Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 16:32
Static task
static1
Behavioral task
behavioral1
Sample
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe
Resource
win10v2004-20220812-en
General
-
Target
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe
-
Size
579KB
-
MD5
80b8e1ea0247de9050d306969f85681a
-
SHA1
bce265a1c011316a4b4423472c118ff82d057cc1
-
SHA256
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334
-
SHA512
57b2ed0a009b80fdd21b7cc48b802e3bbb4fb8dbbdf9f8e083521919d8c6a68b6fe9d1f394851e8c872a0cdb99a1852cab2e046027504868690651f8f76f0ab6
-
SSDEEP
6144:6Z1YYjDZwI/MPNPE4Q0HiHgy7EB8B/r5vIlHgNiUoT1HbBX2QGeaWUHVafe0c:K1YOMtE4Q0ugy7EB8lAuinTXXmdj
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ekeg.exeekeg.exepid process 5024 ekeg.exe 4952 ekeg.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ekeg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\Currentversion\Run ekeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Arcao = "C:\\Users\\Admin\\AppData\\Roaming\\Cuzode\\ekeg.exe" ekeg.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\Currentversion\Run ekeg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exeekeg.exedescription pid process target process PID 1664 set thread context of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 5024 set thread context of 4952 5024 ekeg.exe ekeg.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
ekeg.exepid process 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe 4952 ekeg.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exedescription pid process Token: SeSecurityPrivilege 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe Token: SeSecurityPrivilege 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exeekeg.exepid process 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 5024 ekeg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exeekeg.exeekeg.exedescription pid process target process PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 1664 wrote to memory of 3336 1664 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe PID 3336 wrote to memory of 5024 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe ekeg.exe PID 3336 wrote to memory of 5024 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe ekeg.exe PID 3336 wrote to memory of 5024 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 5024 wrote to memory of 4952 5024 ekeg.exe ekeg.exe PID 3336 wrote to memory of 2820 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe cmd.exe PID 3336 wrote to memory of 2820 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe cmd.exe PID 3336 wrote to memory of 2820 3336 225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe cmd.exe PID 4952 wrote to memory of 2760 4952 ekeg.exe sihost.exe PID 4952 wrote to memory of 2760 4952 ekeg.exe sihost.exe PID 4952 wrote to memory of 2760 4952 ekeg.exe sihost.exe PID 4952 wrote to memory of 2760 4952 ekeg.exe sihost.exe PID 4952 wrote to memory of 2760 4952 ekeg.exe sihost.exe PID 4952 wrote to memory of 2768 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 2768 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 2768 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 2768 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 2768 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 2872 4952 ekeg.exe taskhostw.exe PID 4952 wrote to memory of 2872 4952 ekeg.exe taskhostw.exe PID 4952 wrote to memory of 2872 4952 ekeg.exe taskhostw.exe PID 4952 wrote to memory of 2872 4952 ekeg.exe taskhostw.exe PID 4952 wrote to memory of 2872 4952 ekeg.exe taskhostw.exe PID 4952 wrote to memory of 676 4952 ekeg.exe Explorer.EXE PID 4952 wrote to memory of 676 4952 ekeg.exe Explorer.EXE PID 4952 wrote to memory of 676 4952 ekeg.exe Explorer.EXE PID 4952 wrote to memory of 676 4952 ekeg.exe Explorer.EXE PID 4952 wrote to memory of 676 4952 ekeg.exe Explorer.EXE PID 4952 wrote to memory of 