8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe
Size

23KB
MD5

d37d30fb0f7aaa9f0b662c0a3d405acc
SHA1

69bfb38e660a4d9744053df1e0a7620248196d8d
SHA256

8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc
SHA512

4905319f7ac331d797940dc5616634cc60b0f810727d36bdf620964e53c72a463eb8d878853382ce21cd90ccd8f85260dda2f8eba2e7b3d1a6c43c4c7ea28df8
SSDEEP

192:RmHMqjoQewsETX0o1byouOlOx/+1qAGgYpVAdDWLkqQdAlPTCjhDswHgk:ReMigwsEo6Ze+N5Ypy6QdOwHx

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2916	erdou.exe

Loads dropped DLL 1 IoCs

pid	Process
1820	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erdou.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2916	1820	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe	28
PID 1820 wrote to memory of 2916	1820	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe	28
PID 1820 wrote to memory of 2916	1820	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe	28
PID 1820 wrote to memory of 2916	1820	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe	28

C:\Users\Admin\AppData\Local\Temp\8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe
"C:\Users\Admin\AppData\Local\Temp\8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\erdou.exe
  "C:\Users\Admin\AppData\Local\Temp\erdou.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\erdou.exe

Filesize
23KB

MD5
5f28f0c9d7e4677323d3b5a7c01101a1

SHA1
5bb210005ce546b99576816ab4df984955e83a77

SHA256
057c13d9c3156f3858fbf9695ea3d64837ad98dee8743817a8a7826f5d2182f8

SHA512
a3bd8a03059f7727454dcbf9a055fa0cd07cbbfdeab777ca0bb09185061ec73ec0008532c6239af5081ac451b78393b01c00058f745623bc04278ff2fa241799

Download Submit
memory/1820-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1820-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1820-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2916-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2916-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2916-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download