db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1

General

Target

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
Size

156KB
MD5

577ad57f6b38672e14dd70236b6241e5
SHA1

97643ba574dd7de03b270a52b76cbfd4f6414d8e
SHA256

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1
SHA512

34cf0dc109692c531fb9e9a1a844ca1dda96caee38f83c938e50202c37253647e0021f90bc8c1b72c765d454a9d278c18839f665b427fd7b9aae2e4d37979104
SSDEEP

3072:ECbO/tonrGwkAjpWn1KG912QXXU+EnHsRPaVW+E5j4oQAO+:E3GiwkGG9ggkMRPacdpO+

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exensdon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nsdon.exe

Executes dropped EXE 1 IoCs

Processes:

nsdon.exe

pid process

4524 nsdon.exe

pid	process
4524	nsdon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

nsdon.exedb61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /J"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /j"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /O"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /h"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /x"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /I"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /c"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /D"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /v"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /N"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /C"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /b"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /Y"	nsdon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /K"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /B"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /W"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /w"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /t"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /Q"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /q"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /E"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /R"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /p"	nsdon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /S"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /r"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /u"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /A"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /P"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /e"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /y"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /H"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /g"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /i"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /f"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /o"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /n"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /M"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /F"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /k"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /l"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /a"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /d"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /s"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /Z"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /G"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /V"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /L"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /m"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /U"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /h"	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /X"	nsdon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nsdon = "C:\\Users\\Admin\\nsdon.exe /T"	nsdon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exensdon.exe

pid	process
1108	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
1108	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe
4524	nsdon.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exensdon.exe

pid process

1108 db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
4524 nsdon.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe

description	pid	process	target process
PID 1108 wrote to memory of 4524	1108	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe	nsdon.exe
PID 1108 wrote to memory of 4524	1108	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe	nsdon.exe
PID 1108 wrote to memory of 4524	1108	db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe	nsdon.exe

C:\Users\Admin\AppData\Local\Temp\db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe
"C:\Users\Admin\AppData\Local\Temp\db61ba473d850fe2040f53b2fd53ffe224c5e9e7148ec53b8d2c642315d3ccc1.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\nsdon.exe
  "C:\Users\Admin\nsdon.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\nsdon.exe

Filesize
156KB

MD5
c998a01b61cc1f30cfd88f123a4627e8

SHA1
492c7f03dfe8d07868c4f338acfebabdb2bbefdf

SHA256
3c623f15833156d67b9e5547cfb0b833ed8870d83677842c14bcdd6ba8cdedbb

SHA512
1b3e02df0674f6af1a371a62f8273e8dc37c7497a4e5601f2c8e2cda97a2abe239b39e0fd87550a52124a35f51dba8a2d53684c4c9d3f4a50c1c4082bd7568c3

Download Submit
C:\Users\Admin\nsdon.exe

Filesize
156KB

MD5
c998a01b61cc1f30cfd88f123a4627e8

SHA1
492c7f03dfe8d07868c4f338acfebabdb2bbefdf

SHA256
3c623f15833156d67b9e5547cfb0b833ed8870d83677842c14bcdd6ba8cdedbb

SHA512
1b3e02df0674f6af1a371a62f8273e8dc37c7497a4e5601f2c8e2cda97a2abe239b39e0fd87550a52124a35f51dba8a2d53684c4c9d3f4a50c1c4082bd7568c3

Download Submit
memory/4524-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads