Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2023, 10:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0eb3f9c332f7e328079f8f5de24e2238.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0eb3f9c332f7e328079f8f5de24e2238.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0eb3f9c332f7e328079f8f5de24e2238.exe
-
Size
92KB
-
MD5
0eb3f9c332f7e328079f8f5de24e2238
-
SHA1
ead9fa814e763c2aaf6d483e4add7d0ceea0dfa1
-
SHA256
52907550f36ed886f95bb618db4de7a5aa8e089137584b61cd9b9e0e77a7cf63
-
SHA512
93c2cd0566f3be3a4d5aff066a72015624b6521b47c9b1d21053b0881ecf014f407bf3a8f13af642bd07a4aa34bd6b9f58ca26074bbd1b65fff51fe9bdc9891c
-
SSDEEP
1536:6ZsnJOr0FEJ6kri7hwj4Pnv/rvyvJvSvbvfv3yPHp0Pa:4sJOrW1mmyPOy
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ducob.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 0eb3f9c332f7e328079f8f5de24e2238.exe -
Executes dropped EXE 1 IoCs
pid Process 1968 ducob.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /c" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /j" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /L" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /V" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /z" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /Z" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /U" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /n" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /r" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /Q" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /O" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /f" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /I" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /e" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /N" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /b" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /i" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /o" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /w" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /p" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /x" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /W" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /B" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /X" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /v" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /q" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /J" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /P" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /G" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /R" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /D" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /S" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /K" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /m" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /t" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /d" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /H" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /Y" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /M" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /y" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /T" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /a" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /A" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /u" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /k" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /h" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /C" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /g" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /s" ducob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ducob = "C:\\Users\\Admin\\ducob.exe /E" ducob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe 1968 ducob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5080 0eb3f9c332f7e328079f8f5de24e2238.exe 1968 ducob.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1968 5080 0eb3f9c332f7e328079f8f5de24e2238.exe 90 PID 5080 wrote to memory of 1968 5080 0eb3f9c332f7e328079f8f5de24e2238.exe 90 PID 5080 wrote to memory of 1968 5080 0eb3f9c332f7e328079f8f5de24e2238.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eb3f9c332f7e328079f8f5de24e2238.exe"C:\Users\Admin\AppData\Local\Temp\0eb3f9c332f7e328079f8f5de24e2238.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\ducob.exe"C:\Users\Admin\ducob.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5e433208b26a6e846f9797ae4fae21aab
SHA1e1479be34190a2aa94a3b85ec7d90c226a351605
SHA256455ac6ad657532572fe3d9d1ab8b00a9a06ef855b227ef9e0b7a2cd6ffc88a6d
SHA512d33ca92b09faa38102a2f51badd56ae0500ae5bef74d87b292b2326c8c2d9a6f5cfa536159d143a716eb57206cc17e655d84b41299bbfa6d6707fc4d151ee085