Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 14:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a1dc512902a527b3b468d7ea478464a.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a1dc512902a527b3b468d7ea478464a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3a1dc512902a527b3b468d7ea478464a.exe
-
Size
256KB
-
MD5
3a1dc512902a527b3b468d7ea478464a
-
SHA1
25f385821fb5d7372fe7c38253ac6a81d9be10ab
-
SHA256
d0f3366b954946e7fbc6b3e0101191795e7a43edd1975176e02522fccc611a4a
-
SHA512
dbad9a157534da7b52532f42d6520c9bd1d4e63c6a8dbf8243a18d3567c5ea78bd621e884309690e235da15c280c92160baa3f98f416e927a6cba00822af538d
-
SSDEEP
3072:Jco01tDwd5B2iAhSQ7QkRlye1k2kE00o3yCeJbnpH0w922UP87coVEUHG5HzCo/7:J10jDw9Cb7QkRli2D9UyEUmNzTiW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xeesuf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 3a1dc512902a527b3b468d7ea478464a.exe -
Executes dropped EXE 1 IoCs
pid Process 3752 xeesuf.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /t" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /Y" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /l" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /K" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /v" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /V" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /e" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /L" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /x" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /q" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /c" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /o" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /I" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /m" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /p" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /N" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /g" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /f" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /u" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /E" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /r" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /J" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /X" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /a" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /n" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /T" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /j" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /b" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /d" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /F" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /W" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /S" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /P" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /B" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /H" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /D" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /y" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /h" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /w" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /R" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /A" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /Q" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /z" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /i" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /O" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /k" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /M" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /U" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /C" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /G" xeesuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeesuf = "C:\\Users\\Admin\\xeesuf.exe /Z" xeesuf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe 3752 xeesuf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1752 3a1dc512902a527b3b468d7ea478464a.exe 3752 xeesuf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3752 1752 3a1dc512902a527b3b468d7ea478464a.exe 92 PID 1752 wrote to memory of 3752 1752 3a1dc512902a527b3b468d7ea478464a.exe 92 PID 1752 wrote to memory of 3752 1752 3a1dc512902a527b3b468d7ea478464a.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a1dc512902a527b3b468d7ea478464a.exe"C:\Users\Admin\AppData\Local\Temp\3a1dc512902a527b3b468d7ea478464a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\xeesuf.exe"C:\Users\Admin\xeesuf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5e4510ff4e4a708c2135561d1d122ee73
SHA189c0c25e3aad7bdea90e8a3789d2bfa2f41f0283
SHA256889f8c3f3a3a5ac879b175df2eb6797909a74527313863cac4f031fe579690a9
SHA512f14484a7301ce1721b477baac9758d86c2207c204a494021c0bbf81d25296b873de2ff9c85c1570dd500b54e480f99532ee9250e51160de3141609f67923e570