1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59

General

Target

1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
Size

220KB
MD5

1d97e20c6e5c52c23aacb8292477e78b
SHA1

462c68637084abee678ccc07cce1a844fde80e4c
SHA256

1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59
SHA512

f1cb7e7bf3e45065c2eeee8f65af3b42d8c314e90485c562506b105a81e04029c588a541466297684e9050e206294bbb69931dc14417a784b361991ef41474c8
SSDEEP

3072:ZPsU8/qsNs3Ctl85gVzaSCzRTG2KAikGFyga1IJ+WJv:ZBuqqsCtWgzsmhUSJD

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exeqoeguz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qoeguz.exe

Executes dropped EXE 1 IoCs

Processes:

qoeguz.exe

pid process

1472 qoeguz.exe

pid	process
1472	qoeguz.exe

Loads dropped DLL 2 IoCs

Processes:

1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe

pid	process
972	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
972	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

qoeguz.exe1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /u"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /i"	qoeguz.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /q"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /n"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /a"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /e"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /v"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /f"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /x"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /k"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /d"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /t"	qoeguz.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /c"	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /h"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /b"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /y"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /m"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /g"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /s"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /c"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /z"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /w"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /p"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /l"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /r"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /o"	qoeguz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\qoeguz = "C:\\Users\\Admin\\qoeguz.exe /j"	qoeguz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exeqoeguz.exe

pid	process
972	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe
1472	qoeguz.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exeqoeguz.exe

pid process

972 1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
1472 qoeguz.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe

description	pid	process	target process
PID 972 wrote to memory of 1472	972	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe	qoeguz.exe
PID 972 wrote to memory of 1472	972	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe	qoeguz.exe
PID 972 wrote to memory of 1472	972	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe	qoeguz.exe
PID 972 wrote to memory of 1472	972	1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe	qoeguz.exe

C:\Users\Admin\AppData\Local\Temp\1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe
"C:\Users\Admin\AppData\Local\Temp\1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\qoeguz.exe
"C:\Users\Admin\qoeguz.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\qoeguz.exe

Filesize
220KB

MD5
1d97e20c6e5c52c23aacb8292477e78b

SHA1
462c68637084abee678ccc07cce1a844fde80e4c

SHA256
1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59

SHA512
f1cb7e7bf3e45065c2eeee8f65af3b42d8c314e90485c562506b105a81e04029c588a541466297684e9050e206294bbb69931dc14417a784b361991ef41474c8

Download Submit
C:\Users\Admin\qoeguz.exe

Filesize
220KB

MD5
1d97e20c6e5c52c23aacb8292477e78b

SHA1
462c68637084abee678ccc07cce1a844fde80e4c

SHA256
1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59

SHA512
f1cb7e7bf3e45065c2eeee8f65af3b42d8c314e90485c562506b105a81e04029c588a541466297684e9050e206294bbb69931dc14417a784b361991ef41474c8

Download Submit
\Users\Admin\qoeguz.exe

Filesize
220KB

MD5
1d97e20c6e5c52c23aacb8292477e78b

SHA1
462c68637084abee678ccc07cce1a844fde80e4c

SHA256
1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59

SHA512
f1cb7e7bf3e45065c2eeee8f65af3b42d8c314e90485c562506b105a81e04029c588a541466297684e9050e206294bbb69931dc14417a784b361991ef41474c8

Download Submit
\Users\Admin\qoeguz.exe

Filesize
220KB

MD5
1d97e20c6e5c52c23aacb8292477e78b

SHA1
462c68637084abee678ccc07cce1a844fde80e4c

SHA256
1365aad1fd3ca5269a2c1018186504f5773d2d39c20c6130bdd90e12f1048d59

SHA512
f1cb7e7bf3e45065c2eeee8f65af3b42d8c314e90485c562506b105a81e04029c588a541466297684e9050e206294bbb69931dc14417a784b361991ef41474c8

Download Submit
memory/972-56-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download
memory/972-65-0x0000000073D61000-0x0000000073D63000-memory.dmp

Filesize
8KB

Download
memory/1472-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads