4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84

Analysis

max time kernel
75s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe
Size

22KB
MD5

a9c2bc397fda3ff077b04d5b7ac6706c
SHA1

ff33c3ffc150f9a23dfc7ddac2dd8801b1e29f08
SHA256

4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84
SHA512

007419858c4238e8a89b4bf70df9ec9fd36fe43c22de159fcecf7ea2aef9248da816e15342bb57901fe49213a86bb4a010c7b60ea144411581df06269767a441
SSDEEP

192:/YXEoQewsETX0YMd1oyn3keo+4E5rMdPqaDdDWLkqQl:/QEgwsEoVd1yS5rMhXh6Ql

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

erdou.exe

pid process

2212 erdou.exe

pid	process
2212	erdou.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe

description	pid	process	target process
PID 5012 wrote to memory of 2212	5012	4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe	erdou.exe
PID 5012 wrote to memory of 2212	5012	4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe	erdou.exe
PID 5012 wrote to memory of 2212	5012	4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe	erdou.exe

C:\Users\Admin\AppData\Local\Temp\4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe
"C:\Users\Admin\AppData\Local\Temp\4ff1452566fc312f9630c1fa2a2250a665e1ec3602b7168e4240306b114eae84.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\erdou.exe
  "C:\Users\Admin\AppData\Local\Temp\erdou.exe"
  2⤵
  - Executes dropped EXE
  PID:2212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\erdou.exe

Filesize
22KB

MD5
c8e1bd719171b1f28e1bc42a2cc6bdfc

SHA1
6a71212d04b4c6c3bf7ec029facec3de770d5e2e

SHA256
107d7a155b958e6fd4a20ccba7aa3470d7bf19b591354d50159ef82299d5f633

SHA512
5b2df0437c1f977426e50b0ae4d885d3390f63ef45229dcb4c73bb37097a7560cb92d4f99a5bd150682b43e94aff13c2316412a986c9703f186aa982386a0250

Download Submit
C:\Users\Admin\AppData\Local\Temp\erdou.exe

Filesize
22KB

MD5
c8e1bd719171b1f28e1bc42a2cc6bdfc

SHA1
6a71212d04b4c6c3bf7ec029facec3de770d5e2e

SHA256
107d7a155b958e6fd4a20ccba7aa3470d7bf19b591354d50159ef82299d5f633

SHA512
5b2df0437c1f977426e50b0ae4d885d3390f63ef45229dcb4c73bb37097a7560cb92d4f99a5bd150682b43e94aff13c2316412a986c9703f186aa982386a0250

Download Submit
memory/2212-133-0x0000000000000000-mapping.dmp

Download
memory/2212-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5012-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download