be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477

General

Target

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
Size

288KB
MD5

124d87cc3f2c7e27222bf8c13e94b884
SHA1

3043b032c75ec153dd015155e09ea7c54bd8c006
SHA256

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477
SHA512

09a4f6e8ed62d2debabc9e964440589276d708f34152f037f201f6dd516b68db2c09ae740b8911a5d21a249fe42b7fd4998a0f2695233e23004ad4907628d426
SSDEEP

1536:fopUMphvcBESxGFVYguSXq/fiTvlATmeX4Z4R4H4i4/o9FKs0z2xoetEPnyexeyC:IPc98+guucz9/tBH3H3+n

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

guahiix.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	guahiix.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe

Executes dropped EXE 1 IoCs

Processes:

guahiix.exe

pid process

3736 guahiix.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

guahiix.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guahiix = "C:\\Users\\Admin\\guahiix.exe"	guahiix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exeguahiix.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guahiix.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

guahiix.exe

pid	process
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe
3736	guahiix.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exeguahiix.exe

pid process

4992 be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
3736 guahiix.exe

pid	process
4992	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
3736	guahiix.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exeguahiix.exe

description	pid	process	target process
PID 4992 wrote to memory of 3736	4992	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe	guahiix.exe
PID 4992 wrote to memory of 3736	4992	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe	guahiix.exe
PID 4992 wrote to memory of 3736	4992	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe	guahiix.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
PID 3736 wrote to memory of 4992	3736	guahiix.exe	be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe

C:\Users\Admin\AppData\Local\Temp\be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe
"C:\Users\Admin\AppData\Local\Temp\be5f3a41ef84efe97393c07dcac7162a516631ff1d22046ab4be6b222a50e477.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\guahiix.exe
  "C:\Users\Admin\guahiix.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\guahiix.exe

Filesize
288KB

MD5
f0b826eb67290a3fbab1eadbc51f1741

SHA1
8a6af9b50e289a248567372d0263ab337200ec49

SHA256
0a918cc0283a16a0aac6d06e0f1a20500642385014bc908f5c9ade0b73e0bdd5

SHA512
67d6baaf54f1790f4607accf721cd637187a9c01263279e1c3a9d8eeadacf4ceccf6ad675ca5288a6c2200d0ecad431900cbc8a3958e30c48dd98ea7b04fb008

Download Submit
memory/3736-33-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3736-38-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4992-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4992-37-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads