Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:36
Static task
static1
Behavioral task
behavioral1
Sample
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
Resource
win10v2004-20240508-en
General
-
Target
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
-
Size
53KB
-
MD5
1ce0fa79c716f572459acdca6b8bed40
-
SHA1
5be06a58380db3c999e4af037e26daae6f0a63e2
-
SHA256
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6
-
SHA512
52da7f312c59540179a1e183e16e3e78ab10f94ef513c9e5d0d2c60c2d5d03db05d02e6b6e2cdfcbbdd9d3859bb5dd87d5636ea00b8ec794c651ff75ceda3b61
-
SSDEEP
1536:vNEg8r8Qt/EtI7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:G/EtIJJjmLM3zRJWZsXy4J9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
liouqi.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" liouqi.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe -
Executes dropped EXE 1 IoCs
Processes:
liouqi.exepid process 3512 liouqi.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
liouqi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liouqi = "C:\\Users\\Admin\\liouqi.exe" liouqi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
liouqi.exepid process 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe 3512 liouqi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exeliouqi.exepid process 848 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe 3512 liouqi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exeliouqi.exedescription pid process target process PID 848 wrote to memory of 3512 848 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe liouqi.exe PID 848 wrote to memory of 3512 848 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe liouqi.exe PID 848 wrote to memory of 3512 848 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe liouqi.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe PID 3512 wrote to memory of 848 3512 liouqi.exe 5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe"C:\Users\Admin\AppData\Local\Temp\5924c0dad21b15d7d68a89849c326a35afb20860e51c4d2341308722a1c712f6.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\liouqi.exe"C:\Users\Admin\liouqi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\liouqi.exeFilesize
53KB
MD58eca0ce4330c54bec95c9e13ed015b0f
SHA15c4dbfbd58110d74168935973a6cfbcdc2de69d6
SHA256f2d7521a079b13a2984fce627e30d9ba088a56cbdd28efbf31056bf44ebaf894
SHA5123b4f7a6185bb68c8cb3f38dc99ce972bf2a24757319aaf4d15083ca4912a45035935472bc54137db41ec84337fb425323f1a83bf22d13cf08dc3f9523bac2d64
-
memory/848-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3512-34-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB