Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe
Resource
win10v2004-20241007-en
General
-
Target
25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe
-
Size
124KB
-
MD5
086040cc28695cbc2dcad2926477bf40
-
SHA1
3d60c82ae7413f0277ed32df34e48df3dfb2fc2e
-
SHA256
25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239d
-
SHA512
fc832a12a9a8c8b7e465c020ea5d4d760ec4f2afb21ea2bb0eb358ef7122092dba9d88049bdd4934eb8fb7350192cec1b486946a424ec57065cb9c0483d37699
-
SSDEEP
1536:SRszZ5YKMkhRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:EGXYKMkhkFoN3Oo1+FvfSW
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 34 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jeaote.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yioxu.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceiemes.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nzfaik.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" noafeen.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woeeb.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yooata.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" maair.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kuaseaq.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bmbuw.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" feufue.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" noiqeev.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goomi.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuiqo.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" louugu.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiutee.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zgyiij.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" raiuc.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sphof.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" miaxev.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wouamar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" noaarew.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" weceh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rfmov.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yomef.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cuede.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rieuvuz.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" biebaa.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fioviw.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" npjec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" koujuiy.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rooxuy.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cuise.exe -
Checks computer location settings 2 TTPs 34 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation yomef.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation wouamar.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation biebaa.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation yooata.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation maair.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation koujuiy.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation louugu.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation noafeen.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation hiutee.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation miaxev.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation woeeb.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation cuise.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation kuaseaq.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation goomi.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation rfmov.