vobfus | caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184

General

Target

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
Size

193KB
MD5

cdc9b76b8982bed3ed00e98c9349a6fe
SHA1

736603fa7b4193c2e0137111336d0c65e07abc8d
SHA256

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184
SHA512

56fb4f0b5c1dbfdae8315b107b9cc028b6fffea7eaaf4d51bbdc5391f5b148eb3e114eb4dcbf4379372e7af56eafba526a08a903d6e0763a3162a7f487c61fbf
SSDEEP

3072:sKUoYh8K9j36Sfh+ueK0anG5CU7XO0cUdCSAZDGJ8t19dSQwTR:sUYhXj3dhfpnGs+fdkpG8tH4

Score

10^/10

vobfus persistence worm

Malware Config

Signatures

Vobfus
A widespread worm which spreads via network drives and removable media.
worm vobfus

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\KEE52HN0RK0DO9 = "C:\\Users\\Admin\\AppData\\Roaming\\7XLYWDTZ2IQ.exe"	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\KEE52HN0RK0DO9 = "C:\\Users\\Admin\\AppData\\Roaming\\7XLYWDTZ2IQ.exe"	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KEE52HN0RK0DO9 = "C:\\Users\\Admin\\AppData\\Roaming\\7XLYWDTZ2IQ.exe"	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\KEE52HN0RK0DO9 = "C:\\Users\\Admin\\AppData\\Roaming\\7XLYWDTZ2IQ.exe"	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

description	pid	process	target process
PID 1200 set thread context of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: RenamesItself 1 IoCs

Processes:

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

pid process

1256 caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

pid	process
1256	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
1256	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

description	pid	process	target process
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
PID 1200 wrote to memory of 1256	1200	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe	caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe

C:\Users\Admin\AppData\Local\Temp\caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
"C:\Users\Admin\AppData\Local\Temp\caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe
"C:\Users\Admin\AppData\Local\Temp\caec632369de81d646c8874ab69bc54871758c7b4f12e2324f2353023ef90184.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1256-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1256-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1256-58-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1256-59-0x0000000000401274-mapping.dmp

Download
memory/1256-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1256-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads