b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c

General

Target

b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
Size

53KB
MD5

92c0dfd302e7682f2e0f5f0bae622523
SHA1

a051b6eb1cb99c4830f7c0058d13aafaa9cae387
SHA256

b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c
SHA512

a81ba138213214c2fe4d4938580795045ded4e0a61363cf2ade6d2b68d24960f5add88cf40da9aa61720aac4ef14bdf00b78ef3f1692a66c30bdbb32138f81d2
SSDEEP

1536:vNVg8r8QgMaoz7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:MMaozJJjmLM3zRJWZsXy4J9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

toudu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	toudu.exe

Executes dropped EXE 1 IoCs

Processes:

toudu.exe

pid process

2336 toudu.exe

Loads dropped DLL 2 IoCs

Processes:

b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe

pid	process
1760	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
1760	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

toudu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\toudu = "C:\\Users\\Admin\\toudu.exe"	toudu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

toudu.exe

pid	process
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe
2336	toudu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exetoudu.exe

pid process

1760 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
2336 toudu.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exetoudu.exe

description	pid	process	target process
PID 1760 wrote to memory of 2336	1760	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe	toudu.exe
PID 1760 wrote to memory of 2336	1760	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe	toudu.exe
PID 1760 wrote to memory of 2336	1760	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe	toudu.exe
PID 1760 wrote to memory of 2336	1760	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe	toudu.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
PID 2336 wrote to memory of 1760	2336	toudu.exe	b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe

C:\Users\Admin\AppData\Local\Temp\b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
"C:\Users\Admin\AppData\Local\Temp\b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\toudu.exe
"C:\Users\Admin\toudu.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\toudu.exe
Filesize
53KB

MD5
f865f8f00412ecd8911e31b48877ffb8

SHA1
6b1ffebe98a5a8f6ad2825c4fadc44d0e08cfc41

SHA256
e2072775fca2e147bda2d0d57462fe3b093229f3c5ce3702459f4ac66c9099d5

SHA512
844d10a88006ef054a4a4d9b5887b4c7a2016c6111df3ea15d8238fbffd77cf1c81589290a65992ea86b25b4cd8f31a5c259da96ede52840e88fe3b66fcf7dfb

Download Submit
memory/1760-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-14-0x0000000003920000-0x0000000003932000-memory.dmp

Filesize
72KB

Download
memory/1760-13-0x0000000003920000-0x0000000003932000-memory.dmp

Filesize
72KB

Download
memory/2336-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads