1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106

General

Target

1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
Size

224KB
MD5

285300291a971302cdc3a2f44bb525bc
SHA1

51509fbc064807dca793981b24c055bcb4e41299
SHA256

1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106
SHA512

11d350125157863665f1f3257e065c29e0c5d1a2cb2399d0a90742afd1991e398c0ceaa8e7e9c530a2e22f2a8c815937a2757336465cb08963190e8612d5349f
SSDEEP

3072:xXyqNsMoBu+ZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbax2+l:AqN5Op4LnbmlrZW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exepeodu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	peodu.exe

Executes dropped EXE 1 IoCs

Processes:

peodu.exe

pid process

1684 peodu.exe

pid	process
1684	peodu.exe

Loads dropped DLL 2 IoCs

Processes:

1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe

pid	process
1492	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
1492	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

peodu.exe1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /q"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /j"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /n"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /b"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /y"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /z"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /p"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /x"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /h"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /v"	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /r"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /f"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /a"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /v"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /i"	peodu.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /d"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /l"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /s"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /e"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /u"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /c"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /o"	peodu.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /g"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /w"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /k"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /m"	peodu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\peodu = "C:\\Users\\Admin\\peodu.exe /t"	peodu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exepeodu.exe

pid	process
1492	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe
1684	peodu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exepeodu.exe

pid process

1492 1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
1684 peodu.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe

description	pid	process	target process
PID 1492 wrote to memory of 1684	1492	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe	peodu.exe
PID 1492 wrote to memory of 1684	1492	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe	peodu.exe
PID 1492 wrote to memory of 1684	1492	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe	peodu.exe
PID 1492 wrote to memory of 1684	1492	1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe	peodu.exe

C:\Users\Admin\AppData\Local\Temp\1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe
"C:\Users\Admin\AppData\Local\Temp\1df742e1dc34bfdc71835555238e4be59d858b7c0615f9ec0e33de19f25b9106.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\peodu.exe
"C:\Users\Admin\peodu.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\peodu.exe
Filesize
224KB

MD5
34ac1bcc1923643500c90e17d33facd5

SHA1
4bde9e0ef8261ee2e5bc0e39069508f8f64822a5

SHA256
983e9e93fb788af95c9422ff6f4ff5becf17772b35d369192db3c4d745d84cc7

SHA512
8e02332603fa0add1b2b009bd11ce57dbf6b0fee071c8174206ce595328525c7ccb154b94d77c62b4adc498c0066467ca95497f6aaafbcf01d46c77e3fa46b4a

Download Submit
C:\Users\Admin\peodu.exe
Filesize
224KB

MD5
34ac1bcc1923643500c90e17d33facd5

SHA1
4bde9e0ef8261ee2e5bc0e39069508f8f64822a5

SHA256
983e9e93fb788af95c9422ff6f4ff5becf17772b35d369192db3c4d745d84cc7

SHA512
8e02332603fa0add1b2b009bd11ce57dbf6b0fee071c8174206ce595328525c7ccb154b94d77c62b4adc498c0066467ca95497f6aaafbcf01d46c77e3fa46b4a

Download Submit
\Users\Admin\peodu.exe
Filesize
224KB

MD5
34ac1bcc1923643500c90e17d33facd5

SHA1
4bde9e0ef8261ee2e5bc0e39069508f8f64822a5

SHA256
983e9e93fb788af95c9422ff6f4ff5becf17772b35d369192db3c4d745d84cc7

SHA512
8e02332603fa0add1b2b009bd11ce57dbf6b0fee071c8174206ce595328525c7ccb154b94d77c62b4adc498c0066467ca95497f6aaafbcf01d46c77e3fa46b4a

Download Submit
\Users\Admin\peodu.exe
Filesize
224KB

MD5
34ac1bcc1923643500c90e17d33facd5

SHA1
4bde9e0ef8261ee2e5bc0e39069508f8f64822a5

SHA256
983e9e93fb788af95c9422ff6f4ff5becf17772b35d369192db3c4d745d84cc7

SHA512
8e02332603fa0add1b2b009bd11ce57dbf6b0fee071c8174206ce595328525c7ccb154b94d77c62b4adc498c0066467ca95497f6aaafbcf01d46c77e3fa46b4a

Download Submit
memory/1492-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1684-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads