7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664

General

Target

7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
Size

60KB
MD5

59f7a894987bece515c3f0a52f4251d3
SHA1

17e248984a94b6f31b3f27e8a38f30eacb78d24f
SHA256

7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664
SHA512

fd320a382474e92395fa6b5834a2a2db04d119c85ed8f46ac74bbf0a3a8c38cd3e517b38c6ddb7be1cc4c22c6ffa8262c2605643892759ac9f6d5ab2d7ffcfde
SSDEEP

1536:ocvhZCVZL22/BtJ1DG2xNMfMZec4feLdlzok:fqVM2/deGLdlzn

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

qeayie.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qeayie.exe

Executes dropped EXE 1 IoCs

Processes:

qeayie.exe

pid process

3020 qeayie.exe

Loads dropped DLL 2 IoCs

Processes:

7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe

pid	process
1964	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
1964	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

qeayie.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /E"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /S"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /g"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /H"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /L"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /b"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /X"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /M"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /W"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /C"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /G"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /D"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /p"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /N"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /F"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /u"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /A"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /B"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /c"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /m"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /K"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /Z"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /U"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /P"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /T"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /V"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /t"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /i"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /I"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /y"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /Y"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /R"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /a"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /O"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /n"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /j"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /h"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /s"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /J"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /k"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /e"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /f"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /x"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /d"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /r"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /l"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /w"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /q"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /v"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /o"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /z"	qeayie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeayie = "C:\\Users\\Admin\\qeayie.exe /Q"	qeayie.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

qeayie.exe

pid	process
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe
3020	qeayie.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exeqeayie.exe

pid process

1964 7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
3020 qeayie.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exeqeayie.exe

description	pid	process	target process
PID 1964 wrote to memory of 3020	1964	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe	qeayie.exe
PID 1964 wrote to memory of 3020	1964	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe	qeayie.exe
PID 1964 wrote to memory of 3020	1964	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe	qeayie.exe
PID 1964 wrote to memory of 3020	1964	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe	qeayie.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
PID 3020 wrote to memory of 1964	3020	qeayie.exe	7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe

C:\Users\Admin\AppData\Local\Temp\7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe
"C:\Users\Admin\AppData\Local\Temp\7701ca24698ee8fb94bd5ef71d9fb09f7e3bf80e080a9abc7aa30912674ae664.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\qeayie.exe
"C:\Users\Admin\qeayie.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\qeayie.exe
Filesize
60KB

MD5
3e699f09c17f33ad3b0cd095a58e08bc

SHA1
fb08d64fd8613406e9d0ee89366e0ad35b16dc67

SHA256
b921f4d140ccd02e6c7cf24568e53df2191b744698202b7a45b68d2c0063c33f

SHA512
bfb4b4d7354511bd0f4e4e90d0813a2181bf76a4e269c67c7fcd197e2d42eb70ae85ace983c7b2264e4ac9331184a5ef9b5fc2e4bea3d12e38cbd0d9de624116

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads