6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513

General

Target

6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
Size

104KB
MD5

17f8b3abe51a95bbcdc89c81a3236825
SHA1

a0966877fc07692fa72b85d12f92316ba55153f1
SHA256

6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513
SHA512

5cc2236974ee1ca1f94f278278ca36048a1025cdda96de293b5fe8a43036c0783121105c02173387c128490dfa69e1bcbb4fe1e4cd73d0f0c74bf7d03dbd600a
SSDEEP

1536:3ghvr9f5Wieh6hC3KwTHlyHcw1rqVjSxakAyBGss7oJd:whTldehWwTHlyHBQNSxZs7

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exevoebad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	voebad.exe

Executes dropped EXE 1 IoCs

Processes:

voebad.exe

pid process

268 voebad.exe

pid	process
268	voebad.exe

Loads dropped DLL 2 IoCs

Processes:

6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe

pid	process
1744	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
1744	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

voebad.exe6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /o"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /n"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /d"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /t"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /v"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /g"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /j"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /m"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /h"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /a"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /q"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /b"	voebad.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /j"	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /p"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /u"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /y"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /w"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /e"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /s"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /c"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /l"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /k"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /f"	voebad.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /i"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /x"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /r"	voebad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\voebad = "C:\\Users\\Admin\\voebad.exe /z"	voebad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exevoebad.exe

pid	process
1744	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe
268	voebad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exevoebad.exe

pid process

1744 6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
268 voebad.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe

description	pid	process	target process
PID 1744 wrote to memory of 268	1744	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe	voebad.exe
PID 1744 wrote to memory of 268	1744	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe	voebad.exe
PID 1744 wrote to memory of 268	1744	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe	voebad.exe
PID 1744 wrote to memory of 268	1744	6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe	voebad.exe

C:\Users\Admin\AppData\Local\Temp\6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe
"C:\Users\Admin\AppData\Local\Temp\6ed1bb8486b7248f3ef578dcd4c5696455d2bcdd1b3e5aaec2fab98d187cc513.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\voebad.exe
"C:\Users\Admin\voebad.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\voebad.exe
Filesize
104KB

MD5
7744db4a4191359e229136378ff02b18

SHA1
ef1fe6b013569772758e36b5c9cd1db360a4f79b

SHA256
09306b9e227367c771329decb668c291ab84b865ab85f9fb1667eba2fdc62ddf

SHA512
685823e71d4ffd96ba75ec29ebce8b89ac1d19693192e76069b675f71d036af5469450fa1518c8dd6934a8ab46b914091237e0fff735b93d6cbd726b62777e6b

Download Submit
C:\Users\Admin\voebad.exe
Filesize
104KB

MD5
7744db4a4191359e229136378ff02b18

SHA1
ef1fe6b013569772758e36b5c9cd1db360a4f79b

SHA256
09306b9e227367c771329decb668c291ab84b865ab85f9fb1667eba2fdc62ddf

SHA512
685823e71d4ffd96ba75ec29ebce8b89ac1d19693192e76069b675f71d036af5469450fa1518c8dd6934a8ab46b914091237e0fff735b93d6cbd726b62777e6b

Download Submit
\Users\Admin\voebad.exe
Filesize
104KB

MD5
7744db4a4191359e229136378ff02b18

SHA1
ef1fe6b013569772758e36b5c9cd1db360a4f79b

SHA256
09306b9e227367c771329decb668c291ab84b865ab85f9fb1667eba2fdc62ddf

SHA512
685823e71d4ffd96ba75ec29ebce8b89ac1d19693192e76069b675f71d036af5469450fa1518c8dd6934a8ab46b914091237e0fff735b93d6cbd726b62777e6b

Download Submit
\Users\Admin\voebad.exe
Filesize
104KB

MD5
7744db4a4191359e229136378ff02b18

SHA1
ef1fe6b013569772758e36b5c9cd1db360a4f79b

SHA256
09306b9e227367c771329decb668c291ab84b865ab85f9fb1667eba2fdc62ddf

SHA512
685823e71d4ffd96ba75ec29ebce8b89ac1d19693192e76069b675f71d036af5469450fa1518c8dd6934a8ab46b914091237e0fff735b93d6cbd726b62777e6b

Download Submit
memory/268-59-0x0000000000000000-mapping.dmp

Download
memory/1744-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads