c0dfa51657d72d26ab58594bca7fd35e6e41e57085436974efd4ffd25e4445b8

Resubmissions

31/10/2023, 07:12 UTC

231031-h1xr9shb9w 6

31/10/2023, 07:09 UTC

231031-hy68xsbc69 6

31/10/2023, 07:01 UTC

231031-htdqtabc49 6

Analysis

max time kernel
173s
max time network
170s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
31/10/2023, 07:12 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HideUL/HideUL.exe
Size

779KB
MD5

59e6919b61bcef4225d571e10fb13ef2
SHA1

c864cb1e389c51bdea6cecfed47162e6a03f1e22
SHA256

65ceb24e66bdac7453863bf268316bf6b6b17070ae1100713027c0be398e61f6
SHA512

c904007bd0989c6be41ce1afbbf05fa72d4f81a8b5a4e81e0fda11030e772d6a33c21fad0fe4e1faf97ec0611427a8c7aa6366d5920714e835ba80444f76d89c
SSDEEP

12288:daWzgMg7v3qnCiMErQohh0F4TCJ8lnyJQY4ZNGdiXJpp05iwQK:8aHMv6C4rjXnyJQRZYiA5kK

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs regedit.exe 2 IoCs

pid	Process
4896	regedit.exe
4504	regedit.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4252	HideUL.exe
4252	HideUL.exe
4252	HideUL.exe
4252	HideUL.exe
4252	HideUL.exe
4252	HideUL.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4252	HideUL.exe
4896	regedit.exe
4504	regedit.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4896	regedit.exe
4504	regedit.exe

C:\Users\Admin\AppData\Local\Temp\HideUL\HideUL.exe
"C:\Users\Admin\AppData\Local\Temp\HideUL\HideUL.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4252

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4896

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4504

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2356

Network

DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

1.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.173.189.20.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

1.173.189.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

1.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4252-7-0x0000000008190000-0x0000000008191000-memory.dmp

Filesize
4KB

Download