dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59

General

Target

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
Size

156KB
MD5

cf1e22d4b427f32f2e0812aa3e8bb25a
SHA1

6277f06792358cc6f0c9c0a34d7dd91481ad2d8a
SHA256

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59
SHA512

8f139da7f5d79149551347d53cdce13c0ac3b0acd6071ccd4075aaab47318f38ea3ad42137baf7cc1a6c281638716890cddc7c088f10e4e2f285a5005864c683
SSDEEP

3072:A0O2q9j5h3QKWXXWXG8FF7K+AmsgE5kEZZZy6x84JE5j4oQ:C9jX3QKKXWFFF7KlgaSPd

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exevuusoet.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vuusoet.exe

Executes dropped EXE 1 IoCs

Processes:

vuusoet.exe

pid process

2468 vuusoet.exe

pid	process
2468	vuusoet.exe

Loads dropped DLL 2 IoCs

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

pid	process
2156	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
2156	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vuusoet.exedc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /K"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /O"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /H"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /S"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /R"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /i"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /M"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /X"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /p"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /v"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /N"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /U"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /r"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /Q"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /m"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /s"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /l"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /h"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /P"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /y"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /g"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /E"	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /z"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /T"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /Z"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /V"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /f"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /j"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /e"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /u"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /o"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /Y"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /n"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /D"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /c"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /I"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /x"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /B"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /w"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /b"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /k"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /L"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /E"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /J"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /a"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /G"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /q"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /C"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /t"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /F"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /d"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /W"	vuusoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuusoet = "C:\\Users\\Admin\\vuusoet.exe /A"	vuusoet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exevuusoet.exe

pid	process
2156	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe
2468	vuusoet.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exevuusoet.exe

pid process

2156 dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
2468 vuusoet.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

description	pid	process	target process
PID 2156 wrote to memory of 2468	2156	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe	vuusoet.exe
PID 2156 wrote to memory of 2468	2156	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe	vuusoet.exe
PID 2156 wrote to memory of 2468	2156	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe	vuusoet.exe
PID 2156 wrote to memory of 2468	2156	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe	vuusoet.exe

C:\Users\Admin\AppData\Local\Temp\dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
"C:\Users\Admin\AppData\Local\Temp\dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\vuusoet.exe
"C:\Users\Admin\vuusoet.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\vuusoet.exe

Filesize
156KB

MD5
16da8a4a11ff4cbbf428d7056b8796fb

SHA1
2be8ac3b52ff8d9bffab84eed3768a3f1e31ee72

SHA256
655dae3993eb78109ccb741070b2aca5549172ee558596a1cca3617da0a6ea5e

SHA512
c028fe3a11a71085107ac4ff89254607ac3e8f1a760d170165dcba87b3a0ff1d22eb1c286299475d534c901f8f29be7d0678711a52458879daceb1c745d4e9b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads