8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe
Size

23KB
MD5

d37d30fb0f7aaa9f0b662c0a3d405acc
SHA1

69bfb38e660a4d9744053df1e0a7620248196d8d
SHA256

8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc
SHA512

4905319f7ac331d797940dc5616634cc60b0f810727d36bdf620964e53c72a463eb8d878853382ce21cd90ccd8f85260dda2f8eba2e7b3d1a6c43c4c7ea28df8
SSDEEP

192:RmHMqjoQewsETX0o1byouOlOx/+1qAGgYpVAdDWLkqQdAlPTCjhDswHgk:ReMigwsEo6Ze+N5Ypy6QdOwHx

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe

Executes dropped EXE 1 IoCs

pid	Process
4956	erdou.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erdou.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4956	2444	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe	84
PID 2444 wrote to memory of 4956	2444	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe	84
PID 2444 wrote to memory of 4956	2444	8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe	84

C:\Users\Admin\AppData\Local\Temp\8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe
"C:\Users\Admin\AppData\Local\Temp\8f7a7a54cc7e82cd890800b8740673147c8abd0cfbd32f8a14f2c93b827e59dc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\erdou.exe
  "C:\Users\Admin\AppData\Local\Temp\erdou.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\erdou.exe

Filesize
23KB

MD5
5f28f0c9d7e4677323d3b5a7c01101a1

SHA1
5bb210005ce546b99576816ab4df984955e83a77

SHA256
057c13d9c3156f3858fbf9695ea3d64837ad98dee8743817a8a7826f5d2182f8

SHA512
a3bd8a03059f7727454dcbf9a055fa0cd07cbbfdeab777ca0bb09185061ec73ec0008532c6239af5081ac451b78393b01c00058f745623bc04278ff2fa241799

Download Submit
memory/2444-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2444-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2444-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4956-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download