653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1

General

Target

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
Size

196KB
MD5

73273afd126cdd8d7da6ce164cb752de
SHA1

c0ea751f6685e79e11c01155d23679bd6764e097
SHA256

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1
SHA512

0dc694dea1a5ec2c10c25b29c2a2a671d385028c7d789511bce6e2fecb0d0d97d05c2b53fb4b60fef25d34266538b9d605120e95f0148d490115d46f640cb4ab
SSDEEP

1536:PVqk3NNb/g/rOaZk1GDGe0Pdb+d6DiUYot00gw3:04bo/xzDDypy6DiUru0gE

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

nhyet.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nhyet.exe

Executes dropped EXE 1 IoCs

Processes:

nhyet.exe

pid process

2136 nhyet.exe

Loads dropped DLL 2 IoCs

Processes:

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe

pid	process
2240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
2240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nhyet.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /e"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /z"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /D"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /F"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /l"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /H"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /b"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /n"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /A"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /W"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /d"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /N"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /t"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /u"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /B"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /h"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /v"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /C"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /R"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /I"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /s"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /Q"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /Y"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /j"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /r"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /p"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /g"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /i"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /q"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /U"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /m"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /V"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /S"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /w"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /a"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /X"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /T"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /Z"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /L"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /E"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /f"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /M"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /O"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /G"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /x"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /J"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /c"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /K"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /o"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /P"	nhyet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nhyet = "C:\\Users\\Admin\\nhyet.exe /y"	nhyet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

nhyet.exe

pid	process
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe
2136	nhyet.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exenhyet.exe

pid process

2240 653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
2136 nhyet.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exenhyet.exe

description	pid	process	target process
PID 2240 wrote to memory of 2136	2240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe	nhyet.exe
PID 2240 wrote to memory of 2136	2240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe	nhyet.exe
PID 2240 wrote to memory of 2136	2240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe	nhyet.exe
PID 2240 wrote to memory of 2136	2240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe	nhyet.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2136 wrote to memory of 2240	2136	nhyet.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe

C:\Users\Admin\AppData\Local\Temp\653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
"C:\Users\Admin\AppData\Local\Temp\653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\nhyet.exe
"C:\Users\Admin\nhyet.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\nhyet.exe
Filesize
196KB

MD5
be931062d14c2312ba0dd78d89aaea4d

SHA1
948b4ba9f7b6202e7338ac4ce75a2835f9dca68b

SHA256
3e84b20fdfbe388ce63b4ab33bc9107ea2b530e04bcd0cfa790caa2976675f9c

SHA512
933acd75416094a247a2885ead769c994bb44389afd1c052fb59473c08b5a1f842c9a12d17f3d0658db978351e825a2283115962f50866a5ae56c872f2b71b77

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads