Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:11
Static task
static1
Behavioral task
behavioral1
Sample
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
Resource
win10v2004-20240426-en
General
-
Target
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
-
Size
53KB
-
MD5
92c0dfd302e7682f2e0f5f0bae622523
-
SHA1
a051b6eb1cb99c4830f7c0058d13aafaa9cae387
-
SHA256
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c
-
SHA512
a81ba138213214c2fe4d4938580795045ded4e0a61363cf2ade6d2b68d24960f5add88cf40da9aa61720aac4ef14bdf00b78ef3f1692a66c30bdbb32138f81d2
-
SSDEEP
1536:vNVg8r8QgMaoz7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:MMaozJJjmLM3zRJWZsXy4J9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
toudu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toudu.exe -
Executes dropped EXE 1 IoCs
Processes:
toudu.exepid process 2336 toudu.exe -
Loads dropped DLL 2 IoCs
Processes:
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exepid process 1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe 1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
toudu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\toudu = "C:\\Users\\Admin\\toudu.exe" toudu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toudu.exepid process 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe 2336 toudu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exetoudu.exepid process 1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe 2336 toudu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exetoudu.exedescription pid process target process PID 1760 wrote to memory of 2336 1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe toudu.exe PID 1760 wrote to memory of 2336 1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe toudu.exe PID 1760 wrote to memory of 2336 1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe toudu.exe PID 1760 wrote to memory of 2336 1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe toudu.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2336 wrote to memory of 1760 2336 toudu.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe"C:\Users\Admin\AppData\Local\Temp\b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\toudu.exe"C:\Users\Admin\toudu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\toudu.exeFilesize
53KB
MD5f865f8f00412ecd8911e31b48877ffb8
SHA16b1ffebe98a5a8f6ad2825c4fadc44d0e08cfc41
SHA256e2072775fca2e147bda2d0d57462fe3b093229f3c5ce3702459f4ac66c9099d5
SHA512844d10a88006ef054a4a4d9b5887b4c7a2016c6111df3ea15d8238fbffd77cf1c81589290a65992ea86b25b4cd8f31a5c259da96ede52840e88fe3b66fcf7dfb
-
memory/1760-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1760-14-0x0000000003920000-0x0000000003932000-memory.dmpFilesize
72KB
-
memory/1760-13-0x0000000003920000-0x0000000003932000-memory.dmpFilesize
72KB
-
memory/2336-17-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB