003bd2ca89efc808a6f5e607f1d19c2d5ca1d629dfef3f324a9fbea0ce933fd7

Resubmissions

02/04/2024, 15:14

28/11/2020, 10:16

Target
bf73a8fc20f143a3c4ebddcf97fc3663.exe
Size 864KB
Sample201128-cq41c817v2
SHA256 003bd2ca89efc808a6f5e607f1d19c2d5ca1d629dfef3f324a9fbea0ce933fd7
MD5 bf73a8fc20f143a3c4ebddcf97fc3663
SHA1 a9b78a8c9efda6ee9574563893d97d5f17a95bec
SHA512 26c52719843b4d96b03ac6fd64c217f525607c44f60dbcabb2d42086511b17fee7c9ed985218188f8c631c12131abe013c85d83ccc429d5f23cb5269b22504b5
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 3 IoCs

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bljmbogtlaodsixlaob.job	oplbswt.exe
File created	C:\Windows\Tasks\dhvxu.job	xacegk.exe
File opened for modification	C:\Windows\Tasks\dhvxu.job	xacegk.exe
File created	C:\Windows\Tasks\oplbswt.job	bf73a8fc20f143a3c4ebddcf97fc3663.exe
File opened for modification	C:\Windows\Tasks\oplbswt.job	bf73a8fc20f143a3c4ebddcf97fc3663.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1576	1512	taskeng.exe	30
PID 1512 wrote to memory of 1576	1512	taskeng.exe	30
PID 1512 wrote to memory of 1576	1512	taskeng.exe	30
PID 1512 wrote to memory of 1576	1512	taskeng.exe	30
PID 1512 wrote to memory of 1952	1512	taskeng.exe	31
PID 1512 wrote to memory of 1952	1512	taskeng.exe	31
PID 1512 wrote to memory of 1952	1512	taskeng.exe	31
PID 1512 wrote to memory of 1952	1512	taskeng.exe	31
PID 1512 wrote to memory of 964	1512	taskeng.exe	32
PID 1512 wrote to memory of 964	1512	taskeng.exe	32
PID 1512 wrote to memory of 964	1512	taskeng.exe	32
PID 1512 wrote to memory of 964	1512	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\bf73a8fc20f143a3c4ebddcf97fc3663.exe
"C:\Users\Admin\AppData\Local\Temp\bf73a8fc20f143a3c4ebddcf97fc3663.exe"
1⤵
- Drops file in Windows directory
PID:1640

C:\Windows\system32\taskeng.exe
taskeng.exe {189B23BF-3BBB-4767-90D8-632D3D81DD72} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\ProgramData\dnud\oplbswt.exe
  C:\ProgramData\dnud\oplbswt.exe start
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1576
- C:\Windows\TEMP\xacegk.exe
  C:\Windows\TEMP\xacegk.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1952
- C:\ProgramData\aocgsx\dhvxu.exe
  C:\ProgramData\aocgsx\dhvxu.exe start
  2⤵
  - Executes dropped EXE
  PID:964