70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
Size

4.1MB
MD5

3abf7a0ebfb5ad7f0d7ac93fe5f952f8
SHA1

f9490b1f754e45c64c7a0ec27df340643e931c5c
SHA256

70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93
SHA512

3acb44ce32f46c38725f6356ff73b009878802a6189498832cd898878dc5f1c3491ba9bdd157ff32bf7c79ef79ac9ed4aceec8dd532cfc46f776290bffdcbe00
SSDEEP

98304:+R0pI/IQlUoMPdmpSpA4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmH5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2956	adobloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files6D\\adobloc.exe"	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid44\\dobdevloc.exe"	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
2956	adobloc.exe
2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2956	2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe	28
PID 2276 wrote to memory of 2956	2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe	28
PID 2276 wrote to memory of 2956	2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe	28
PID 2276 wrote to memory of 2956	2276	70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe	28

C:\Users\Admin\AppData\Local\Temp\70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe
"C:\Users\Admin\AppData\Local\Temp\70310971ca6bcc41362dc081d304a8593f44aca949b787b7fff0fb5f65a45d93.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Files6D\adobloc.exe
  C:\Files6D\adobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Files6D\adobloc.exe

Filesize
4.1MB

MD5
0f0a1f1396335bf8c61c20e3bcc505a6

SHA1
500ebf8bf5eea07fc3ebb33352f4fe25343dfd9d

SHA256
f93e19c5a508a9953fb45c17b29a4eb7eacb1e4fc7628c2da49e5a300466a21d

SHA512
51c1b68dedea60fa1b06a991c1688c22f1326f5972838bfd2c9082c6380a4b8672656f3f234ba36068c06abfe245331466f0b4481aba49ec750394f352fcfd18

Download Submit
C:\Files6D\adobloc.exe

Filesize
4.1MB

MD5
0f0a1f1396335bf8c61c20e3bcc505a6

SHA1
500ebf8bf5eea07fc3ebb33352f4fe25343dfd9d

SHA256
f93e19c5a508a9953fb45c17b29a4eb7eacb1e4fc7628c2da49e5a300466a21d

SHA512
51c1b68dedea60fa1b06a991c1688c22f1326f5972838bfd2c9082c6380a4b8672656f3f234ba36068c06abfe245331466f0b4481aba49ec750394f352fcfd18

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
201B

MD5
ec025abc07abc9e5ce52a1f5072e3caa

SHA1
3acc099b9b3f4f341eb18696ebc5ed019fb996f6

SHA256
09b1d8cbdefa9ef5294dbec684eeeeb7a67c98cfb9efc4d5146e83cb5544d121

SHA512
00d6363e513c0b036470055eb6acff55562c281a4244d786597b8f021f28575ffc90c74cf89a7fbcf17511ea11454b2f1ef8bc7bfca7d847e4319602574fc794

Download Submit
C:\Vid44\dobdevloc.exe

Filesize
4.1MB

MD5
9aa512e74c0d1648dd1b6eaa18ab57fb

SHA1
d9941275f7392057cc99cdd7ebf83ec9b1478359

SHA256
991b6149146892ab9ffd59a025f0d207b12abca939b8a94b2a641d5509ced199

SHA512
4320b1e93b723f35a39ed159ef02a9eceb85c95bc7088a825b31f2596c05d9b425ff292301ffddf646aa55148a2048d98cd3e253611826256464cb9c8a12e336

Download Submit
C:\Vid44\dobdevloc.exe

Filesize
4.1MB

MD5
9aa512e74c0d1648dd1b6eaa18ab57fb

SHA1
d9941275f7392057cc99cdd7ebf83ec9b1478359

SHA256
991b6149146892ab9ffd59a025f0d207b12abca939b8a94b2a641d5509ced199

SHA512
4320b1e93b723f35a39ed159ef02a9eceb85c95bc7088a825b31f2596c05d9b425ff292301ffddf646aa55148a2048d98cd3e253611826256464cb9c8a12e336

Download Submit
\Files6D\adobloc.exe

Filesize
4.1MB

MD5
0f0a1f1396335bf8c61c20e3bcc505a6

SHA1
500ebf8bf5eea07fc3ebb33352f4fe25343dfd9d

SHA256
f93e19c5a508a9953fb45c17b29a4eb7eacb1e4fc7628c2da49e5a300466a21d

SHA512
51c1b68dedea60fa1b06a991c1688c22f1326f5972838bfd2c9082c6380a4b8672656f3f234ba36068c06abfe245331466f0b4481aba49ec750394f352fcfd18

Download Submit