cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801

Analysis

max time kernel
154s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe
Size

244KB
MD5

1170f916e6936acf12104d0d9cffe1a2
SHA1

ff0521f4d69f881b4fa02969a31566eedefa8395
SHA256

cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801
SHA512

e8194b5a8e74c631a9baa8c2aa3475511288eb456c5a715b7f8552546e17577e318cb86d4f0c5b140201274c4d9e7438ff4ad632cabcffd97c3baf54b0078354
SSDEEP

6144:O+Ba3zA0qjRc4KSxjcaqfZlIXQkFtI+aZWi0vE:bBoOtc4KSjcaqfZlSXnI+aZW0

Score

10^/10

evasion persistence spyware stealer upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cy70EmV6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	galez.exe

Executes dropped EXE 8 IoCs

pid	Process
2028	cy70EmV6.exe
1756	2kua.exe
2544	2kua.exe
1592	2kua.exe
2000	2kua.exe
116	2kua.exe
3740	3kua.exe
3564	galez.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2544-146-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2544-149-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1592-152-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/2544-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2000-158-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2000-162-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2000-164-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/1592-168-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/116-171-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/116-173-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2000-172-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2544-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/116-163-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/116-176-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1592-180-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/1592-181-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/2544-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1592-193-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cy70EmV6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /C"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /Z"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /E"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /r"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /p"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /F"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /Y"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /B"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /j"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /O"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /D"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /b"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /m"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /K"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /e"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /s"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /I"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /M"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /o"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /y"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /P"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /U"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /W"	cy70EmV6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /J"	galez.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cy70EmV6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /g"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /k"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /w"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /q"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /R"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /u"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /f"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /c"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /T"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /v"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /A"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /l"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /S"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /a"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /V"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /H"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /N"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /i"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /Q"	galez.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /G"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /z"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /W"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /L"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /t"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /h"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /n"	galez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\galez = "C:\\Users\\Admin\\galez.exe /d"	galez.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2kua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2kua.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 2544	1756	2kua.exe	82
PID 1756 set thread context of 1592	1756	2kua.exe	83
PID 1756 set thread context of 2000	1756	2kua.exe	84
PID 1756 set thread context of 116	1756	2kua.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3412	tasklist.exe
3992	tasklist.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	16	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	cy70EmV6.exe
2028	cy70EmV6.exe
1592	2kua.exe
1592	2kua.exe
1592	2kua.exe
1592	2kua.exe
2028	cy70EmV6.exe
2028	cy70EmV6.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe
3564	galez.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeDebugPrivilege	3412	tasklist.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe
2028	cy70EmV6.exe
1756	2kua.exe
2544	2kua.exe
2000	2kua.exe
116	2kua.exe
3564	galez.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2028	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	80
PID 4984 wrote to memory of 2028	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	80
PID 4984 wrote to memory of 2028	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	80
PID 4984 wrote to memory of 1756	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	81
PID 4984 wrote to memory of 1756	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	81
PID 4984 wrote to memory of 1756	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	81
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 2544	1756	2kua.exe	82
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 1592	1756	2kua.exe	83
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 2000	1756	2kua.exe	84
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 1756 wrote to memory of 116	1756	2kua.exe	85
PID 4984 wrote to memory of 3740	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	86
PID 4984 wrote to memory of 3740	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	86
PID 4984 wrote to memory of 3740	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	86
PID 4984 wrote to memory of 4632	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	87
PID 4984 wrote to memory of 4632	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	87
PID 4984 wrote to memory of 4632	4984	cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe	87
PID 2028 wrote to memory of 3564	2028	cy70EmV6.exe	88
PID 2028 wrote to memory of 3564	2028	cy70EmV6.exe	88
PID 2028 wrote to memory of 3564	2028	cy70EmV6.exe	88
PID 2028 wrote to memory of 1888	2028	cy70EmV6.exe	89
PID 2028 wrote to memory of 1888	2028	cy70EmV6.exe	89
PID 2028 wrote to memory of 1888	2028	cy70EmV6.exe	89
PID 1888 wrote to memory of 3412	1888	cmd.exe	92
PID 1888 wrote to memory of 3412	1888	cmd.exe	92
PID 1888 wrote to memory of 3412	1888	cmd.exe	92
PID 4632 wrote to memory of 3992	4632	cmd.exe	93
PID 4632 wrote to memory of 3992	4632	cmd.exe	93
PID 4632 wrote to memory of 3992	4632	cmd.exe	93
PID 3564 wrote to memory of 3992	3564	galez.exe	93
PID 3564 wrote to memory of 3992	3564	galez.exe	93
PID 3564 wrote to memory of 3412	3564	galez.exe	92
PID 3564 wrote to memory of 3412	3564	galez.exe	92
PID 3564 wrote to memory of 3992	3564	galez.exe	93
PID 3564 wrote to memory of 3992	3564	galez.exe	93
PID 3564 wrote to memory of 3412	3564	galez.exe	92
PID 3564 wrote to memory of 3412	3564	galez.exe	92

C:\Users\Admin\AppData\Local\Temp\cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe
"C:\Users\Admin\AppData\Local\Temp\cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\cy70EmV6.exe
  C:\Users\Admin\cy70EmV6.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\galez.exe
    "C:\Users\Admin\galez.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del cy70EmV6.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- C:\Users\Admin\2kua.exe
  C:\Users\Admin\2kua.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\2kua.exe
    "C:\Users\Admin\2kua.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2544
- - C:\Users\Admin\2kua.exe
    "C:\Users\Admin\2kua.exe"
    3⤵
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1592
- - C:\Users\Admin\2kua.exe
    "C:\Users\Admin\2kua.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
- - C:\Users\Admin\2kua.exe
    "C:\Users\Admin\2kua.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:116
- C:\Users\Admin\3kua.exe
  C:\Users\Admin\3kua.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del cb7f52cd207598d5a3a72e3f86d35c493f562ef4bf02368609667c0a4dd48801.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2kua.exe

Filesize
124KB

MD5
fc7b0b59d12bd90f35ad7039ad4ef0b3

SHA1
773ac4373e459930d59d8630f79657ba8e60ea9f

SHA256
a039610bd18552fc39b3c2b8f67deef6ab9635e951fbb28a905f3bd5b5fd10bc

SHA512
48c553c2fb8da4074830a3f06ac9b298aec8912223d5a44fd25f6b032c7ca05a9c14f4b3d0423648c330fa4b474480050c5fe97ed5414bbc493138b15921a8f9

Download Submit
C:\Users\Admin\2kua.exe

Filesize
124KB

MD5
fc7b0b59d12bd90f35ad7039ad4ef0b3

SHA1
773ac4373e459930d59d8630f79657ba8e60ea9f

SHA256
a039610bd18552fc39b3c2b8f67deef6ab9635e951fbb28a905f3bd5b5fd10bc

SHA512
48c553c2fb8da4074830a3f06ac9b298aec8912223d5a44fd25f6b032c7ca05a9c14f4b3d0423648c330fa4b474480050c5fe97ed5414bbc493138b15921a8f9

Download Submit
C:\Users\Admin\2kua.exe

Filesize
124KB

MD5
fc7b0b59d12bd90f35ad7039ad4ef0b3

SHA1
773ac4373e459930d59d8630f79657ba8e60ea9f

SHA256
a039610bd18552fc39b3c2b8f67deef6ab9635e951fbb28a905f3bd5b5fd10bc

SHA512
48c553c2fb8da4074830a3f06ac9b298aec8912223d5a44fd25f6b032c7ca05a9c14f4b3d0423648c330fa4b474480050c5fe97ed5414bbc493138b15921a8f9

Download Submit
C:\Users\Admin\2kua.exe

Filesize
124KB

MD5
fc7b0b59d12bd90f35ad7039ad4ef0b3

SHA1
773ac4373e459930d59d8630f79657ba8e60ea9f

SHA256
a039610bd18552fc39b3c2b8f67deef6ab9635e951fbb28a905f3bd5b5fd10bc

SHA512
48c553c2fb8da4074830a3f06ac9b298aec8912223d5a44fd25f6b032c7ca05a9c14f4b3d0423648c330fa4b474480050c5fe97ed5414bbc493138b15921a8f9

Download Submit
C:\Users\Admin\2kua.exe

Filesize
124KB

MD5
fc7b0b59d12bd90f35ad7039ad4ef0b3

SHA1
773ac4373e459930d59d8630f79657ba8e60ea9f

SHA256
a039610bd18552fc39b3c2b8f67deef6ab9635e951fbb28a905f3bd5b5fd10bc

SHA512
48c553c2fb8da4074830a3f06ac9b298aec8912223d5a44fd25f6b032c7ca05a9c14f4b3d0423648c330fa4b474480050c5fe97ed5414bbc493138b15921a8f9

Download Submit
C:\Users\Admin\2kua.exe

Filesize
124KB

MD5
fc7b0b59d12bd90f35ad7039ad4ef0b3

SHA1
773ac4373e459930d59d8630f79657ba8e60ea9f

SHA256
a039610bd18552fc39b3c2b8f67deef6ab9635e951fbb28a905f3bd5b5fd10bc

SHA512
48c553c2fb8da4074830a3f06ac9b298aec8912223d5a44fd25f6b032c7ca05a9c14f4b3d0423648c330fa4b474480050c5fe97ed5414bbc493138b15921a8f9

Download Submit
C:\Users\Admin\3kua.exe

Filesize
39KB

MD5
2e7ffefb1aa2f3cfd394886b4d825206

SHA1
c09401b54ec9eb82e6f931e117f218c0dbba2d11

SHA256
d21884af92a77968b379be4d50d37dbcf13212aba989a1fae1737e0f6823719f

SHA512
814ef71d67bd243faec482ce0696363fe1bc129d0b11cecddf97d1dc7bb9c222eca2cf72814916167552baf1ea1ae460e5ae071f4f292a2de4fe94e49b154ef4

Download Submit
C:\Users\Admin\3kua.exe

Filesize
39KB

MD5
2e7ffefb1aa2f3cfd394886b4d825206

SHA1
c09401b54ec9eb82e6f931e117f218c0dbba2d11

SHA256
d21884af92a77968b379be4d50d37dbcf13212aba989a1fae1737e0f6823719f

SHA512
814ef71d67bd243faec482ce0696363fe1bc129d0b11cecddf97d1dc7bb9c222eca2cf72814916167552baf1ea1ae460e5ae071f4f292a2de4fe94e49b154ef4

Download Submit
C:\Users\Admin\cy70EmV6.exe

Filesize
156KB

MD5
fd068f54698e065d71d97c0409ce76ec

SHA1
22b502115bbd5a12002d2046a57618535ef0d386

SHA256
e875c6efd68018cae15a5046d24eaccc86b4be7b741e75863f2f365914824f46

SHA512
da9ef7ef7b9a9ae05b159468614349f8df8d075fc125c384bace44fdd6cdc8436bcf2644517f9d340a30151d707471f0c4d987ce0cb2420cd9c68a9dcdbd5853

Download Submit
C:\Users\Admin\cy70EmV6.exe

Filesize
156KB

MD5
fd068f54698e065d71d97c0409ce76ec

SHA1
22b502115bbd5a12002d2046a57618535ef0d386

SHA256
e875c6efd68018cae15a5046d24eaccc86b4be7b741e75863f2f365914824f46

SHA512
da9ef7ef7b9a9ae05b159468614349f8df8d075fc125c384bace44fdd6cdc8436bcf2644517f9d340a30151d707471f0c4d987ce0cb2420cd9c68a9dcdbd5853

Download Submit
C:\Users\Admin\galez.exe

Filesize
156KB

MD5
7d58b7dbcb866127bccdc453757939b1

SHA1
f0a96066b7c560cac7d6dd4549a3abffc58fa75d

SHA256
687d273445cb86e56228979d29d4dabdd1dea92cb1ca3908f093535a56d1d3fd

SHA512
5624170a9d39d435a7e17f51e8c110ec2391c55b65f094679dda884f232f3475ad0036910a6e4fbc7a1c29079ea20ad1e0821052ce5cf8d08384ce0373aa2860

Download Submit
C:\Users\Admin\galez.exe

Filesize
156KB

MD5
7d58b7dbcb866127bccdc453757939b1

SHA1
f0a96066b7c560cac7d6dd4549a3abffc58fa75d

SHA256
687d273445cb86e56228979d29d4dabdd1dea92cb1ca3908f093535a56d1d3fd

SHA512
5624170a9d39d435a7e17f51e8c110ec2391c55b65f094679dda884f232f3475ad0036910a6e4fbc7a1c29079ea20ad1e0821052ce5cf8d08384ce0373aa2860

Download Submit
memory/116-176-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/116-163-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/116-173-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/116-171-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1592-168-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1592-180-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1592-181-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1592-152-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1592-193-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2000-172-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2000-164-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2000-162-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2000-158-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2544-146-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2544-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2544-149-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2544-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2544-151-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4984-190-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4984-132-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download