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation jeaote.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation sphof.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation noiqeev.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation npjec.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation bmbuw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation yioxu.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation cuede.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation nuiqo.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation rieuvuz.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation rooxuy.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation noaarew.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation ceiemes.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation weceh.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation feufue.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation fioviw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation raiuc.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation zgyiij.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation nzfaik.exe -
Executes dropped EXE 34 IoCs
pid Process 2296 jeaote.exe 1876 feufue.exe 4292 yioxu.exe 2824 sphof.exe 4456 cuede.exe 948 noafeen.exe 4168 rooxuy.exe 1288 hiutee.exe 3032 miaxev.exe 1712 woeeb.exe 3256 noiqeev.exe 1380 zgyiij.exe 720 fioviw.exe 3168 wouamar.exe 4668 noaarew.exe 1432 biebaa.exe 4532 cuise.exe 4640 npjec.exe 756 goomi.exe 4768 ceiemes.exe 3688 weceh.exe 4108 nzfaik.exe 1580 yooata.exe 1220 raiuc.exe 1832 maair.exe 2624 rfmov.exe 1224 nuiqo.exe 3700 koujuiy.exe 1496 louugu.exe 4428 yomef.exe 4900 kuaseaq.exe 3516 rieuvuz.exe 592 bmbuw.exe 3668 qeruh.exe -
Adds Run key to start application 2 TTPs 34 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaarew = "C:\\Users\\Admin\\noaarew.exe /t" wouamar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiemes = "C:\\Users\\Admin\\ceiemes.exe /S" goomi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raiuc = "C:\\Users\\Admin\\raiuc.exe /s" yooata.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiutee = "C:\\Users\\Admin\\hiutee.exe /e" rooxuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woeeb = "C:\\Users\\Admin\\woeeb.exe /Z" miaxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfaik = "C:\\Users\\Admin\\nzfaik.exe /y" weceh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\maair = "C:\\Users\\Admin\\maair.exe /r" raiuc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rieuvuz = "C:\\Users\\Admin\\rieuvuz.exe /q" kuaseaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeruh = "C:\\Users\\Admin\\qeruh.exe /L" bmbuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cuede = "C:\\Users\\Admin\\cuede.exe /G" sphof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\npjec = "C:\\Users\\Admin\\npjec.exe /c" cuise.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rfmov = "C:\\Users\\Admin\\rfmov.exe /W" maair.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmbuw = "C:\\Users\\Admin\\bmbuw.exe /T" rieuvuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noiqeev = "C:\\Users\\Admin\\noiqeev.exe /T" woeeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooata = "C:\\Users\\Admin\\yooata.exe /C" nzfaik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zgyiij = "C:\\Users\\Admin\\zgyiij.exe /S" noiqeev.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fioviw = "C:\\Users\\Admin\\fioviw.exe /L" zgyiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuiqo = "C:\\Users\\Admin\\nuiqo.exe /Z" rfmov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\louugu = "C:\\Users\\Admin\\louugu.exe /W" koujuiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuaseaq = "C:\\Users\\Admin\\kuaseaq.exe /s" yomef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sphof = "C:\\Users\\Admin\\sphof.exe /V" yioxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miaxev = "C:\\Users\\Admin\\miaxev.exe /u" hiutee.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noafeen = "C:\\Users\\Admin\\noafeen.exe /B" cuede.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rooxuy = "C:\\Users\\Admin\\rooxuy.exe /I" noafeen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\goomi = "C:\\Users\\Admin\\goomi.exe /m" npjec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weceh = "C:\\Users\\Admin\\weceh.exe /v" ceiemes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koujuiy = "C:\\Users\\Admin\\koujuiy.exe /v" nuiqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\feufue = "C:\\Users\\Admin\\feufue.exe /i" jeaote.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yioxu = "C:\\Users\\Admin\\yioxu.exe /E" feufue.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cuise = "C:\\Users\\Admin\\cuise.exe /L" biebaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeaote = "C:\\Users\\Admin\\jeaote.exe /b" 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wouamar = "C:\\Users\\Admin\\wouamar.exe /t" fioviw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\biebaa = "C:\\Users\\Admin\\biebaa.exe /p" noaarew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yomef = "C:\\Users\\Admin\\yomef.exe /B" louugu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language noaarew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zgyiij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fioviw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language maair.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cuise.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yooata.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language noafeen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hiutee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language woeeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jeaote.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sphof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language louugu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yomef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qeruh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language weceh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nzfaik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rieuvuz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wouamar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language koujuiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmbuw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nuiqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language noiqeev.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biebaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npjec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kuaseaq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language feufue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language miaxev.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rooxuy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language goomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ceiemes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raiuc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfmov.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yioxu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cuede.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe 1968 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe 2296 jeaote.exe 2296 jeaote.exe 1876 feufue.exe 1876 feufue.exe 4292 yioxu.exe 4292 yioxu.exe 2824 sphof.exe 2824 sphof.exe 4456 cuede.exe 4456 cuede.exe 948 noafeen.exe 948 noafeen.exe 4168 rooxuy.exe 4168 rooxuy.exe 1288 hiutee.exe 1288 hiutee.exe 3032 miaxev.exe 3032 miaxev.exe 1712 woeeb.exe 1712 woeeb.exe 3256 noiqeev.exe 3256 noiqeev.exe 1380 zgyiij.exe 1380 zgyiij.exe 720 fioviw.exe 720 fioviw.exe 3168 wouamar.exe 3168 wouamar.exe 4668 noaarew.exe 4668 noaarew.exe 1432 biebaa.exe 1432 biebaa.exe 4532 cuise.exe 4532 cuise.exe 4640 npjec.exe 4640 npjec.exe 756 goomi.exe 756 goomi.exe 4768 ceiemes.exe 4768 ceiemes.exe 3688 weceh.exe 3688 weceh.exe 4108 nzfaik.exe 4108 nzfaik.exe 1580 yooata.exe 1580 yooata.exe 1220 raiuc.exe 1220 raiuc.exe 1832 maair.exe 1832 maair.exe 2624 rfmov.exe 2624 rfmov.exe 1224 nuiqo.exe 1224 nuiqo.exe 3700 koujuiy.exe 3700 koujuiy.exe 1496 louugu.exe 1496 louugu.exe 4428 yomef.exe 4428 yomef.exe 4900 kuaseaq.exe 4900 kuaseaq.exe -
Suspicious use of SetWindowsHookEx 35 IoCs
pid Process 1968 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe 2296 jeaote.exe 1876 feufue.exe 4292 yioxu.exe 2824 sphof.exe 4456 cuede.exe 948 noafeen.exe 4168 rooxuy.exe 1288 hiutee.exe 3032 miaxev.exe 1712 woeeb.exe 3256 noiqeev.exe 1380 zgyiij.exe 720 fioviw.exe 3168 wouamar.exe 4668 noaarew.exe 1432 biebaa.exe 4532 cuise.exe 4640 npjec.exe 756 goomi.exe 4768 ceiemes.exe 3688 weceh.exe 4108 nzfaik.exe 1580 yooata.exe 1220 raiuc.exe 1832 maair.exe 2624 rfmov.exe 1224 nuiqo.exe 3700 koujuiy.exe 1496 louugu.exe 4428 yomef.exe 4900 kuaseaq.exe 3516 rieuvuz.exe 592 bmbuw.exe 3668 qeruh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2296 1968 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe 89 PID 1968 wrote to memory of 2296 1968 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe 89 PID 1968 wrote to memory of 2296 1968 25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe 89 PID 2296 wrote to memory of 1876 2296 jeaote.exe 92 PID 2296 wrote to memory of 1876 2296 jeaote.exe 92 PID 2296 wrote to memory of 1876 2296 jeaote.exe 92 PID 1876 wrote to memory of 4292 1876 feufue.exe 96 PID 1876 wrote to memory of 4292 1876 feufue.exe 96 PID 1876 wrote to memory of 4292 1876 feufue.exe 96 PID 4292 wrote to memory of 2824 4292 yioxu.exe 97 PID 4292 wrote to memory of 2824 4292 yioxu.exe 97 PID 4292 wrote to memory of 2824 4292 yioxu.exe 97 PID 2824 wrote to memory of 4456 2824 sphof.exe 98 PID 2824 wrote to memory of 4456 2824 sphof.exe 98 PID 2824 wrote to memory of 4456 2824 sphof.exe 98 PID 4456 wrote to memory of 948 4456 cuede.exe 99 PID 4456 wrote to memory of 948 4456 cuede.exe 99 PID 4456 wrote to memory of 948 4456 cuede.exe 99 PID 948 wrote to memory of 4168 948 noafeen.exe 100 PID 948 wrote to memory of 4168 948 noafeen.exe 100 PID 948 wrote to memory of 4168 948 noafeen.exe 100 PID 4168 wrote to memory of 1288 4168 rooxuy.exe 101 PID 4168 wrote to memory of 1288 4168 rooxuy.exe 101 PID 4168 wrote to memory of 1288 4168 rooxuy.exe 101 PID 1288 wrote to memory of 3032 1288 hiutee.exe 103 PID 1288 wrote to memory of 3032 1288 hiutee.exe 103 PID 1288 wrote to memory of 3032 1288 hiutee.exe 103 PID 3032 wrote to memory of 1712 3032 miaxev.exe 104 PID 3032 wrote to memory of 1712 3032 miaxev.exe 104 PID 3032 wrote to memory of 1712 3032 miaxev.exe 104 PID 1712 wrote to memory of 3256 1712 woeeb.exe 106 PID 1712 wrote to memory of 3256 1712 woeeb.exe 106 PID 1712 wrote to memory of 3256 1712 woeeb.exe 106 PID 3256 wrote to memory of 1380 3256 noiqeev.exe 107 PID 3256 wrote to memory of 1380 3256 noiqeev.exe 107 PID 3256 wrote to memory of 1380 3256 noiqeev.exe 107 PID 1380 wrote to memory of 720 1380 zgyiij.exe 108 PID 1380 wrote to memory of 720 1380 zgyiij.exe 108 PID 1380 wrote to memory of 720 1380 zgyiij.exe 108 PID 720 wrote to memory of 3168 720 fioviw.exe 109 PID 720 wrote to memory of 3168 720 fioviw.exe 109 PID 720 wrote to memory of 3168 720 fioviw.exe 109 PID 3168 wrote to memory of 4668 3168 wouamar.exe 110 PID 3168 wrote to memory of 4668 3168 wouamar.exe 110 PID 3168 wrote to memory of 4668 3168 wouamar.exe 110 PID 4668 wrote to memory of 1432 4668 noaarew.exe 111 PID 4668 wrote to memory of 1432 4668 noaarew.exe 111 PID 4668 wrote to memory of 1432 4668 noaarew.exe 111 PID 1432 wrote to memory of 4532 1432 biebaa.exe 112 PID 1432 wrote to memory of 4532 1432 biebaa.exe 112 PID 1432 wrote to memory of 4532 1432 biebaa.exe 112 PID 4532 wrote to memory of 4640 4532 cuise.exe 113 PID 4532 wrote to memory of 4640 4532 cuise.exe 113 PID 4532 wrote to memory of 4640 4532 cuise.exe 113 PID 4640 wrote to memory of 756 4640 npjec.exe 114 PID 4640 wrote to memory of 756 4640 npjec.exe 114 PID 4640 wrote to memory of 756 4640 npjec.exe 114 PID 756 wrote to memory of 4768 756 goomi.exe 115 PID 756 wrote to memory of 4768 756 goomi.exe 115 PID 756 wrote to memory of 4768 756 goomi.exe 115 PID 4768 wrote to memory of 3688 4768 ceiemes.exe 116 PID 4768 wrote to memory of 3688 4768 ceiemes.exe 116 PID 4768 wrote to memory of 3688 4768 ceiemes.exe 116 PID 3688 wrote to memory of 4108 3688 weceh.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe"C:\Users\Admin\AppData\Local\Temp\25e59e564df78672acf773d818b73ce3b536cb0c4b4a51304dd22150add1239dN.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\jeaote.exe"C:\Users\Admin\jeaote.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\feufue.exe"C:\Users\Admin\feufue.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\yioxu.exe"C:\Users\Admin\yioxu.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\sphof.exe"C:\Users\Admin\sphof.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\cuede.exe"C:\Users\Admin\cuede.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\noafeen.exe"C:\Users\Admin\noafeen.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\rooxuy.exe"C:\Users\Admin\rooxuy.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\hiutee.exe"C:\Users\Admin\hiutee.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\miaxev.exe"C:\Users\Admin\miaxev.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\woeeb.exe"C:\Users\Admin\woeeb.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\noiqeev.exe"C:\Users\Admin\noiqeev.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\zgyiij.exe"C:\Users\Admin\zgyiij.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\fioviw.exe"C:\Users\Admin\fioviw.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\wouamar.exe"C:\Users\Admin\wouamar.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\noaarew.exe"C:\Users\Admin\noaarew.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\biebaa.exe"C:\Users\Admin\biebaa.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\cuise.exe"C:\Users\Admin\cuise.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\npjec.exe"C:\Users\Admin\npjec.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\goomi.exe"C:\Users\Admin\goomi.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\ceiemes.exe"C:\Users\Admin\ceiemes.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\weceh.exe"C:\Users\Admin\weceh.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\nzfaik.exe"C:\Users\Admin\nzfaik.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4108 -
