dbb73037b7ba573b01edf32cf5dfbf2e4b25078230b0381f884735332f696ace

General

Target

75106d3492cbb864b5814dadb0709fdf.exe
Size

204KB
MD5

75106d3492cbb864b5814dadb0709fdf
SHA1

39f5f03c443fed76838e883c93edce3a7d35be8b
SHA256

dbb73037b7ba573b01edf32cf5dfbf2e4b25078230b0381f884735332f696ace
SHA512

f8c03c7a9ac9612f30d52321c2111616ca9a078a71b070e5f035319983b8c1ac1d0abe8814c8ead9affae9725a23b78184d85f7a0cb785e2d582aeeaf85f0b98
SSDEEP

6144:ksVZi/cZrSlO3OW80Nr0SkA6XLeLGvUjouMdDrC:ksjccVSlW80N4SkA6yKUjouM1rC

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

geofum.exe75106d3492cbb864b5814dadb0709fdf.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	geofum.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	75106d3492cbb864b5814dadb0709fdf.exe

Executes dropped EXE 1 IoCs

Processes:

geofum.exe

pid process

1220 geofum.exe
Loads dropped DLL 2 IoCs

Processes:

75106d3492cbb864b5814dadb0709fdf.exe

pid process

1228 75106d3492cbb864b5814dadb0709fdf.exe
1228 75106d3492cbb864b5814dadb0709fdf.exe

pid	process
1220	geofum.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

geofum.exe75106d3492cbb864b5814dadb0709fdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /U"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /b"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /Z"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /E"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /h"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /X"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /M"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /s"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /T"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /J"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /u"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /c"	75106d3492cbb864b5814dadb0709fdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /t"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /v"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /c"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /N"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /k"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /q"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /S"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /j"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /C"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /F"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /O"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /y"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /W"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /r"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /P"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /D"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /G"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /Q"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /l"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /w"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /p"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /Y"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /g"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /n"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /H"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /o"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /a"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /R"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /V"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /f"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /z"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /K"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /d"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /x"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /i"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /I"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /A"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /e"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /L"	geofum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\geofum = "C:\\Users\\Admin\\geofum.exe /B"	geofum.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

75106d3492cbb864b5814dadb0709fdf.exegeofum.exe

pid	process
1228	75106d3492cbb864b5814dadb0709fdf.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe
1220	geofum.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

75106d3492cbb864b5814dadb0709fdf.exegeofum.exe

pid process

1228 75106d3492cbb864b5814dadb0709fdf.exe
1220 geofum.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

75106d3492cbb864b5814dadb0709fdf.exe

description	pid	process	target process
PID 1228 wrote to memory of 1220	1228	75106d3492cbb864b5814dadb0709fdf.exe	geofum.exe
PID 1228 wrote to memory of 1220	1228	75106d3492cbb864b5814dadb0709fdf.exe	geofum.exe
PID 1228 wrote to memory of 1220	1228	75106d3492cbb864b5814dadb0709fdf.exe	geofum.exe
PID 1228 wrote to memory of 1220	1228	75106d3492cbb864b5814dadb0709fdf.exe	geofum.exe

C:\Users\Admin\AppData\Local\Temp\75106d3492cbb864b5814dadb0709fdf.exe
"C:\Users\Admin\AppData\Local\Temp\75106d3492cbb864b5814dadb0709fdf.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\geofum.exe
"C:\Users\Admin\geofum.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\geofum.exe
Filesize
204KB

MD5
750c72d99d9d2f50abb333fecaae5740

SHA1
eb8bd3a8d86d41c432bdd5c353c4505d0c49a0c0

SHA256
e6d1a6c5e6bbe5b0f7be588cf12ad99300d72919dca57cebd42336d66ae411fd

SHA512
4afaa739fef98396c37703b7bedbe270a65cb4076a72598722d09cc734d17bd6a2368bfd0eeb5ca3ceab065b251b26b954265218eb3eb9a0a1843215c97801ce

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads