Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:11
Static task
static1
Behavioral task
behavioral1
Sample
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
Resource
win10v2004-20240426-en
General
-
Target
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
-
Size
53KB
-
MD5
92c0dfd302e7682f2e0f5f0bae622523
-
SHA1
a051b6eb1cb99c4830f7c0058d13aafaa9cae387
-
SHA256
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c
-
SHA512
a81ba138213214c2fe4d4938580795045ded4e0a61363cf2ade6d2b68d24960f5add88cf40da9aa61720aac4ef14bdf00b78ef3f1692a66c30bdbb32138f81d2
-
SSDEEP
1536:vNVg8r8QgMaoz7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:MMaozJJjmLM3zRJWZsXy4J9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
fksoit.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fksoit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe -
Executes dropped EXE 1 IoCs
Processes:
fksoit.exepid process 2072 fksoit.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fksoit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fksoit = "C:\\Users\\Admin\\fksoit.exe" fksoit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fksoit.exepid process 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe 2072 fksoit.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exefksoit.exepid process 2956 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe 2072 fksoit.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exefksoit.exedescription pid process target process PID 2956 wrote to memory of 2072 2956 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe fksoit.exe PID 2956 wrote to memory of 2072 2956 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe fksoit.exe PID 2956 wrote to memory of 2072 2956 b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe fksoit.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe PID 2072 wrote to memory of 2956 2072 fksoit.exe b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe"C:\Users\Admin\AppData\Local\Temp\b57261e6e2abda72c802ebefdcf63fa19c02c976d92b8d641c7f69e57210337c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\fksoit.exe"C:\Users\Admin\fksoit.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\fksoit.exeFilesize
53KB
MD5d8d137b65ee6fa3d37b87a416af4fa18
SHA1fa772afaac9b9c9e21a53e82aacc2f404f23f741
SHA2568d289efddb19ae342bff9d2bc04114479002caee8674a602e65f6da8e5792497
SHA5124b959bbbd00d020e3e95b5c8aa642a3b9656e5ea85b90309075255a35758f48d9aacb8b652b8508e6ca4b69c0fbc3dc07db7709a5df852c455882b25c5c6cc15
-
memory/2072-33-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2956-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB