e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6

General

Target

e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
Size

1.2MB
MD5

d47395885a6c44a916212dcf8cef180e
SHA1

8ae9094b2bfb79dc020d4139d823f12124cf56d3
SHA256

e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6
SHA512

5313c5be4b2b61bda4993cb75c44d1b51ae6f5c8a1e9f2bab0491461411373e0543c1e9d6bb10c6bdd0539b8702e84c3340aa3ab4432f69d0341d6c6690d829f
SSDEEP

24576:WD0tM85tbNJjldeYiY39Ox7MKEZH+5jOTWGyG:WD0tM85DJjl/iqN

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3988	Sdat.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4700-137-0x0000000000400000-0x00000000004DF000-memory.dmp	upx
behavioral2/memory/4700-139-0x0000000000400000-0x00000000004DF000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4700-137-0x0000000000400000-0x00000000004DF000-memory.dmp	autoit_exe
behavioral2/memory/4700-139-0x0000000000400000-0x00000000004DF000-memory.dmp	autoit_exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI5	Sdat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04}	Sdat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04}\ = 4f31d83173c1bb505b8944527d01227e69e2b67e5ae307f85466c53b1a58bfb923e1c0b1029187852baa88a832d6d7847bc8d810f9071ab400d9973e8b6308100c39d35abffe232260b95121fec69d7b01e7cafb481f317caa6391d0318f6a4cd7d0fbbed81cfc019c82be61a2aec9d3d2c7097b2d206eb313a0001222e250517d926178cadd96fe0a6211c18509e98e11ed4212d107318b9ef7c36b60a8bb56744b3b70581dc67e2a9d5742c41126b9eba5ef058c1a6f798c1a1138bde55de9c24d8ece2c722d9191fdf19d51bd729d99c27a911fb2bcd7a2841e47c3940ff98ca2edb632a457a8f4892952f2f8dee0fc44a22b80904386384add0902ea972e3bf398a73c2b9d680197fa4b60683d77e26b0ef06dea4e11f3f290a94312d73efba35faffc2c5cf3bd201d80be1a5d79829a3f7ea31d1f7e7c9d9f81832ef00cdfefc3f3a7978bbbd7604b4dc80e5273bfe7232be0b0d01cf9c3d9187dbd225eb97ca65dfb7ea0e3a2985e7d3da2de300297b70b5b90780c61cf511336802b5610450d4ace76522b0108b60ba43065e126a2950685353956e6c51426875524ca67f05b1cf83fda9c01fdd21e4703cbe8d76c0b3108aa4dae12134737a494fb46605b78405915064a2b91d0728d602e370cd48dca6d7672251186f68ae52ea6cd942db692643ff75c94bdf59de601e4fa781e2343b85865fdaae171d516b9f59d16becb6350d73ffba3674fc4ec5652b58715c4c6778d729dfd7318f6473791c0bd999b34c006379c76ff0738131f10818c9fb977062ae0b759a127cf8d95237bd0d5b61454b9b7e6eb0597eabbb160e23d66a2abf737dbe407c6e4bb7a4c1981fe3a62e149c196c9f5f5d5aa096f0a8ccf1193faffe663aaa0880588899369b792eb76af1bf3f8271c24c1f77d5be200e79304c8791361f8ead8b6c45ac4817b31205ee383209855044527b674641bd538852769e4b2562e7badd81185c63a54593782d4be48220f01ac8292794e590d3aaedfb2c311b739dba27f88dc0f03ecafcc3392508e71929af1bfa223ff701ce101e58dea91ce0d721251887aee1f32035fd03cc221562acb2f08139478ca5d08be75e2d69034bed7a38b48f7f65b94b838df1dbc82e1511a45074ad451440a69cfae0cb2d117820b69e8ae8a0d6e916d05327a2f67eca4d355470604d569ca4ea9ad95edb9b1655dea82b7d6148a7990617fd21cf6831bd000f49858be391ca27da1a2c6bf5a5c87fccba26f26ac750c96adb4ce2b2dd0ee3bcca7f20bd69045073a64a6668485f4459ae6bea49d1a7e07dc648027eec4d20bc87055603aadd9913e0d5d2e3e4d1c323f261c353ddae28668f411687aeb990881e90df15295b7b9d4d9bbbda061c9fe75dda67df41e684369984abc0f22332fd0b3f8d79c3bbe605dd33ef79d14c2c727941b7bb89898017d952239e79e3403eb6090723be11f8dfc31de12bc7fdc1c3c3e1f23bce09cbe7c225d373e64233708d4d5768a2b0890ef84330be02f8cec6ece534cf8cf9d0cfeace330e7ab5b083892e34e67b3345797f4c46809b5ce16b3cb1ff7fcab624f21acb62c95d1ca095072c96715e4b6f82b1e8f3d33e268585747f4cbd497f8fbdc277f5463f5b0295eca3da8a22ca8cd2d12ceffd25c803d4ee253370864317a1ad93e85631548ca6911cab28f286cb5eed9b23d1ee27d9e6202a9e18a3628a5093552e6073a04e1f9659e1a43bf985c7f81dc42bdd95e45c286b604dacbc6cf2a8c0f93acf0b0ab6c681389b8eea6cc1532fad9d881fe25a26a985741c4468bf4376414fb4520da59793a9e21437a6fe66c144f450cc6d1cafaef9fac83aebf4c637310284b57f0c42b774894f777eb243745d4967ab4e7e824cca7f064ad7a5219873e1463cb08f7f3eb17b774ab19b0feae62ac07b04497b574ea2751547df69e2a426f110cc62dd452463fd51c49018e311212810f5e4cc351478e64b2f52856ed8511258a7a099f89832d27921431865ec4834487b51b19c046e48ba7e8b44daa7190568235bf665c9503b58fdab3ff271c343e57a3044fe58c3a0ea6532af08f2d4cb1cf11ac4a4d91f1b9ddde3dfd22ddbf415c7a42a741947608252f164c45333618e50345d846bbbb27e7c4bb489f117c861d85feeae3afb86ca0eca8ee483211694a52f1cf528cce5332b09fe303a8d86d01edeacd6f11f33aef5f337c109dbbc260f85c647f575c843f65dce6c3547f4b1cc8bd8da1ee360de56e0af38818d4f9389a23f99861c5f216663babd83078aa656886f1da59c64665f44596a6c444eaebc897534b7fd05c873dd422c53706e42aa9b7eaab1770c45be4c7caabc8174b0477c594fa44583b3b9898b88067731450b7f29ba87f081c49bfaaa39048c32ba0a8a78e9b32bf11a3bae09ebf42dc573dc462abd1080216e9f58ea51279379ea47c87e1d45d74be97ddcb7e6fa36c3f719c613c2eddf37ee7236bafd07370a8652ca6ef9a3307601b0dc0cefe6c62330190a2b69e64026bf110e97bd6d88b03e8984e06f3956735a496c5cb562885104a8b68b7536440372194e6bad51eb6fdaa1db67e64233b1860c5e7ba145f877c44e2a9aeee0c934d8f5293b1b79ae47fb51cdabcc160c19f750356d84b3c105f0a7c37e1d4d94a05492ac99751f4c225111672bad9de3e3ca2631000833f701cef7f535cb0bfdedc42bd5f5ebc835f373c94e3f8e8de914381184dff321ce97fd5637588ea682917cab4a9aa1571c6660aead76ebbd367f0b466282beb90cfb8cc1bb1c0dede7c829d563d75e2e63e6ba3f7c8eb492f964c0a1191c6096a964f34f39ba73f2b9c483c91df81032290103efddde17e5523368795abf6f7d4ab34af15acc653ba38e0634acfd7537bc860eb9310cf7bf32058f7075bbb005fa3bcd7223bc9e0f1cadae9b992e6cf742ca710ebb5af99d33e071c64bdf761dbaac0c8a9d4f64b2b57d074852735342a2b4f37ec2431f76a5bd77834e6db8ab816df053cb61c5b83b88fe36c9013b68854e9052a9a2886755b6a788f23f30fdfcc3cd2e1708ee50d5552b6811a8187d964fd89e15656057aca992fb98c591202c97711d4ca494e8e0d328eaf4dd3ee378d24119b36bfa52386d03a0e616dda72c0d9e1ba9e61fd9a6106fa555eba83de0082c3aec7b28b978fbbf3a7578bb488276b9b104773a4a00a86b1f416a675ca9ad67904226b9e707c97a1445129f2aa9090487aeb27e8b468a83169a22e86ad2bf2f0d8ec44ec49eeb6536b473044e725f41a6607e5f46999b2fa2f5eb383270784d4150a7ab760d493074724c4d94686752ae91149b696e50446bb6ae071d22a4e6933b6e864146b8930ce21137638dae14661b51e697d0ea293f8709895b836da948076a09bb53f95dc853e65a33a3859a0c65a6bf988a5575534b6aa149075f49694f58a56898b5670ca1dd0427aeee7726be950ce832dbf6e1c2dc12d2ace8e8c2c6e516d822e9e7303a03f4edc0dc2b27e5fddfc7d5e9ebdfcdd607d459eb63c55a3fae0a7f87420d8e9f8a91c357d6622951945064adb117f0a5c6fbd2c9d323e2722e49f764315a08a00907d76a255d10a4e69b3b2686854714b2608152d050e0acdf171a95ae98771eb9e	Sdat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{438FA796-37355315-F37E4574-60462D04}\ = 3facdc3973c1bb505b8944527d01227e69e2b67e5ae307f85466c53b1a58bfb923e1c0b1029187852baa88a832d6d7847bc8d810f9071ab400d9973e8b6308100c39d35abffe232260b95121fec69d7b01e7cafb481f317caa6391d0318f6a4cd7d0fbbed81cfc019c82be61a2aec9d3d2c7097b2d206eb313a0001222e250517d926178cadd96fe0a6211c18509e98e11ed4212d107318b9ef7c36b60a8bb56734b3b70581dc67e2a9d5742c41126b9eba5ef058c1a6f798c1a1138bde55de9c24d8ece2c722d9191fdf19d51bd729d99c27a911fb2bcd7a2841e47c3940ff98ca2edb632a457a8f4892952f2f8dee0fc44a22b80904386384add0902ea972e3bf398a73c2b9d680197fa4b60683d77e26b0ef06dea4e11f3f290a94312d73efba35faffc2c5cf3bd201d80be1a5d79829a3f7ea31d1f7e7c9d9f81832ef00cdfefc3f3a7978bbbd7604b4dc80e5273bfe7232be0b0d01cf9c3d9187dbd225eb97ca65dfb7ea0e3a2985e7d3da2de300297b70b5b90780c61cf511336802b5610450d4ace76522b0108b60ba43065e126a2950685353956e6c51426875524ca67f05b1cf83fda9c01fdd21e4703cbe8d76c0b3108aa4dae12134737a494fb46605b78405915064a2b91d0728d602e370cd48dca6d7672251186f68ae52ea6cd942db692643ff75c94bdf59de601e4fa781e2343b85865fdaae171d516b9f59d16becb6350d73ffba3674fc4ec5652b58715c4c677d31c9ffd7318f6473791c0bd999b34c006379c76ff0738131f10818c9fb977062ae0b759a127cf8d95237bd0d5b61454b9b7e6eb0597eabbb160e23d66a2abf737dbe407c6e4bb7a4c1981fe3a62e149c196c9f5f5d5aa096f0a8ccf1193faffe663aaa0880588899369b792eb76af1bf3f8271c24c1f77d5be200e79304c8791361f8ead8b6c45ac4817b31205ee383209855044527b674641bd538852769e4b2562e7badd81185c63a54593782d4be48220f01ac8292794e590d3aaedfb2c311b739dba27f88dc0f03ecafcc3392508e71929af1bfa223ff701ce101e58dea91ce0d721251887aee1f32035fd03cc221562acb2f08139478ca5d08be75e2d69034bed7a38b48f7f65b94b838df1dbc82e1511a45074ad451440a69cfae0cb2d117820b69e8ae8a0d6e916d05327a2f67eca4d355470604d569ca4ea9ad95edb9b1655dea82b7d6148a7990617fd21cf6831bd000f49858be391ca27da1a2c6bf5a5c87fccba26f26ac750c96adb4ce2b2dd0ee3bcca7f20bd69045073a64a6668485f4459ae6bea49d1a7e07dc648027eec4d20bc87055603aadd9913e0d5d2e3e4d1c323f261c353ddae28668f411687aeb990881e90df15295b7b9d4d9bbbda061c9fe75dda67df41e684369984abc0f22332fd0b3f8d79c3bbe605dd33ef79d14c2c727941b7bb89898017d952239e79e3403eb6090723be11f8dfc31de12bc7fdc1c3c3e1f23bce09cbe7c225d373e64233708d4d5768a2b0890ef84330be02f8cec6ece534cf8cf9d0cfeace330e7ab5b083892e34e67b3345797f4c46809b5ce16b3cb1ff7fcab624f21acb62c95d1ca095072c96715e4b6f82b1e8f3d33e268585747f4cbd497f8fbdc277f5463f5b0295eca3da8a22ca8cd2d12ceffd25c803d4ee253370864317a1ad93e85631548ca6911cab28f286cb5eed9b23d1ee27d9e6202a9e18a3628a5093552e6073a04e1f9659e1a43bf985c7f81dc42bdd95e45c286b604dacbc6cf2a8c0f93acf0b0ab6c681389b8eea6cc1532fad9d881fe25a26a985741c4468bf4376414fb4520da59793a9e21437a6fe66c144f450cc6d1cafaef9fac83aebf4c637310284b57f0c42b774894f777eb243745d4967ab4e7e824cca7f064ad7a5219873e1463cb08f7f3eb17b774ab19b0feae62ac07b04497b574ea2751547df69e2a426f110cc62dd452463fd51c49018e311212810f5e4cc351478e64b2f52856ed8511258a7a099f89832d27921431865ec4834487b51b19c046e48ba7e8b44daa7190568235bf665c9503b58fdab3ff271c343e57a3044fe58c3a0ea6532af08f2d4cb1cf11ac4a4d91f1b9ddde3dfd22ddbf415c7a42a741947608252f164c45333618e50345d846bbbb27e7c4bb489f117c861d85feeae3afb86ca0eca8ee483211694a52f1cf528cce5332b09fe303a8d86d01edeacd6f11f33aef5f337c109dbbc260f85c647f575c843f65dce6c3547f4b1cc8bd8da1ee360de56e0af38818d4f9389a23f99861c5f216663babd83078aa656886f1da59c64665f44596a6c444eaebc897534b7fd05c873dd422c53706e42aa9b7eaab1770c45be4c7caabc8174b0477c594fa44583b3b9898b88067731450b7f29ba87f081c49bfaaa39048c32ba0a8a78e9b32bf11a3bae09ebf42dc573dc462abd1080216e9f58ea51279379ea47c87e1d45d74be97ddcb7e6fa36c3f719c613c2eddf37ee7236bafd07370a8652ca6ef9a3307601b0dc0cefe6c62330190a2b69e64026bf110e97bd6d88b03e8984e06f3956735a496c5cb562885104a8b68b7536440372194e6bad51eb6fdaa1db67e64233b1860c5e7ba145f877c44e2a9aeee0c934d8f5293b1b79ae47fb51cdabcc160c19f750356d84b3c105f0a7c37e1d4d94a05492ac99751f4c225111672bad9de3e3ca2631000833f701cef7f535cb0bfdedc42bd5f5ebc835f373c94e3f8e8de914381184dff321ce97fd5637588ea682917cab4a9aa1571c6660aead76ebbd367f0b466282beb90cfb8cc1bb1c0dede7c829d563d75e2e63e6ba3f7c8eb492f964c0a1191c6096a964f34f39ba73f2b9c483c91df81032290103efddde17e5523368795abf6f7d4ab34af15acc653ba38e0634acfd7537bc860eb9310cf7bf32058f7075bbb005fa3bcd7223bc9e0f1cadae9b992e6cf742ca710ebb5af99d33e071c64bdf761dbaac0c8a9d4f64b2b57d074852735342a2b4f37ec2431f76a5bd77834e6db8ab816df053cb61c5b83b88fe36c9013b68854e9052a9a2886755b6a788f23f30fdfcc3cd2e1708ee50d5552b6811a8187d964fd89e15656057aca992fb98c591202c97711d4ca494e8e0d328eaf4dd3ee378d24119b36bfa52386d03a0e616dda72c0d9e1ba9e61fd9a6106fa555eba83de0082c3aec7b28b978fbbf3a7578bb488276b9b104773a4a00a86b1f416a675ca9ad67904226b9e707c97a1445129f2aa9090487aeb27e8b468a83169a22e86ad2bf2f0d8ec44ec49eeb6536b473044e725f41a6607e5f46999b2fa2f5eb383270784d4150a7ab760d493074724c4d94686752ae91149b696e50446bb6ae071d22a4e6933b6e864146b8930ce21137638dae14661b51e697d0ea293f8709895b836da948076a09bb53f95dc853e65a33a3859a0c65a6bf988a5575534b6aa149075f49694f58a56898b5670ca1dd0427aeee7726be950ce832dbf6e1c2dc12d2ace8e8c2c6e516d822e9e7303a03f4edc0dc2b27e5fddfc7d5e9ebdfcdd607d459eb63c55a3fae0a7f87420d8e9f8a91c357d6622951945064adb117f0a5c6fbd2c9d323e2722e49f764315a08a00907d76a255d10a4e69b3b2686854714b2608152d050e0acdf171a95ae98771eb9e	Sdat.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3124	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3988	4700	e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe	80
PID 4700 wrote to memory of 3988	4700	e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe	80
PID 4700 wrote to memory of 3988	4700	e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe	80
PID 4700 wrote to memory of 1352	4700	e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe	81
PID 4700 wrote to memory of 1352	4700	e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe	81
PID 4700 wrote to memory of 1352	4700	e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe	81
PID 1352 wrote to memory of 3124	1352	cmd.exe	83
PID 1352 wrote to memory of 3124	1352	cmd.exe	83
PID 1352 wrote to memory of 3124	1352	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
"C:\Users\Admin\AppData\Local\Temp\e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Roaming\Sdat.exe
  C:\Users\Admin\AppData\Roaming\Sdat.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  PID:3988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping 0.0.0.1 -n 1 -w 1000 & del e7dda1a854b702b56cc33c146c61041da0a38ed946c307c8f6b6752329b5b7c6.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\PING.EXE
    ping 0.0.0.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:3124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sdat.exe

Filesize
219KB

MD5
63f5cafa5db0ea7725a1f88126e79c69

SHA1
6045945dabbc10e8503993bf487d10f9268d55d7

SHA256
d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94

SHA512
a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Sdat.exe

Filesize
219KB

MD5
63f5cafa5db0ea7725a1f88126e79c69

SHA1
6045945dabbc10e8503993bf487d10f9268d55d7

SHA256
d4b7886c31121eb3ac9dee85367959273700d6617cf19c0c1eabd4b396679b94

SHA512
a2569e2cf97fbb6bcfcb35c56f2bb7047b49c8cb81e5c95a39a502199b67f1893043096b26cf837ffd618999de54400ee804f10d7f6df5035e6a61f98cf66c6c

Download Submit
memory/3988-135-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3988-136-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4700-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4700-139-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download

Analysis

Sharing