be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477

General

Target

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
Size

288KB
MD5

124d87cc3f2c7e27222bf8c13e94b884
SHA1

3043b032c75ec153dd015155e09ea7c54bd8c006
SHA256

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477
SHA512

09a4f6e8ed62d2debabc9e964440589276d708f34152f037f201f6dd516b68db2c09ae740b8911a5d21a249fe42b7fd4998a0f2695233e23004ad4907628d426
SSDEEP

1536:fopUMphvcBESxGFVYguSXq/fiTvlATmeX4Z4R4H4i4/o9FKs0z2xoetEPnyexeyC:IPc98+guucz9/tBH3H3+n

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

bauuye.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bauuye.exe

Executes dropped EXE 1 IoCs

Processes:

bauuye.exe

pid process

2772 bauuye.exe

Loads dropped DLL 2 IoCs

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe

pid	process
2180	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
2180	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bauuye.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\bauuye = "C:\\Users\\Admin\\bauuye.exe"	bauuye.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exebauuye.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bauuye.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bauuye.exe

pid	process
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe
2772	bauuye.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exebauuye.exe

pid process

2180 be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
2772 bauuye.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exebauuye.exe

description	pid	process	target process
PID 2180 wrote to memory of 2772	2180	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe	bauuye.exe
PID 2180 wrote to memory of 2772	2180	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe	bauuye.exe
PID 2180 wrote to memory of 2772	2180	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe	bauuye.exe
PID 2180 wrote to memory of 2772	2180	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe	bauuye.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 2772 wrote to memory of 2180	2772	bauuye.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe

C:\Users\Admin\AppData\Local\Temp\be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
"C:\Users\Admin\AppData\Local\Temp\be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\bauuye.exe
  "C:\Users\Admin\bauuye.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\bauuye.exe

Filesize
288KB

MD5
6cdcb7c06f97031b1078b195d7e9a75a

SHA1
c90eafdcfe0e7f6532929de3cbc97496a353dd2e

SHA256
8ee59376efde079d8772015726c3325d256df0facbb0265be3d35275b388d0c6

SHA512
bb4282d3a48a775cf2a3de9e48454552f4e7a60c449e75339b4f9ebc4f28a49ce4e86c8909fc7a41c4b1989f64f1bf69dae7c092c6a490939edd205984c7d0a7

Download Submit
memory/2180-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2180-14-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-13-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-20-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2180-21-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-22-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2772-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2772-23-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads