Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 23:27
Behavioral task
behavioral1
Sample
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
Resource
win10v2004-20220812-en
General
-
Target
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
-
Size
1.2MB
-
MD5
d47395885a6c44a916212dcf8cef180e
-
SHA1
8ae9094b2bfb79dc020d4139d823f12124cf56d3
-
SHA256
e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6
-
SHA512
5313c5be4b2b61bda4993cb75c44d1b51ae6f5c8a1e9f2bab0491461411373e0543c1e9d6bb10c6bdd0539b8702e84c3340aa3ab4432f69d0341d6c6690d829f
-
SSDEEP
24576:WD0tM85tbNJjldeYiY39Ox7MKEZH+5jOTWGyG:WD0tM85DJjl/iqN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1992 Sdat.exe -
resource yara_rule behavioral1/memory/1572-55-0x0000000000400000-0x00000000004DF000-memory.dmp upx behavioral1/memory/1572-66-0x0000000000400000-0x00000000004DF000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1972 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1572-66-0x0000000000400000-0x00000000004DF000-memory.dmp autoit_exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\PCGWIN32.LI5 Sdat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04} Sdat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04}\ = 858bb89073c1bb505b8944527d01227e69e2b67e5ae307f85466c53b1a58bfb923e1c0b1029187852baa88a832d6d7847bc8d810f9071ab400d9973e8b6308100c39d35abffe232260b95121fec69d7b01e7cafb481f317caa6391d0318f6a4cd7d0fbbed81cfc019c82be61a2aec9d3d2c7097b2d206eb313a0001222e250517d926178cadd96fe0a6211c18509e98e11ed4212d107318b9ef7c36b60a8bb56744b3b70581dc67e2a9d5742c41126b9eba5ef058c1a6f798c1a1138bde55de9c24d8ece2c722d9191fdf19d51bd729d99c27a911fb2bcd7a2841e47c3940ff98ca2edb632a457a8f4892952f2f8dee0fc44a22b80904386384add0902ea972e3bf398a73c2b9d680197fa4b60683d77e26b0ef06dea4e11f3f290a94312d73efba35faffc2c5cf3bd201d80be1a5d79829a3f7ea31d1f7e7c9d9f81832ef00cdfefc3f3a7978bbbd7604b4dc80e5273bfe7232be0b0d01cf9c3d9187dbd225eb97ca65dfb7ea0e3a2985e7d3da2de300297b70b5b90780c61cf511336802b5610450d4ace76522b0108b60ba43065e126a2950685353956e6c51426875524ca67f05b1cf83fda9c01fdd21e4703cbe8d76c0b3108aa4dae12134737a494fb46605b78405915064a2b91d0728d602e370cd48dca6d7672251186f68ae52ea6cd942db692643ff75c94bdf59de601e4fa781e2343b85865fdaae171d516b9f59d16becb6350d73ffba3674fc4ec5652b58715c4c6779aff50837318f6473791c0bd999b34c006379c76ff0738131f10818c9fb977062ae0b759a127cf8d95237bd0d5b61454b9b7e6eb0597eabbb160e23d66a2abf737dbe407c6e4bb7a4c1981fe3a62e149c196c9f5f5d5aa096f0a8ccf1193faffe663aaa0880588899369b792eb76af1bf3f8271c24c1f77d5be200e79304c8791361f8ead8b6c45ac4817b31205ee383209855044527b674641bd538852769e4b2562e7badd81185c63a54593782d4be48220f01ac8292794e590d3aaedfb2c311b739dba27f88dc0f03ecafcc3392508e71929af1bfa223ff701ce101e58dea91ce0d721251887aee1f32035fd03cc221562acb2f08139478ca5d08be75e2d69034bed7a38b48f7f65b94b838df1dbc82e1511a45074ad451440a69cfae0cb2d117820b69e8ae8a0d6e916d05327a2f67eca4d355470604d569ca4ea9ad95edb9b1655dea82b7d6148a7990617fd21cf6831bd000f49858be391ca27da1a2c6bf5a5c87fccba26f26ac750c96adb4ce2b2dd0ee3bcca7f20bd69045073a64a6668485f4459ae6bea49d1a7e07dc648027eec4d20bc87055603aadd9913e0d5d2e3e4d1c323f261c353ddae28668f411687aeb990881e90df15295b7b9d4d9bbbda061c9fe75dda67df41e684369984abc0f22332fd0b3f8d79c3bbe605dd33ef79d14c2c727941b7bb89898017d952239e79e3403eb6090723be11f8dfc31de12bc7fdc1c3c3e1f23bce09cbe7c225d373e64233708d4d5768a2b0890ef84330be02f8cec6ece534cf8cf9d0cfeace330e7ab5b083892e34e67b3345797f4c46809b5ce16b3cb1ff7fcab624f21acb62c95d1ca095072c96715e4b6f82b1e8f3d33e268585747f4cbd497f8fbdc277f5463f5b0295eca3da8a22ca8cd2d12ceffd25c803d4ee253370864317a1ad93e85631548ca6911cab28f286cb5eed9b23d1ee27d9e6202a9e18a3628a5093552e6073a04e1f9659e1a43bf985c7f81dc42bdd95e45c286b604dacbc6cf2a8c0f93acf0b0ab6c681389b8eea6cc1532fad9d881fe25a26a985741c4468bf4376414fb4520da59793a9e21437a6fe66c144f450cc6d1cafaef9fac83aebf4c637310284b57f0c42b774894f777eb243745d4967ab4e7e824cca7f064ad7a5219873e1463cb08f7f3eb17b774ab19b0feae62ac07b04497b574ea2751547df69e2a426f110cc62dd452463fd51c49018e311212810f5e4cc351478e64b2f52856ed8511258a7a099f89832d27921431865ec4834487b51b19c046e48ba7e8b44daa7190568235bf665c9503b58fdab3ff271c343e57a3044fe58c3a0ea6532af08f2d4cb1cf11ac4a4d91f1b9ddde3dfd22ddbf415c7a42a741947608252f164c45333618e50345d846bbbb27e7c4bb489f117c861d85feeae3afb86ca0eca8ee483211694a52f1cf528cce5332b09fe303a8d86d01edeacd6f11f33aef5f337c109dbbc260f85c647f575c843f65dce6c3547f4b1cc8bd8da1ee360de56e0af38818d4f9389a23f99861c5f216663babd83078aa656886f1da59c64665f44596a6c444eaebc897534b7fd05c873dd422c53706e42aa9b7eaab1770c45be4c7caabc8174b0477c594fa44583b3b9898b88067731450b7f29ba87f081c49bfaaa39048c32ba0a8a78e9b32bf11a3bae09ebf42dc573dc462abd1080216e9f58ea51279379ea47c87e1d45d74be97ddcb7e6fa36c3f719c613c2eddf37ee7236bafd07370a8652ca6ef9a3307601b0dc0cefe6c62330190a2b69e64026bf110e97bd6d88b03e8984e06f3956735a496c5cb562885104a8b68b7536440372194e6bad51eb6fdaa1db67e64233b1860c5e7ba145f877c44e2a9aeee0c934d8f5293b1b79ae47fb51cdabcc160c19f750356d84b3c105f0a7c37e1d4d94a05492ac99751f4c225111672bad9de3e3ca2631000833f701cef7f535cb0bfdedc42bd5f5ebc835f373c94e3f8e8de914381184dff321ce97fd5637588ea682917cab4a9aa1571c6660aead76ebbd367f0b466282beb90cfb8cc1bb1c0dede7c829d563d75e2e63e6ba3f7c8eb492f964c0a1191c6096a964f34f39ba73f2b9c483c91df81032290103efddde17e5523368795abf6f7d4ab34af15acc653ba38e0634acfd7537bc860eb9310cf7bf32058f7075bbb005fa3bcd7223bc9e0f1cadae9b992e6cf742ca710ebb5af99d33e071c64bdf761dbaac0c8a9d4f64b2b57d074852735342a2b4f37ec2431f76a5bd77834e6db8ab816df053cb61c5b83b88fe36c9013b68854e9052a9a2886755b6a788f23f30fdfcc3cd2e1708ee50d5552b6811a8187d964fd89e15656057aca992fb98c591202c97711d4ca494e8e0d328eaf4dd3ee378d24119b36bfa52386d03a0e616dda72c0d9e1ba9e61fd9a6106fa555eba83de0082c3aec7b28b978fbbf3a7578bb488276b9b104773a4a00a86b1f416a675ca9ad67904226b9e707c97a1445129f2aa9090487aeb27e8b468a83169a22e86ad2bf2f0d8ec44ec49eeb6536b473044e725f41a6607e5f46999b2fa2f5eb383270784d4150a7ab760d493074724c4d94686752ae91149b696e50446bb6ae071d22a4e6933b6e864146b8930ce21137638dae14661b51e697d0ea293f8709895b836da948076a09bb53f95dc853e65a33a3859a0c65a6bf988a5575534b6aa149075f49694f58a56898b5670ca1dd0427aeee7726be950ce832dbf6e1c2dc12d2ace8e8c2c6e516d822e9e7303a03f4edc0dc2b27e5fddfc7d5e9ebdfcdd607d459eb63c55a3fae0a7f87420d8e9f8a91c357d6622951945064adb117f0a5c6fbd2c9d323e2722e49f764315a08a00907d76a255d10a4e69b3b2686854714b2608152d050e0acdf171a95ae98771eb9e Sdat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04}\ = 288b371673c1bb505b8944527d01227e69e2b67e5ae307f85466c53b1a58bfb923e1c0b1029187852baa88a832d6d7847bc8d810f9071ab400d9973e8b6308100c39d35abffe232260b95121fec69d7b01e7cafb481f317caa6391d0318f6a4cd7d0fbbed81cfc019c82be61a2aec9d3d2c7097b2d206eb313a0001222e250517d926178cadd96fe0a6211c18509e98e11ed4212d107318b9ef7c36b60a8bb56734b3b70581dc67e2a9d5742c41126b9eba5ef058c1a6f798c1a1138bde55de9c24d8ece2c722d9191fdf19d51bd729d99c27a911fb2bcd7a2841e47c3940ff98ca2edb632a457a8f4892952f2f8dee0fc44a22b80904386384add0902ea972e3bf398a73c2b9d680197fa4b60683d77e26b0ef06dea4e11f3f290a94312d73efba35faffc2c5cf3bd201d80be1a5d79829a3f7ea31d1f7e7c9d9f81832ef00cdfefc3f3a7978bbbd7604b4dc80e5273bfe7232be0b0d01cf9c3d9187dbd225eb97ca65dfb7ea0e3a2985e7d3da2de300297b70b5b90780c61cf511336802b5610450d4ace76522b0108b60ba43065e126a2950685353956e6c51426875524ca67f05b1cf83fda9c01fdd21e4703cbe8d76c0b3108aa4dae12134737a494fb46605b78405915064a2b91d0728d602e370cd48dca6d7672251186f68ae52ea6cd942db692643ff75c94bdf59de601e4fa781e2343b85865fdaae171d516b9f59d16becb6350d73ffba3674fc4ec5652b58715c4c6779aff50837318f6473791c0bd999b34c006379c76ff0738131f10818c9fb977062ae0b759a127cf8d95237bd0d5b61454b9b7e6eb0597eabbb160e23d66a2abf737dbe407c6e4bb7a4c1981fe3a62e149c196c9f5f5d5aa096f0a8ccf1193faffe663aaa0880588899369b792eb76af1bf3f8271c24c1f77d5be200e79304c8791361f8ead8b6c45ac4817b31205ee383209855044527b674641bd538852769e4b2562e7badd81185c63a54593782d4be48220f01ac8292794e590d3aaedfb2c311b739dba27f88dc0f03ecafcc3392508e71929af1bfa223ff701ce101e58dea91ce0d721251887aee1f32035fd03cc221562acb2f08139478ca5d08be75e2d69034bed7a38b48f7f65b94b838df1dbc82e1511a45074ad451440a69cfae0cb2d117820b69e8ae8a0d6e916d05327a2f67eca4d355470604d569ca4ea9ad95edb9b1655dea82b7d6148a7990617fd21cf6831bd000f49858be391ca27da1a2c6bf5a5c87fccba26f26ac750c96adb4ce2b2dd0ee3bcca7f20bd69045073a64a6668485f4459ae6bea49d1a7e07dc648027eec4d20bc87055603aadd9913e0d5d2e3e4d1c323f261c353ddae28668f411687aeb990881e90df15295b7b9d4d9bbbda061c9fe75dda67df41e684369984abc0f22332fd0b3f8d79c3bbe605dd33ef79d14c2c727941b7bb89898017d952239e79e3403eb6090723be11f8dfc31de12bc7fdc1c3c3e1f23bce09cbe7c225d373e64233708d4d5768a2b0890ef84330be02f8cec6ece534cf8cf9d0cfeace330e7ab5b083892e34e67b3345797f4c46809b5ce16b3cb1ff7fcab624f21acb62c95d1ca095072c96715e4b6f82b1e8f3d33e268585747f4cbd497f8fbdc277f5463f5b0295eca3da8a22ca8cd2d12ceffd25c803d4ee253370864317a1ad93e85631548ca6911cab28f286cb5eed9b23d1ee27d9e6202a9e18a3628a5093552e6073a04e1f9659e1a43bf985c7f81dc42bdd95e45c286b604dacbc6cf2a8c0f93acf0b0ab6c681389b8eea6cc1532fad9d881fe25a26a985741c4468bf4376414fb4520da59793a9e21437a6fe66c144f450cc6d1cafaef9fac83aebf4c637310284b57f0c42b774894f777eb243745d4967ab4e7e824cca7f064ad7a5219873e1463cb08f7f3eb17b774ab19b0feae62ac07b04497b574ea2751547df69e2a426f110cc62dd452463fd51c49018e311212810f5e4cc351478e64b2f52856ed8511258a7a099f89832d27921431865ec4834487b51b19c046e48ba7e8b44daa7190568235bf665c9503b58fdab3ff271c343e57a3044fe58c3a0ea6532af08f2d4cb1cf11ac4a4d91f1b9ddde3dfd22ddbf415c7a42a741947608252f164c45333618e50345d846bbbb27e7c4bb489f117c861d85feeae3afb86ca0eca8ee483211694a52f1cf528cce5332b09fe303a8d86d01edeacd6f11f33aef5f337c109dbbc260f85c647f575c843f65dce6c3547f4b1cc8bd8da1ee360de56e0af38818d4f9389a23f99861c5f216663babd83078aa656886f1da59c64665f44596a6c444eaebc897534b7fd05c873dd422c53706e42aa9b7eaab1770c45be4c7caabc8174b0477c594fa44583b3b9898b88067731450b7f29ba87f081c49bfaaa39048c32ba0a8a78e9b32bf11a3bae09ebf42dc573dc462abd1080216e9f58ea51279379ea47c87e1d45d74be97ddcb7e6fa36c3f719c613c2eddf37ee7236bafd07370a8652ca6ef9a3307601b0dc0cefe6c62330190a2b69e64026bf110e97bd6d88b03e8984e06f3956735a496c5cb562885104a8b68b7536440372194e6bad51eb6fdaa1db67e64233b1860c5e7ba145f877c44e2a9aeee0c934d8f5293b1b79ae47fb51cdabcc160c19f750356d84b3c105f0a7c37e1d4d94a05492ac99751f4c225111672bad9de3e3ca2631000833f701cef7f535cb0bfdedc42bd5f5ebc835f373c94e3f8e8de914381184dff321ce97fd5637588ea682917cab4a9aa1571c6660aead76ebbd367f0b466282beb90cfb8cc1bb1c0dede7c829d563d75e2e63e6ba3f7c8eb492f964c0a1191c6096a964f34f39ba73f2b9c483c91df81032290103efddde17e5523368795abf6f7d4ab34af15acc653ba38e0634acfd7537bc860eb9310cf7bf32058f7075bbb005fa3bcd7223bc9e0f1cadae9b992e6cf742ca710ebb5af99d33e071c64bdf761dbaac0c8a9d4f64b2b57d074852735342a2b4f37ec2431f76a5bd77834e6db8ab816df053cb61c5b83b88fe36c9013b68854e9052a9a2886755b6a788f23f30fdfcc3cd2e1708ee50d5552b6811a8187d964fd89e15656057aca992fb98c591202c97711d4ca494e8e0d328eaf4dd3ee378d24119b36bfa52386d03a0e616dda72c0d9e1ba9e61fd9a6106fa555eba83de0082c3aec7b28b978fbbf3a7578bb488276b9b104773a4a00a86b1f416a675ca9ad67904226b9e707c97a1445129f2aa9090487aeb27e8b468a83169a22e86ad2bf2f0d8ec44ec49eeb6536b473044e725f41a6607e5f46999b2fa2f5eb383270784d4150a7ab760d493074724c4d94686752ae91149b696e50446bb6ae071d22a4e6933b6e864146b8930ce21137638dae14661b51e697d0ea293f8709895b836da948076a09bb53f95dc853e65a33a3859a0c65a6bf988a5575534b6aa149075f49694f58a56898b5670ca1dd0427aeee7726be950ce832dbf6e1c2dc12d2ace8e8c2c6e516d822e9e7303a03f4edc0dc2b27e5fddfc7d5e9ebdfcdd607d459eb63c55a3fae0a7f87420d8e9f8a91c357d6622951945064adb117f0a5c6fbd2c9d323e2722e49f764315a08a00907d76a255d10a4e69b3b2686854714b2608152d050e0acdf171a95ae98771eb9e Sdat.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1288 PING.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1572 wrote to memory of 1992 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 27 PID 1572 wrote to memory of 1992 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 27 PID 1572 wrote to memory of 1992 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 27 PID 1572 wrote to memory of 1992 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 27 PID 1572 wrote to memory of 1972 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 28 PID 1572 wrote to memory of 1972 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 28 PID 1572 wrote to memory of 1972 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 28 PID 1572 wrote to memory of 1972 1572 e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe 28 PID 1972 wrote to memory of 1288 1972 cmd.exe 30 PID 1972 wrote to memory of 1288 1972 cmd.exe 30 PID 1972 wrote to memory of 1288 1972 cmd.exe 30 PID 1972 wrote to memory of 1288 1972 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe"C:\Users\Admin\AppData\Local\Temp\e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Roaming\Sdat.exeC:\Users\Admin\AppData\Roaming\Sdat.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:1992
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 0.0.0.1 -n 1 -w 1000 & del e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\PING.EXEping 0.0.0.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:1288
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD563f5cafa5db0ea7725a1f88126e79c69
SHA16045945dabbc10e8503993bf487d10f9268d55d7
SHA256d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94
SHA512a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c
-
Filesize
219KB
MD563f5cafa5db0ea7725a1f88126e79c69
SHA16045945dabbc10e8503993bf487d10f9268d55d7
SHA256d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94
SHA512a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c
-
Filesize
219KB
MD563f5cafa5db0ea7725a1f88126e79c69
SHA16045945dabbc10e8503993bf487d10f9268d55d7
SHA256d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94
SHA512a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c
-
Filesize
219KB
MD563f5cafa5db0ea7725a1f88126e79c69
SHA16045945dabbc10e8503993bf487d10f9268d55d7
SHA256d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94
SHA512a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c