00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b

General

Target

00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
Size

52KB
MD5

273474a0820a72479695a7d024ee4970
SHA1

aeebd3c4f4c78c972c99f78938cffbab971aa497
SHA256

00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b
SHA512

9e7ba5b9d4c341a20c15a872857acdc3ccc31bc65038e146390474b422df12a0f49c6825dfe66fcfe4d67cbf7b656132b862184e04d943d41229165abb6a94a2
SSDEEP

768:neWnCwgRni/y1jskr/v/m89S3rkC6R+wibw52TzpUH:neBi/yNskr3mbkC6R+XpUH

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

zoubo.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zoubo.exe

Executes dropped EXE 1 IoCs

Processes:

zoubo.exe

pid process

912 zoubo.exe

Loads dropped DLL 2 IoCs

Processes:

00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe

pid	process
540	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
540	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zoubo.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoubo = "C:\\Users\\Admin\\zoubo.exe"	zoubo.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	zoubo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

zoubo.exe

pid	process
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe
912	zoubo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exezoubo.exe

pid process

540 00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
912 zoubo.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exezoubo.exe

description	pid	process	target process
PID 540 wrote to memory of 912	540	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe	zoubo.exe
PID 540 wrote to memory of 912	540	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe	zoubo.exe
PID 540 wrote to memory of 912	540	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe	zoubo.exe
PID 540 wrote to memory of 912	540	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe	zoubo.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
PID 912 wrote to memory of 540	912	zoubo.exe	00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe

C:\Users\Admin\AppData\Local\Temp\00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe
"C:\Users\Admin\AppData\Local\Temp\00f351d0787b87d91227fa125fc2a736698cd40082a6638c22218923eba0219b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\zoubo.exe
"C:\Users\Admin\zoubo.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zoubo.exe

Filesize
52KB

MD5
026e011feba2eb418e8c5a3bda2b4a2c

SHA1
9faf12777df5cf9a93f429d43e62ac4da2b3600a

SHA256
5d3767865e4f844fb6d0af8076a3e749571609161478a1b6928390731f07a50d

SHA512
e6160b72ec530e35ac9d943a1baeae3cad87a10e40a4be9169ab30363543495dafc7a7010989047c22f4a2a4ec0950d7888224fe0be5082bc4097d9fc47bec87

Download Submit
C:\Users\Admin\zoubo.exe

Filesize
52KB

MD5
026e011feba2eb418e8c5a3bda2b4a2c

SHA1
9faf12777df5cf9a93f429d43e62ac4da2b3600a

SHA256
5d3767865e4f844fb6d0af8076a3e749571609161478a1b6928390731f07a50d

SHA512
e6160b72ec530e35ac9d943a1baeae3cad87a10e40a4be9169ab30363543495dafc7a7010989047c22f4a2a4ec0950d7888224fe0be5082bc4097d9fc47bec87

Download Submit
\Users\Admin\zoubo.exe

Filesize
52KB

MD5
026e011feba2eb418e8c5a3bda2b4a2c

SHA1
9faf12777df5cf9a93f429d43e62ac4da2b3600a

SHA256
5d3767865e4f844fb6d0af8076a3e749571609161478a1b6928390731f07a50d

SHA512
e6160b72ec530e35ac9d943a1baeae3cad87a10e40a4be9169ab30363543495dafc7a7010989047c22f4a2a4ec0950d7888224fe0be5082bc4097d9fc47bec87

Download Submit
\Users\Admin\zoubo.exe

Filesize
52KB

MD5
026e011feba2eb418e8c5a3bda2b4a2c

SHA1
9faf12777df5cf9a93f429d43e62ac4da2b3600a

SHA256
5d3767865e4f844fb6d0af8076a3e749571609161478a1b6928390731f07a50d

SHA512
e6160b72ec530e35ac9d943a1baeae3cad87a10e40a4be9169ab30363543495dafc7a7010989047c22f4a2a4ec0950d7888224fe0be5082bc4097d9fc47bec87

Download Submit
memory/540-56-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/912-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads