daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414

General

Target

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
Size

802KB
MD5

f13de32bd797d37585860968b8959ed6
SHA1

982d4512571667789df33cee965af591071b8de2
SHA256

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414
SHA512

31436b7f861de980f19eb08961c823a43644680a244f90c209cdac0945dba6e44aac136a0c37cba5e05717e3aae30e9e494ac9fdcbbbabfb343b40664643b704
SSDEEP

12288:LFAd2HHO/3X5eST+57A7bY2079eXz96JnBezokeC9M2:LmqM3JFTuA79Y9ckJnBezokHM

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

pid process

1168 daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

pid	process
1168	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Loads dropped DLL 2 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

pid	process
1172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
1172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\progrmma = "C:\\Program Files (x86)\\popadalovo\\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe"	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Drops file in Program Files directory 2 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

description	ioc	process
File created	C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
File opened for modification	C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exedaaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

pid	process
1736	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
1172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exedaaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

description	pid	process	target process
PID 1736 wrote to memory of 1172	1736	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 1736 wrote to memory of 1172	1736	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 1736 wrote to memory of 1172	1736	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 1736 wrote to memory of 1172	1736	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 1172 wrote to memory of 1168	1172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 1172 wrote to memory of 1168	1172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 1172 wrote to memory of 1168	1172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 1172 wrote to memory of 1168	1172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
"C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
"C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe" runas
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1172

C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
"C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Filesize
802KB

MD5
f13de32bd797d37585860968b8959ed6

SHA1
982d4512571667789df33cee965af591071b8de2

SHA256
daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414

SHA512
31436b7f861de980f19eb08961c823a43644680a244f90c209cdac0945dba6e44aac136a0c37cba5e05717e3aae30e9e494ac9fdcbbbabfb343b40664643b704

Download Submit
\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Filesize
802KB

MD5
f13de32bd797d37585860968b8959ed6

SHA1
982d4512571667789df33cee965af591071b8de2

SHA256
daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414

SHA512
31436b7f861de980f19eb08961c823a43644680a244f90c209cdac0945dba6e44aac136a0c37cba5e05717e3aae30e9e494ac9fdcbbbabfb343b40664643b704

Download Submit
\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Filesize
802KB

MD5
f13de32bd797d37585860968b8959ed6

SHA1
982d4512571667789df33cee965af591071b8de2

SHA256
daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414

SHA512
31436b7f861de980f19eb08961c823a43644680a244f90c209cdac0945dba6e44aac136a0c37cba5e05717e3aae30e9e494ac9fdcbbbabfb343b40664643b704

Download Submit
memory/1168-59-0x0000000000000000-mapping.dmp

Download
memory/1172-55-0x0000000000000000-mapping.dmp

Download
memory/1736-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads