04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e

Resubmissions

25/09/2024, 18:16

240925-wwm9xszcpj 10

25/09/2024, 18:13

240925-wtz6pszbrm 10

Analysis

max time kernel
150s
max time network
25s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe
Size

135KB
MD5

f3b291f4d5dd3ec4214bca22307ab5ad
SHA1

6090f422d5b9d26280f1e017bfcb93ac7265a5dd
SHA256

04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e
SHA512

4695bacbcb6142b6798667cd29d520d4c93ba101907e084be8f4276b61c687d84fe93569f637e8c132f8fb5cfd7361e1f3a95680c7081cd4e9817fc3f291c609
SSDEEP

3072:0DTRiupUPb1WpXVxAaGBvbNvNbNJkvmhyPQbaDTUXGIDbwKDqCtrwdAxaVTtVHLO:8coIDbByGPMsMP

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	leaqot.exe

Executes dropped EXE 1 IoCs

pid	Process
3008	leaqot.exe

Loads dropped DLL 2 IoCs

pid	Process
1456	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe
1456	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaqot = "C:\\Users\\Admin\\leaqot.exe"	leaqot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leaqot.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe
3008	leaqot.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1456	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe
3008	leaqot.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 3008	1456	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe	29
PID 1456 wrote to memory of 3008	1456	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe	29
PID 1456 wrote to memory of 3008	1456	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe	29
PID 1456 wrote to memory of 3008	1456	04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe	29
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28
PID 3008 wrote to memory of 1456	3008	leaqot.exe	28

C:\Users\Admin\AppData\Local\Temp\04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe
"C:\Users\Admin\AppData\Local\Temp\04737a0fa1bdaa52e430dc81827a792b69719abaf3112fcd4448f4a5b409619e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\leaqot.exe
  "C:\Users\Admin\leaqot.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\leaqot.exe

Filesize
135KB

MD5
5fb87225e8c225e98d67d00deebfd663

SHA1
31bb037416eae4cdde80c1b4f6eafdf4ab7966ea

SHA256
911bfd66263e4edfe0dddc4d69674ba50e90f92686e0d18b73085c824a306bf0

SHA512
6c5347f8d9fdbd67d639841233bb4d01a15389c45320a0fcef07023e3601b2f61a9cbe06fd0bf561ac12295a2697bdbdf5beb1c65ca5b4479594b9047cda6fad

Download Submit