vobfus | 8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3

General

Target

8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Size

200KB
MD5

04f378543dd407f5888e08cbd33421f9
SHA1

f48cd25081dec07417f3d0737b5cac2769829492
SHA256

8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3
SHA512

6b4b10a937e8089ff8bdc32e6564a285ad57072e8c293b40d79a1cb447a9be68122d402700438aa951ddd99a52e12d2725a9db88d0d7bd570e417868f6ed7808

Score

10^/10

vobfus persistence worm

Malware Config

Signatures

Vobfus
A widespread worm which spreads via network drives and removable media.
worm vobfus

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

pid process

1248 8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

pid process

1248 8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

pid	process
1248	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
1248	8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe

C:\Users\Admin\AppData\Local\Temp\8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe
"C:\Users\Admin\AppData\Local\Temp\8dc0599e10403568a9d428ce5687a37337d97d721a3a34f53c450d6c4d1500b3.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-54-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads