dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59

General

Target

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
Size

156KB
MD5

cf1e22d4b427f32f2e0812aa3e8bb25a
SHA1

6277f06792358cc6f0c9c0a34d7dd91481ad2d8a
SHA256

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59
SHA512

8f139da7f5d79149551347d53cdce13c0ac3b0acd6071ccd4075aaab47318f38ea3ad42137baf7cc1a6c281638716890cddc7c088f10e4e2f285a5005864c683
SSDEEP

3072:A0O2q9j5h3QKWXXWXG8FF7K+AmsgE5kEZZZy6x84JE5j4oQ:C9jX3QKKXWFFF7KlgaSPd

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exelieosu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lieosu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

Executes dropped EXE 1 IoCs

Processes:

lieosu.exe

pid process

1656 lieosu.exe

pid	process
1656	lieosu.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

lieosu.exedc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /W"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /Q"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /O"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /n"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /G"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /V"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /F"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /m"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /U"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /i"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /t"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /r"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /T"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /J"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /D"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /w"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /o"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /L"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /g"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /A"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /B"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /k"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /H"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /a"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /v"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /z"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /q"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /P"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /h"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /j"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /A"	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /C"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /b"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /f"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /e"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /l"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /y"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /X"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /R"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /c"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /x"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /N"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /E"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /s"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /p"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /Y"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /S"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /Z"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /u"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /I"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /d"	lieosu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lieosu = "C:\\Users\\Admin\\lieosu.exe /M"	lieosu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exelieosu.exe

pid	process
868	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
868	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe
1656	lieosu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exelieosu.exe

pid process

868 dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
1656 lieosu.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe

description	pid	process	target process
PID 868 wrote to memory of 1656	868	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe	lieosu.exe
PID 868 wrote to memory of 1656	868	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe	lieosu.exe
PID 868 wrote to memory of 1656	868	dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe	lieosu.exe

C:\Users\Admin\AppData\Local\Temp\dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe
"C:\Users\Admin\AppData\Local\Temp\dc407a7548630c13113d468564f7f7a2bf19cd2c83ff58552f3b4778f4bfdc59.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868

C:\Users\Admin\lieosu.exe
"C:\Users\Admin\lieosu.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\lieosu.exe

Filesize
156KB

MD5
18b7de963378fe4e7963736afc67ef34

SHA1
864d2943ff08b6de07dd228121ac29be8691b16c

SHA256
40a4b39630fd4729bae69b6c1c184533bb91f146899e653d02cb639e5cee36e1

SHA512
7f6e7fc08184a061a53d867739684760f30d47f637cb407a884f156dbb626f4e93e20a0a7d91c687eae59a6f2c5d69397f06673eb956e959a5de2aba3fb1f036

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads