d02dae189a7990a7ef471b9328cdcfa86f09599393c427fd2caf0977ddc89b3a30a25116045033d541608332a9f7116bcc1fc6118

Download Submit
C:\Users\Admin\jiano.exe

Filesize
124KB

MD5
03cce30c2e5a2dc605af569a4f2014c4

SHA1
644e001bf7e02407fae960ab1e3ec0255f3dcae0

SHA256
6fae9fc4e27d1b5d631205993ef6c729016e7cb7f548e59e828ca5ff148a300b

SHA512
a79084652c98f665399a1b8aedabb76a01794a8b8c8fab9b938044c3747b46079c0c202b5872095e93559858b289c89ddbf288d3377194dc92ecc5c934786a01

Download Submit
C:\Users\Admin\jiano.exe

Filesize
124KB

MD5
03cce30c2e5a2dc605af569a4f2014c4

SHA1
644e001bf7e02407fae960ab1e3ec0255f3dcae0

SHA256
6fae9fc4e27d1b5d631205993ef6c729016e7cb7f548e59e828ca5ff148a300b

SHA512
a79084652c98f665399a1b8aedabb76a01794a8b8c8fab9b938044c3747b46079c0c202b5872095e93559858b289c89ddbf288d3377194dc92ecc5c934786a01

Download Submit
C:\Users\Admin\jiopoa.exe

Filesize
124KB

MD5
da2cfdd5afcd8f29a9635460ce25367c

SHA1
e73169e9261b9203f394539ee79017d3928ddcfa

SHA256
baefb0c847c0ccced226a08fe4c6fc9db747f7d20578d48671af263378a47e66

SHA512
e8c6e713b97db3114fc0c7eff4d765baed604d2d278833f5697fd1e170418e4acaab6ecb6b883d3473a78ba9d9fbc215f9c878f33100207265d16ca4c37c1948

Download Submit
C:\Users\Admin\jiopoa.exe

Filesize
124KB

MD5
da2cfdd5afcd8f29a9635460ce25367c

SHA1
e73169e9261b9203f394539ee79017d3928ddcfa

SHA256
baefb0c847c0ccced226a08fe4c6fc9db747f7d20578d48671af263378a47e66

SHA512
e8c6e713b97db3114fc0c7eff4d765baed604d2d278833f5697fd1e170418e4acaab6ecb6b883d3473a78ba9d9fbc215f9c878f33100207265d16ca4c37c1948

Download Submit
C:\Users\Admin\leimi.exe

Filesize
124KB

MD5
70deb0926c2468bb06236e943cea3920

SHA1
33bcb15dfad9437d0b138b4834823004f3a835dc

SHA256
ea7be3d087093520cd5907f94c22356324e1287917a08397e96a430f90fc2fba

SHA512
5b6979508fd012de841d2fb2801daaa0a622bc18e64a9e28995d2b2f48e4a55d5ce44bfad44f393284e33fcfe14489d92d797eef559e52c01210d8b924e84188

Download Submit
C:\Users\Admin\leimi.exe

Filesize
124KB

MD5
70deb0926c2468bb06236e943cea3920

SHA1
33bcb15dfad9437d0b138b4834823004f3a835dc

SHA256
ea7be3d087093520cd5907f94c22356324e1287917a08397e96a430f90fc2fba

SHA512
5b6979508fd012de841d2fb2801daaa0a622bc18e64a9e28995d2b2f48e4a55d5ce44bfad44f393284e33fcfe14489d92d797eef559e52c01210d8b924e84188

Download Submit
C:\Users\Admin\leuoq.exe

Filesize
124KB

MD5
ed616c776755837793faecef9e87b890

SHA1
c5ddafe816bfd69de2f8799a21849623ee71506d

SHA256
5cb127d17c551d4cd7127fe4f990ff26d6630519b3e729ce1d4ab254a6c5bfe6

SHA512
630064d33e35173a0784c48f662edeabe13221149ad03af161defd090e23cc9aebd472ba5dfb21a4b2560f002ddb6f4c8279343e6443fbcec7ade27c1c05c82a

Download Submit
C:\Users\Admin\leuoq.exe

Filesize
124KB

MD5
ed616c776755837793faecef9e87b890

SHA1
c5ddafe816bfd69de2f8799a21849623ee71506d

SHA256
5cb127d17c551d4cd7127fe4f990ff26d6630519b3e729ce1d4ab254a6c5bfe6

SHA512
630064d33e35173a0784c48f662edeabe13221149ad03af161defd090e23cc9aebd472ba5dfb21a4b2560f002ddb6f4c8279343e6443fbcec7ade27c1c05c82a

Download Submit
C:\Users\Admin\lialuq.exe

Filesize
124KB

MD5
35ab8df4b04a35ce174f793d6e5837e5

SHA1
9f648dbf70511b4692eb457e7f9af6c5e5ee2e0a

SHA256
908a250e5dedcf6aba10464eaa6e551a81a7214a0af8212108f264ed5874301c

SHA512
9fe804e2c8f29477c92359c1b3ef8a0b6e1fc624342c1863f1142cf078c3354a5106b792bf0368921e1c21b753b4b05aa45f442925e3cfa7db44d6fb13bc345d

Download Submit
C:\Users\Admin\lialuq.exe

Filesize
124KB

MD5
35ab8df4b04a35ce174f793d6e5837e5

SHA1
9f648dbf70511b4692eb457e7f9af6c5e5ee2e0a

SHA256
908a250e5dedcf6aba10464eaa6e551a81a7214a0af8212108f264ed5874301c

SHA512
9fe804e2c8f29477c92359c1b3ef8a0b6e1fc624342c1863f1142cf078c3354a5106b792bf0368921e1c21b753b4b05aa45f442925e3cfa7db44d6fb13bc345d

Download Submit
C:\Users\Admin\moeza.exe

Filesize
124KB

MD5
7002d9ca3bd44b9077f54c6f730d8036

SHA1
58c835ad473c31ee580f8ed0f90e37887e7f799e

SHA256
2d73a94908f0590fc29f23f16d071010daca4497b9b1943b5b96806191325ef0

SHA512
2b8e34292f2377d6628c940792bf5da3fd759016814e19cfef6e8863c270c174669b393e8a1e11e2cfaa4929484843eb1446807250525bb58d1d000196db4e51

Download Submit
C:\Users\Admin\moeza.exe

Filesize
124KB

MD5
7002d9ca3bd44b9077f54c6f730d8036

SHA1
58c835ad473c31ee580f8ed0f90e37887e7f799e

SHA256
2d73a94908f0590fc29f23f16d071010daca4497b9b1943b5b96806191325ef0

SHA512
2b8e34292f2377d6628c940792bf5da3fd759016814e19cfef6e8863c270c174669b393e8a1e11e2cfaa4929484843eb1446807250525bb58d1d000196db4e51

Download Submit
C:\Users\Admin\nhbiip.exe

Filesize
124KB

MD5
b72cf406a96edc76f09fc6d5d49c0589

SHA1
e068ff190ba44026d6c617d9277058b040bffceb

SHA256
76097f31c9e2f43629ff02921cb4ffd4a89e55e6614d002ffc5defe2361e1650

SHA512
b9a5c5f46f06db0bd84667ea3451200446b5c7ede20b177fc9c1a8503e33f70883d4cde5732398c813b628ee8c8a0a20496628846f40eab388a8b5b5c36a50a0

Download Submit
C:\Users\Admin\nhbiip.exe

Filesize
124KB

MD5
b72cf406a96edc76f09fc6d5d49c0589

SHA1
e068ff190ba44026d6c617d9277058b040bffceb

SHA256
76097f31c9e2f43629ff02921cb4ffd4a89e55e6614d002ffc5defe2361e1650

SHA512
b9a5c5f46f06db0bd84667ea3451200446b5c7ede20b177fc9c1a8503e33f70883d4cde5732398c813b628ee8c8a0a20496628846f40eab388a8b5b5c36a50a0

Download Submit
C:\Users\Admin\nqguon.exe

Filesize
124KB

MD5
e0dee5b858079ecc5b11e883c7835cce

SHA1
1cea0ff7d9560e8cb70de983a0a7b780ebb832f9

SHA256
382f793703aa74ac96ca37b5088dae07b99c62de666d3243ffd055049ceeef55

SHA512
6839c011610078284419bc098139a1558aecaeda36df8bbcfe6da26d2948c2c424d986b29f8f7731ce0476bbe279051f725efc5331b9ca423b35cca8e71e857c

Download Submit
C:\Users\Admin\nqguon.exe

Filesize
124KB

MD5
e0dee5b858079ecc5b11e883c7835cce

SHA1
1cea0ff7d9560e8cb70de983a0a7b780ebb832f9

SHA256
382f793703aa74ac96ca37b5088dae07b99c62de666d3243ffd055049ceeef55

SHA512
6839c011610078284419bc098139a1558aecaeda36df8bbcfe6da26d2948c2c424d986b29f8f7731ce0476bbe279051f725efc5331b9ca423b35cca8e71e857c

Download Submit
C:\Users\Admin\puixe.exe

Filesize
124KB

MD5
3aff1d57d3b26be7851611bc75ca7701

SHA1
4c7ac8face5caf0263e3c860a5afe05d551eed8a

SHA256
f9259763fa7c3601f69b327b0f903ee62c8a35b6c29ae4a3901c9ce8f13b3c11

SHA512
0c5d484c7654a671d8c2a7b77fd7a04f6871c6e21c6b1e6aefd3d236814418aea04ee765f8f0f81f55687439cfc9c3b3532c26a8e74ba8993cb3100fef7e69a2

Download Submit
C:\Users\Admin\puixe.exe

Filesize
124KB

MD5
3aff1d57d3b26be7851611bc75ca7701

SHA1
4c7ac8face5caf0263e3c860a5afe05d551eed8a

SHA256
f9259763fa7c3601f69b327b0f903ee62c8a35b6c29ae4a3901c9ce8f13b3c11

SHA512
0c5d484c7654a671d8c2a7b77fd7a04f6871c6e21c6b1e6aefd3d236814418aea04ee765f8f0f81f55687439cfc9c3b3532c26a8e74ba8993cb3100fef7e69a2

Download Submit
C:\Users\Admin\wldez.exe

Filesize
124KB

MD5
9e292f6a119b12e8d9917f10c819ae3f

SHA1
d32fbc07efbc1e01081465c000317676892db2e5

SHA256
5fd8f3d78779c39eedcfce3f21b42a7a5467fcea103827bbfc18cfffa01e7c9b

SHA512
33077f25db701fd8a4253811cdf4c6b2765385594359aca62c53e859d7e0ce67108e78724691b2fc2bb54960f561a60d87b521d2d5b4759f92b058adf855567e

Download Submit
C:\Users\Admin\wldez.exe

Filesize
124KB

MD5
9e292f6a119b12e8d9917f10c819ae3f

SHA1
d32fbc07efbc1e01081465c000317676892db2e5

SHA256
5fd8f3d78779c39eedcfce3f21b42a7a5467fcea103827bbfc18cfffa01e7c9b

SHA512
33077f25db701fd8a4253811cdf4c6b2765385594359aca62c53e859d7e0ce67108e78724691b2fc2bb54960f561a60d87b521d2d5b4759f92b058adf855567e

Download Submit
C:\Users\Admin\yeonov.exe

Filesize
124KB

MD5
81c183e1510d584cdf37c12e4403344d

SHA1
12315c87d9c255370512487f833cc2dfb63808bc

SHA256
b3fd1249263fefc164f240e5f3d96d96facf04b67d8c1b2135413b050aa8651e

SHA512
b16ee24bb596a672185098fa9cf8edbb645f29f7f759b1a01ca0a63b8a379a1b3f4c51bfd20872175d48f367669e423df6b5f920ccfcb58d59729d037c7d96b9

Download Submit
C:\Users\Admin\yeonov.exe

Filesize
124KB

MD5
81c183e1510d584cdf37c12e4403344d

SHA1
12315c87d9c255370512487f833cc2dfb63808bc

SHA256
b3fd1249263fefc164f240e5f3d96d96facf04b67d8c1b2135413b050aa8651e

SHA512
b16ee24bb596a672185098fa9cf8edbb645f29f7f759b1a01ca0a63b8a379a1b3f4c51bfd20872175d48f367669e423df6b5f920ccfcb58d59729d037c7d96b9

Download Submit