ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803

General

Target

ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
Size

192KB
MD5

1c2b64dcb9286f43bc48ed90fe73a54f
SHA1

36301fdb5937a2e418c6c71aa1a33158f502c3e7
SHA256

ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803
SHA512

956e7d60264c58c667c396aba92a5a0c1b3062e3af492ef5adb1376e5ec311dc947f123134e98b680dd2c5bf317a765e08355e7c999576bde971b833499e4910
SSDEEP

3072:KwBJP6h+RH5UL1iUG3KgKLKRKSdNIVqR5VxerayK/fObT/bGicFgvXb6jGJoX:KwBJCcRZSgKgKLKRKSdNIVqRTxEpK/fD

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exegdnean.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	gdnean.exe

Executes dropped EXE 1 IoCs

Processes:

gdnean.exe

pid process

1384 gdnean.exe

pid	process
1384	gdnean.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

gdnean.exeee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /d"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /b"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /I"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /Z"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /w"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /C"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /g"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /L"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /x"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /F"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /X"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /W"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /V"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /B"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /c"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /J"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /O"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /k"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /A"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /s"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /e"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /U"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /j"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /S"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /z"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /T"	gdnean.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /U"	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /n"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /q"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /m"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /K"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /r"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /o"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /N"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /h"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /G"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /t"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /M"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /R"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /Q"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /f"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /P"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /Y"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /H"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /l"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /y"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /i"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /v"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /D"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /p"	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /E"	gdnean.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	gdnean.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdnean = "C:\\Users\\Admin\\gdnean.exe /a"	gdnean.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exegdnean.exe

pid	process
5036	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
5036	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe
1384	gdnean.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exegdnean.exe

pid process

5036 ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
1384 gdnean.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe

description	pid	process	target process
PID 5036 wrote to memory of 1384	5036	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe	gdnean.exe
PID 5036 wrote to memory of 1384	5036	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe	gdnean.exe
PID 5036 wrote to memory of 1384	5036	ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe	gdnean.exe

C:\Users\Admin\AppData\Local\Temp\ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe
"C:\Users\Admin\AppData\Local\Temp\ee3690adc9ca4fb4dbb43b23328881db76a325d134c493fce2cee2fa27f4f803.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\gdnean.exe
"C:\Users\Admin\gdnean.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\gdnean.exe

Filesize
192KB

MD5
f868d1782956d3becb7af6d6052c1c53

SHA1
dab3a582961675f3a33537abb9a66b4f91189743

SHA256
c8112ebea7345013e33957469b29ab35f242cf4fec580d1c2a456e5a44442634

SHA512
824ce7af03175ede5747b17862eae5499373c143aabf7cb48aaa33ca406144d06927f487633d010b7c6cbfc3a6fb74ce29a0e22b9d6c0ec63cf3b04e23ce0833

Download Submit
C:\Users\Admin\gdnean.exe

Filesize
192KB

MD5
f868d1782956d3becb7af6d6052c1c53

SHA1
dab3a582961675f3a33537abb9a66b4f91189743

SHA256
c8112ebea7345013e33957469b29ab35f242cf4fec580d1c2a456e5a44442634

SHA512
824ce7af03175ede5747b17862eae5499373c143aabf7cb48aaa33ca406144d06927f487633d010b7c6cbfc3a6fb74ce29a0e22b9d6c0ec63cf3b04e23ce0833

Download Submit
memory/1384-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads