Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:36
Static task
static1
Behavioral task
behavioral1
Sample
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
Resource
win10v2004-20240508-en
General
-
Target
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
-
Size
53KB
-
MD5
1ce0fa79c716f572459acdca6b8bed40
-
SHA1
5be06a58380db3c999e4af037e26daae6f0a63e2
-
SHA256
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6
-
SHA512
52da7f312c59540179a1e183e16e3e78ab10f94ef513c9e5d0d2c60c2d5d03db05d02e6b6e2cdfcbbdd9d3859bb5dd87d5636ea00b8ec794c651ff75ceda3b61
-
SSDEEP
1536:vNEg8r8Qt/EtI7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:G/EtIJJjmLM3zRJWZsXy4J9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
deioqi.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deioqi.exe -
Executes dropped EXE 1 IoCs
Processes:
deioqi.exepid process 1752 deioqi.exe -
Loads dropped DLL 2 IoCs
Processes:
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exepid process 2880 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe 2880 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
deioqi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\deioqi = "C:\\Users\\Admin\\deioqi.exe" deioqi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
deioqi.exepid process 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe 1752 deioqi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exedeioqi.exepid process 2880 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe 1752 deioqi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exedeioqi.exedescription pid process target process PID 2880 wrote to memory of 1752 2880 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe deioqi.exe PID 2880 wrote to memory of 1752 2880 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe deioqi.exe PID 2880 wrote to memory of 1752 2880 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe deioqi.exe PID 2880 wrote to memory of 1752 2880 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe deioqi.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 1752 wrote to memory of 2880 1752 deioqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe"C:\Users\Admin\AppData\Local\Temp\5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\deioqi.exe"C:\Users\Admin\deioqi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\deioqi.exeFilesize
53KB
MD5f9311fc8d4bcfa69e4b67f7a385b9989
SHA100b9cb50607e84a856ee28a1da504f184e31e2bc
SHA2565c628091b61b99cf932b3febdf4cf55915003b8af5629f4e84794fd956d761b3
SHA51244ebc096df081131373ad508101206c24e569f86be484fcae0a593e1bfc7b09450979184af74b047e5836684e8f93cd6a0b41a700b347cab08b5c2a66549bc02
-
memory/1752-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2880-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2880-8-0x00000000027D0000-0x00000000027E2000-memory.dmpFilesize
72KB
-
memory/2880-15-0x00000000027D0000-0x00000000027E2000-memory.dmpFilesize
72KB