C:\Users\Admin\yooata.exe"C:\Users\Admin\yooata.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Users\Admin\raiuc.exe"C:\Users\Admin\raiuc.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1220 -
C:\Users\Admin\maair.exe"C:\Users\Admin\maair.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Users\Admin\rfmov.exe"C:\Users\Admin\rfmov.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2624 -
C:\Users\Admin\nuiqo.exe"C:\Users\Admin\nuiqo.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1224 -
C:\Users\Admin\koujuiy.exe"C:\Users\Admin\koujuiy.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3700 -
C:\Users\Admin\louugu.exe"C:\Users\Admin\louugu.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\yomef.exe"C:\Users\Admin\yomef.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4428 -
C:\Users\Admin\kuaseaq.exe"C:\Users\Admin\kuaseaq.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4900 -
C:\Users\Admin\rieuvuz.exe"C:\Users\Admin\rieuvuz.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3516 -
C:\Users\Admin\bmbuw.exe"C:\Users\Admin\bmbuw.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:592 -
C:\Users\Admin\qeruh.exe"C:\Users\Admin\qeruh.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD53a90c80639637baefd71de06f1616d00
SHA108d8c9096e95e7f7d60dbc6799fab9005916da71
SHA25651496a05447cebdfac947fb0c54d62c3019375f7c710927528bfa7d9727c8677
SHA51296f3f2221587e5f6c2ec18bd475a4600dec3106f8358128eae674ed3dfdf05e9b95e98163dc2500c8ba6ca537e7c08d3a632af82839fae96ea46168cf5f5c1a6
-
Filesize
124KB
MD557ad823496d1e8e41eeb71028ba6be54
SHA10365a951141e13a78e700b560876eea3baecf7d4
SHA2563acc1e15e7daceaafee4e239e6f7a134975492ec20485d143d9986a63eacf8ad
SHA512203328bd3cbc7f7152d00146f2cdde8baf97210b40a569815cf449b4382ec9cced7552f358269bbebd76f0dc3b7659190520f9cfe1230997f8ec5c09de6ede81
-
Filesize
124KB
MD59818770e215aba39ec9e150735e8d3bf
SHA11b1d6751766a7f4d5218cf04cb1f121c890034be
SHA256ada7456c3e26a2eee8d6e910d8bcac67cc488b4cc38ad9a0b5d2d67e66d2c7ac
SHA5122925dd7ce88d45fa21477cff72b5c8f0c9cbb5bb45d542e1d03a62ccfd2de8dea22d65e62b6a1563f4229ddd05666c1ef2fd360e724611716e320db2e94b37e8
-
Filesize
124KB
MD5092fdcffe7603e1d078b8fa60b03c4b5
SHA18a3236e0542052d3c2ebd6217d854d8b15ea6c60
SHA256c7511a6ba77b7490de711f63f2635a83f68bb3b54303037a89510b20a7c0d827
SHA512e9fdf5e1a2c9cd834e66f3d8839bc16cba4a5f8ded4c674b8c1165b2fcd326bf6b41b8db5b60e925dbad678daf75483282458e843d9ad951dea6a8f1df0eff30
-
Filesize
124KB
MD59f16c3ce809f8a419f3cda6d5ab74d76
SHA103d508a167b5d24eb35dc19255dcc24f69d7d317
SHA2566b064bff076def5fe443120634b9b99438cfb263aaaed7a227c3e307eb5e19a2
SHA512974dab127b4192097c16f51dc0717c4d2ef4ee8a9cc3b4f6e08f53eb2fe41c2667ce705750b2cbec8fcc4602e0d52660723b8b139fa1ec6d83814506a4d5ef1f
-
Filesize
124KB
MD562e47d05416185fa1d9b6dc96adb06cc
SHA1379ff3646effa51a2d579e1cfb21d8aa6d15ad3d
SHA2561b1f0efb290b95a95dd27b655fd9a539eac8f394da2cd0dd53786cf370d2745e
SHA512633d642e929a36994cdda6945f8edcc3d8ae5cb8a96bc845976bd9b71609fde7780672ad9b2ba03e432e03924cb4686aa7f8142d691c7b95e86c05f93c6211cf
-
Filesize
124KB
MD5ea8a8fd2f1f0f3356bf1affa194463d0
SHA1ff6ad02118a19fb34834f9ab318fba2c3e14aa7b
SHA256755d3749f02c69bb238f6d646eb7920001db4a9789f8cccfc83a2ee66dc412f2
SHA512ac7477b6c9bb2f11ca72fb576173dbbb9b5c7775fa56cd534da01644cfbf420536f5c56ad2ad8b7ca4d497d8e69df31abc80bb9051eec017d6dcd8ae235d78bc
-
Filesize
124KB
MD525fd7ff6bcf45e7ed4287b463d44238f
SHA1ff3ab85313d729d718c552c163c884b1e07e3582
SHA256bfa2f068edc98987cfa0f6f9241e967dcf33026756c415cef725fa785db1e9b2
SHA51215aa267a956f2448b84def1ca06ded4c7dd15fbdeb516d18489a06b9d8ed2545ec816957a469cb5dfd22dc7faafa272cedc81fe073ff381198399e1557e29b6d
-
Filesize
124KB
MD5a5746ecfa873a88a83037188157f115d
SHA1d9a9921dacf59d6fe8729b0640c575243311c3bd
SHA256e354a5f2e9b35e173b29a9434ffb36787330de0480b19e086d8df6ea296a9d0f
SHA5120ef19487c9d16302a0a85a8f1a6a91d9c8661a6b17a20b832d53a918d33e2b32e3fea99af0756c91e8d6f79e24fbda0f0dae34f4e97ad00eb68928cfcb35d0cb
-
Filesize
124KB
MD5c5de6d16d79716d0204fc856419c96b0
SHA18d52e89ef585a5c04c6f99512dff4e72de3936bd
SHA2562a112d3701f8f66badad2c4dd9487fd5f499b3c0094de5777958f83e3d96ef6c
SHA512b1750c9fb4f5ad1575398bb3ef5fb22f9e4baa02fcfa8d94df1838fb3b27cdf97d3a840514deb9b66b721647c68d8405eb48654bcf335f41897b542661186416
-
Filesize
124KB
MD5af7b8383a0911a79a13b5dd098e3556e
SHA1161bf4cedc45d9fdb50552b0fe043988cc749425
SHA2569e04ec6f1b57c816c07e3e64b9b5a9bd3f837a711ff2c06b30472dc2736f1ebb
SHA5124813ce67b84706b8abcf055a1ccc7cdc5dcde99b34d26f92b1f5bf8419564e80c233d0939f46cc93a41fbcff4a77b22713b2cded6ddc7e89c9d108169e61bad1
-
Filesize
124KB
MD5d42670bc1a9a3aec38221ca3e2359a89
SHA1d2faaa5ebace18cbd87cf11f032e16e327fac5d2
SHA256a6639aaf8bd274b3232a781312ef5eb40fa05a225fdfb656b1aacf534b2fd182
SHA5125e5939baeb86cb011a01e498b0b4032fbad63d93e1d1948cb246665c40f686cac4147f4fae99e6c2174f8d2cef162a81214135fae16860f91ecafca12a90d987
-
Filesize
124KB
MD5a2fd5754de5200fe86a324b3127f0301
SHA196b8ec5276024fdf1582ff1a8f0c67781a2a11fa
SHA256af7be07398eb47bfca1d1a297f9cf974a79d4ed85c5fe47eef47b949abc2d0d8
SHA51211a9113d49aae0690a8aeb4c94e3f1e48adcdb7eeb877542078d55ef0475a3e8c1879202a2b4d12929d303d3f0c30bfcd06e805e5e072f0341882e16ea757e8d
-
Filesize
124KB
MD5d266ed082d80733aabdfe2c9691554ed
SHA1796987f3863792e0e2c9d62b689291ebff02d6c6
SHA25684e9b6dde13f9898c3a282eb6830f9b0a8fe1b46150ef7231e508e8ec4a19cc6
SHA512eb4f8262df77f7e2203870542ade32356225c45d8c4a342f3e8b85dbc99fc7d3e1475a3350c7c80a4ba31cb70bcba916945a095f2145415fb2a12118411b5b34
-
Filesize
124KB
MD5328d2cee3d4a47f57ffdf35af4c9c5ce
SHA1e54d3bbc729fd00c67cb0b9fbeb62ae8a987ad78
SHA256b8928ed8fa033255c4c1d4cf498454b3ea61c3f6b94880522f551d8ab85b9076
SHA5128840e0ac18178daee6a321d6034560e1dfd4535c13684222642c88953da89b1df7684ba4a1e429b5b2844e2f4bc4d595b291fdd17fc1d9dac9f3a450e343e79a
-
Filesize
124KB
MD5c4e6ee64fe6eeb284b17c993e2c02a04
SHA13864f91f7494bbc69498629ac086c56c1bb01c96
SHA256950977ec2da8b52311eea115f6915e63b064cf9cd0a2336ef11a32856bea1fab
SHA51231ec04ff1dac9d6ff73468dbb68d1ffc0c00c1ab6044a1e2167e0ae2f6d95dc71872f9992800cf7d2b060424f2437a126f7c12299d46d817d10123393b9cbc12
-
Filesize
124KB
MD510cf4925478e26bd36ca4c271838e132
SHA184e2d18dae77729436d4f86733c5e52ccd82c884
SHA256c980fe0878ad09667a42ad5fed854ee1994fce3a418cfc18934818b570ed1808
SHA512baadb49c96a80d837a55f1e1a818ffd349acc88287c112cea35e81b690b31ccc063ee0addcafd94faad74e7363b4e285662178177efecf16027f0a4733bff1f7
-
Filesize
124KB
MD5a2188cb777af1b1104b9bb63eca0f364
SHA1fd077bf6c5a8d668d740dfcf46412e4b4fdf80be
SHA2567f0eadcc35cb9df7b79b4f4fb2ce09b7fb7d7901e393bdf0265c6f3a94fa9859
SHA512407ac3c59449e509e4344af3648a4bc8567f43c0f28386c45a7ab4e4140832589fca5ba43fd6cb844a72e1ff536fcd7809733bc8edd6103d9ec677c618eef199
-
Filesize
124KB
MD53dcb9f4bbbb3b92da79966af29cd3b2f
SHA15c0cb125e3407c540482d1b54e05241b961980fb
SHA25665581c44891a06665374c877630edc282809083cd3616b855d0e96e0a5457e1c
SHA51294a2409b93b3101d1d9287737ab45059275301299be3e83f497c6378c041a50b25d5830cb251ffd676c8d48d886be430a16226c6b794142c671abc75944f7188
-
Filesize
124KB
MD5e19dca019dfe4fa29b873fb7bcdce932
SHA1309189d9f8b79be8cc7c35634d8fb156a071ea73
SHA256f8d12b8ce4ec37b86a76d6f0aa1bb3ccd0a4ea088e894f2943e1941613ba00b4
SHA5126749ee05db248ae84f2ba0811bb8b2d2ca98d3f3f487816380f565d44f4a4084c964fa1dd17da5dd5b7dbdd83d30754f16f73be78cf678d5e2b0fe028b46091c
-
Filesize
124KB
MD56c4e8ace568468ad3ed98a45d5397c20
SHA1413ecdb167befda98b16c7b109cbf9eb37ed44c8
SHA256ebdcdeeffabddd53d149fd752aeabf6bf1b689fac4158f643bb78cefb72d0449
SHA512b3f27e3065ce331251e49f8fe4c1b4d13df2916552c2c082b29e024cb8b1d9bc2dcab2c597a357964ffc917773b59a0afba3cf5971c193cdedeee400200d5c5b
-
Filesize
124KB
MD519f42047c450a519c613cd0ed5e7bf49
SHA1a2d46d1163faa3c10ac98778605c3ac0e3bc8b72
SHA256de47b0140950ce8073b6bac7623e281148241aac94472fc6ba2fb106aa51681e
SHA512aa859196c9d5b19707910ed73d15f6c764583bbce78f09a737b4d69fd7593e7eb484535cc6ed0cef4d9485e860318ed174aa9ddf5cfbfa3f3a5d0d00f9851ee4
-
Filesize
124KB
MD5189ae196a974aaf0d4a75d01d8ef3ffa
SHA139103d9bf40f7551262b37b34b5a30c360dfd6f2
SHA256980d82278a17e590035d568421af8bde69da88525227096df7a9e1cf2dfd2f15
SHA512461283d77f6c0e77643675b82bb2297cca9c10ab4a9fee7021f6d67db92150f6d130e82dc28c3ef756aaa93cc3b754afe849503c972c9be72978460659ce223d
-
Filesize
124KB
MD5e854287f744c2fcb6e380d46244c87de
SHA1cfcce123639aa93ccfcf43733ef2ccbe146cb156
SHA256d25c64eac324391614f9b7d5795718635098a3ea3ccc0f2607b6db8e6f2526c0
SHA5122865da3972e2d24e98c48c2955ced208289bdf030f6a31395b70df95d7b18a1a52b2abd27e8bd69f5e4d33e09a928f3bd23d9a14e5959b61960e1f440f8a3992
-
Filesize
124KB
MD55f3f2581c305a811b6d90306b951534e
SHA1f39a7b193b21098f75953b38b80eefcd1e3dfc86
SHA25660dfebb91b8c9511c0d2fe801bc5620eb6fc88b478b89e3ef6c1bc86c03f16fe
SHA51283c297e4fade406f29727f83f1cdc4eefaaea25b57b693920a23e4af1afe39adc4fc7916ccd8d3e91dc0a47ee31bf166ca373e7814fddccc32d9f3ede2a2708c
-
Filesize
124KB
MD510601e743ae4e521efef30438b50debc
SHA17087b430b1d8473a9c1d6847670e4a764fa4cb00
SHA2569d99fbd8ccf38716ac1a187c82664059826dd757ff4150d54ced9ccc7107a5da
SHA512f7b31d01d155b8a8772adb8f8ace821cacec1ece7b082337306797ec0e5a1c7c573f128a4c0e1dffdea31aec8ea6512995a30a434b2a7f1f1b1d9318ff17f5ba
-
Filesize
124KB
MD5cfd7dcb6e7f5bea18ac071afeb97e699
SHA1315aca4ec7e067b0779a860812d7e3eba48225ae
SHA256e7edae8d385d277f3811c12c25177d054db5e5d1b25b74b36284073f23929aee
SHA512a0989a8f89ad0503ec6734156209a610f80b84db91eb9c84af5e7167aeddd7a51ec70d334d6ab9655d8634384346644861af03892a36dbb84f5d0d5421dd43ec
-
Filesize
124KB
MD51f7144f8005134cd5ab26c88642a4454
SHA128fae8c74c0353e62b8451de93beebda387abe5b
SHA256a8c96427fd721c8c90f9808f970c21129d557e4c57ba044678e8d9d08ca2d652
SHA5123ced0632a00e212ac4c4b48448683a248fd1e4f18f31490a22291885d9a442096c3ac50dd5bad79dd69a5b68e20958243b14a555483329e49f9a36f8a6b745f2
-
Filesize
124KB
MD56839911453ad41969befe0b0248f1883
SHA14d47a954e3d22a789987972ed694ca5eb93a1252
SHA256561f39b86628c19e311b35cc6e2edb22c07f3060d536e04b121e5e9cc4296be1
SHA512f8214628587ed28c3f2ea783160a08493138f11d7faa0a215917b1cd0420de5f2ae31a014de8a6c56276199f1a6a8f13348a17b3214f847ecd212a9725efd0e8
-
Filesize
124KB
MD5e1f9946bcd7b07c234f957bd78a09a48
SHA1a3f2789a0e1fdf262dc4104d644c6a3b223315e8
SHA25670f562a3dcfbd4da0cc46e744ec0956065e12878491bc741f8a4f0327d02c792
SHA512d3a138fe26c0aa9ba4ffbd4ed621437c5f87e0f4dcf4f6f406d484f5bb3cb0bb445584b82378d79031024357f3029b810d79fc8c3e92420fd926e5b18b689477
-
Filesize
124KB
MD5583b06525f520ecb1bb20a774f1e5f58
SHA1b1752c1214ab7c90d09460c004063bcc19f47593
SHA2569a7537b31b195b718c6cfa91a07736599b69a33ad7795390888b0419ebe42ea8
SHA512da0e7654c8f91c7772053202c93c0742129ea12ce38620306d07a9303db0e625c391b33fd9568b7b0cb2f2794422270ad1b5e471d61382c136acc4611efe6337
-
Filesize
124KB
MD5708916560020c6389e25456fa5484ecd
SHA1ec2191ba5f0c2a6773dc86394774943dd8f61bdf
SHA256cc438e10c4f88b36d3535f21aa6343b46b9b72b9a58f48065b580a9cd5c12920
SHA5125cd1463b3dd83315eada26309fc4b5101209f48ccedb6966708eba370cbdc6006aeff0650d77db5600d872f1368a7483d62de8752aa0b34f8a709dac653cdd3a