f246fd21e462a9c527f9cc04ec75941b9f31558fbfc822216cc87d7566fb6c30

General

Target

2870d3773791c6f86e22e8dace82cebe.exe
Size

252KB
MD5

2870d3773791c6f86e22e8dace82cebe
SHA1

9778aa5cf37472caa7d5f917dfb096e5de046669
SHA256

f246fd21e462a9c527f9cc04ec75941b9f31558fbfc822216cc87d7566fb6c30
SHA512

8884c6811812ee10160700d9adcb030c337e25cd502a40fc9e4c8aeb514160a5c098f4083a2c2a3429a1899b159363845fb676555c1f581964eb8fd66fc15416
SSDEEP

6144:x+AMYVyrimEU/EztV++Jbtd4lfn8hFXbTom85FMnH:xNzArimr/EztV++JZd4lfnSTo7F

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fdqaih.exe

Executes dropped EXE 1 IoCs

pid	Process
2376	fdqaih.exe

Loads dropped DLL 2 IoCs

pid	Process
2616	2870d3773791c6f86e22e8dace82cebe.exe
2616	2870d3773791c6f86e22e8dace82cebe.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /u"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /X"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /b"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /w"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /V"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /Y"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /E"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /a"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /m"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /n"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /c"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /Q"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /U"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /F"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /h"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /q"	fdqaih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdqaih = "C:\\Users\\Admin\\fdqaih.exe /o"	fdqaih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe
2376	fdqaih.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2616	2870d3773791c6f86e22e8dace82cebe.exe
2376	fdqaih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2376	2616	2870d3773791c6f86e22e8dace82cebe.exe	28
PID 2616 wrote to memory of 2376	2616	2870d3773791c6f86e22e8dace82cebe.exe	28
PID 2616 wrote to memory of 2376	2616	2870d3773791c6f86e22e8dace82cebe.exe	28
PID 2616 wrote to memory of 2376	2616	2870d3773791c6f86e22e8dace82cebe.exe	28

C:\Users\Admin\AppData\Local\Temp\2870d3773791c6f86e22e8dace82cebe.exe
"C:\Users\Admin\AppData\Local\Temp\2870d3773791c6f86e22e8dace82cebe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\fdqaih.exe
  "C:\Users\Admin\fdqaih.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2376