3096 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 3096 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 3096 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 3096 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 3096 4952 ekeg.exe svchost.exe PID 4952 wrote to memory of 3304 4952 ekeg.exe DllHost.exe PID 4952 wrote to memory of 3304 4952 ekeg.exe DllHost.exe PID 4952 wrote to memory of 3304 4952 ekeg.exe DllHost.exe PID 4952 wrote to memory of 3304 4952 ekeg.exe DllHost.exe PID 4952 wrote to memory of 3304 4952 ekeg.exe DllHost.exe PID 4952 wrote to memory of 3404 4952 ekeg.exe StartMenuExperienceHost.exe PID 4952 wrote to memory of 3404 4952 ekeg.exe StartMenuExperienceHost.exe PID 4952 wrote to memory of 3404 4952 ekeg.exe StartMenuExperienceHost.exe PID 4952 wrote to memory of 3404 4952 ekeg.exe StartMenuExperienceHost.exe PID 4952 wrote to memory of 3404 4952 ekeg.exe StartMenuExperienceHost.exe PID 4952 wrote to memory of 3472 4952 ekeg.exe RuntimeBroker.exe PID 4952 wrote to memory of 3472 4952 ekeg.exe RuntimeBroker.exe PID 4952 wrote to memory of 3472 4952 ekeg.exe RuntimeBroker.exe PID 4952 wrote to memory of 3472 4952 ekeg.exe RuntimeBroker.exe PID 4952 wrote to memory of 3472 4952 ekeg.exe RuntimeBroker.exe PID 4952 wrote to memory of 3564 4952 ekeg.exe SearchApp.exe PID 4952 wrote to memory of 3564 4952 ekeg.exe SearchApp.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe"C:\Users\Admin\AppData\Local\Temp\225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe"C:\Users\Admin\AppData\Local\Temp\225589564f0a0f468c9341860348c074522baf69d2dbb1ce6d0fa137f369f334.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Cuzode\ekeg.exe"C:\Users\Admin\AppData\Roaming\Cuzode\ekeg.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Cuzode\ekeg.exe"C:\Users\Admin\AppData\Roaming\Cuzode\ekeg.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp252f0163.bat"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp252f0163.batFilesize
307B
MD5d19a1cf54861e06f7f1205a866593c18
SHA153941a53210242840a85884b45f7d56a4684035f
SHA2562636fba555f1b9cd4480f631aa821aed3595b3c08cdeee026a773a9f14fb91ac
SHA5128bd3cf9b0526c3f83402d119e6dc80adc64701682b4f9873426ec463e875fed548bf8b465c3b332d35bdd9ab82d4eacf883fc5b39f963c4593f94ae4bc482a58
-
C:\Users\Admin\AppData\Roaming\Cuzode\ekeg.exeFilesize
579KB
MD56806ca064a9c1ae89033c6faec43ab2d
SHA134491bb0c83ccafe3bedfc7ea384f4c1c3e9657d
SHA2560f3d71f17ba0ec08df3b3c570ea5412a2d234a7a9d9ca38d0e7dec1020d2ab37
SHA512e13e5b5bc92b5e810c73d51f2fb7d8d5e8d812ec4bcec60fe9452f48545961a686ae74d884aa088848b59a2e708fca6e41cdf49c94f2a611550d41b71847bad6
-
C:\Users\Admin\AppData\Roaming\Cuzode\ekeg.exeFilesize
579KB
MD56806ca064a9c1ae89033c6faec43ab2d
SHA134491bb0c83ccafe3bedfc7ea384f4c1c3e9657d
SHA2560f3d71f17ba0ec08df3b3c570ea5412a2d234a7a9d9ca38d0e7dec1020d2ab37
SHA512e13e5b5bc92b5e810c73d51f2fb7d8d5e8d812ec4bcec60fe9452f48545961a686ae74d884aa088848b59a2e708fca6e41cdf49c94f2a611550d41b71847bad6
-
C:\Users\Admin\AppData\Roaming\Cuzode\ekeg.exeFilesize
579KB
MD56806ca064a9c1ae89033c6faec43ab2d
SHA134491bb0c83ccafe3bedfc7ea384f4c1c3e9657d
SHA2560f3d71f17ba0ec08df3b3c570ea5412a2d234a7a9d9ca38d0e7dec1020d2ab37
SHA512e13e5b5bc92b5e810c73d51f2fb7d8d5e8d812ec4bcec60fe9452f48545961a686ae74d884aa088848b59a2e708fca6e41cdf49c94f2a611550d41b71847bad6
-
memory/2820-150-0x0000000000590000-0x00000000005CB000-memory.dmpFilesize
236KB
-
memory/2820-147-0x0000000000000000-mapping.dmp
-
memory/3336-135-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/3336-137-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/3336-134-0x0000000000000000-mapping.dmp
-
memory/3336-148-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4952-143-0x0000000000000000-mapping.dmp
-
memory/4952-151-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4952-152-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/5024-138-0x0000000000000000-mapping.dmp