daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414

General

Target

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
Size

802KB
MD5

f13de32bd797d37585860968b8959ed6
SHA1

982d4512571667789df33cee965af591071b8de2
SHA256

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414
SHA512

31436b7f861de980f19eb08961c823a43644680a244f90c209cdac0945dba6e44aac136a0c37cba5e05717e3aae30e9e494ac9fdcbbbabfb343b40664643b704
SSDEEP

12288:LFAd2HHO/3X5eST+57A7bY2079eXz96JnBezokeC9M2:LmqM3JFTuA79Y9ckJnBezokHM

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

pid process

3172 daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

pid	process
3172	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exedaaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\progrmma = "C:\\Program Files (x86)\\popadalovo\\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe"	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Drops file in Program Files directory 2 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

description	ioc	process
File created	C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
File opened for modification	C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exedaaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

pid	process
3528	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
3528	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
5044	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
5044	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exedaaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

description	pid	process	target process
PID 3528 wrote to memory of 5044	3528	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 3528 wrote to memory of 5044	3528	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 3528 wrote to memory of 5044	3528	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 5044 wrote to memory of 3172	5044	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 5044 wrote to memory of 3172	5044	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
PID 5044 wrote to memory of 3172	5044	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe	daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
"C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528

C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
"C:\Users\Admin\AppData\Local\Temp\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe" runas
2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044

C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe
"C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Filesize
802KB

MD5
f13de32bd797d37585860968b8959ed6

SHA1
982d4512571667789df33cee965af591071b8de2

SHA256
daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414

SHA512
31436b7f861de980f19eb08961c823a43644680a244f90c209cdac0945dba6e44aac136a0c37cba5e05717e3aae30e9e494ac9fdcbbbabfb343b40664643b704

Download Submit
C:\Program Files (x86)\popadalovo\daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414.exe

Filesize
802KB

MD5
f13de32bd797d37585860968b8959ed6

SHA1
982d4512571667789df33cee965af591071b8de2

SHA256
daaa2080806a9aa60f5b34d216008f563a5b8f1e0280ee5a8242ee3e288ab414

SHA512
31436b7f861de980f19eb08961c823a43644680a244f90c209cdac0945dba6e44aac136a0c37cba5e05717e3aae30e9e494ac9fdcbbbabfb343b40664643b704

Download Submit
memory/3172-133-0x0000000000000000-mapping.dmp

Download
memory/5044-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads