7538b796a9c4a33e641f07e33d30f452bd50631a8a524c1e266ba60f4521c7ce

General

Target

PTdheeUfg.bin.exe
Size

49KB
MD5

3c6ec00a7e34177cb77b44f3d9863516
SHA1

2747e73ccf62262007c8048beafc5d7d6d795c44
SHA256

9555f2dd0ba90755c246c5c15f96c3f4bee4a97e4714f0a99651a93bea592a84
SHA512

aefd6097370303cd64116afcaf97dadd602a9617a41742ae01c810ee3e5d5425c0f1a475e7ccbcae147de6d325bb41d88b495e3b8b77c3f3e8c1ee930d23ec18

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

gdsun.exe

pid process

1000 gdsun.exe
Loads dropped DLL 2 IoCs

Processes:

PTdheeUfg.bin.exe

pid process

344 PTdheeUfg.bin.exe
344 PTdheeUfg.bin.exe
NTFS ADS 1 IoCs

Processes:

PTdheeUfg.bin.exe

description ioc process

File created \??\c:\programdata\1be588a5b7\gdsun.exe:Zone.Identifier PTdheeUfg.bin.exe

pid	process
1000	gdsun.exe

pid	process
344	PTdheeUfg.bin.exe
344	PTdheeUfg.bin.exe

description	ioc	process
File created	\??\c:\programdata\1be588a5b7\gdsun.exe:Zone.Identifier	PTdheeUfg.bin.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PTdheeUfg.bin.exegdsun.exe

description	pid	process	target process
PID 344 wrote to memory of 1000	344	PTdheeUfg.bin.exe	gdsun.exe
PID 344 wrote to memory of 1000	344	PTdheeUfg.bin.exe	gdsun.exe
PID 344 wrote to memory of 1000	344	PTdheeUfg.bin.exe	gdsun.exe
PID 344 wrote to memory of 1000	344	PTdheeUfg.bin.exe	gdsun.exe
PID 1000 wrote to memory of 1588	1000	gdsun.exe	REG.exe
PID 1000 wrote to memory of 1588	1000	gdsun.exe	REG.exe
PID 1000 wrote to memory of 1588	1000	gdsun.exe	REG.exe
PID 1000 wrote to memory of 1588	1000	gdsun.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\PTdheeUfg.bin.exe
"C:\Users\Admin\AppData\Local\Temp\PTdheeUfg.bin.exe"
1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:344
- \??\c:\programdata\1be588a5b7\gdsun.exe
  c:\programdata\1be588a5b7\gdsun.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\1be588a5b7
    3⤵
    PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\0

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\1be588a5b7\gdsun.exe

MD5
3c6ec00a7e34177cb77b44f3d9863516

SHA1
2747e73ccf62262007c8048beafc5d7d6d795c44

SHA256
9555f2dd0ba90755c246c5c15f96c3f4bee4a97e4714f0a99651a93bea592a84

SHA512
aefd6097370303cd64116afcaf97dadd602a9617a41742ae01c810ee3e5d5425c0f1a475e7ccbcae147de6d325bb41d88b495e3b8b77c3f3e8c1ee930d23ec18

Download Submit
\ProgramData\1be588a5b7\gdsun.exe

MD5
3c6ec00a7e34177cb77b44f3d9863516

SHA1
2747e73ccf62262007c8048beafc5d7d6d795c44

SHA256
9555f2dd0ba90755c246c5c15f96c3f4bee4a97e4714f0a99651a93bea592a84

SHA512
aefd6097370303cd64116afcaf97dadd602a9617a41742ae01c810ee3e5d5425c0f1a475e7ccbcae147de6d325bb41d88b495e3b8b77c3f3e8c1ee930d23ec18

Download Submit
\ProgramData\1be588a5b7\gdsun.exe

MD5
3c6ec00a7e34177cb77b44f3d9863516

SHA1
2747e73ccf62262007c8048beafc5d7d6d795c44

SHA256
9555f2dd0ba90755c246c5c15f96c3f4bee4a97e4714f0a99651a93bea592a84

SHA512
aefd6097370303cd64116afcaf97dadd602a9617a41742ae01c810ee3e5d5425c0f1a475e7ccbcae147de6d325bb41d88b495e3b8b77c3f3e8c1ee930d23ec18

Download Submit
memory/344-60-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1000-63-0x0000000000000000-mapping.dmp

Download
memory/1588-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads