7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
Size

2.7MB
MD5

3ecbdbed8fa410f1ee39fe3efe46593b
SHA1

f4353c9db000b9e9673beaefdfe6ad83300538c7
SHA256

7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee
SHA512

78d347fb9136907d2387089c8567b1d40187daf621a3dafc3eeb211f0ef08b489ac6108a3ad121d52e964b1c2340a7574e5b10a57230f4d1bbadf7e8c7d1171f
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB59w4Sx:+R0pI/IQlUoMPdmpSp54

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5020	devdobec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeT7\\devdobec.exe"	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZHF\\dobdevec.exe"	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5020	devdobec.exe
5020	devdobec.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 5020	5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe	86
PID 5072 wrote to memory of 5020	5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe	86
PID 5072 wrote to memory of 5020	5072	7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe	86

C:\Users\Admin\AppData\Local\Temp\7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe
"C:\Users\Admin\AppData\Local\Temp\7648be6059d9b0a96e9be1d91a423927c791ed72adfe2d1714ac3e251deb95ee.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072
- C:\AdobeT7\devdobec.exe
  C:\AdobeT7\devdobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AdobeT7\devdobec.exe

Filesize
2.7MB

MD5
19a462df20443b5a40ca76133452548c

SHA1
2a267732001578420e35e8d0fca50fab510fe2b1

SHA256
431391857f7b1610b06f15791fced900814e865a1b80cb55009af9c714ad4a41

SHA512
2df4e802e9f9646025d1ea15022777e8cb7b65b31c770bc8be9046dad6157586697e9a2bc45e9b79462d479dafc49e3f08561f69ea9d63f686336386b583d1ad

Download Submit
C:\LabZHF\dobdevec.exe

Filesize
5KB

MD5
11995b0e70a03e1c1871e7f318a6bb94

SHA1
60440c8b1b94110d9f871bcfea5fbba45535b2f0

SHA256
d1a44a0d9e209b59f344c8134a033dd6bdb09a32af542f9cef8c9af278aaaa30

SHA512
bf4bd4a9b5d8fc64daa941dd2b1826eea738481e4dca06d6df089610d53ff779c6aa3e44840dc03ea51255cb776f71d190c542d73b3dedbacfdc600c25b2517b

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
203B

MD5
29f25e7f8ebc7830152117ae7eeb060d

SHA1
7cdef0ca7ea6e683f5ba0573d72bd69d22ec75bd

SHA256
068a2349e150bb163b7fa444ffd8374c8c17108e715bda465dadae5ce77b0bf6

SHA512
548275b2e592807d79cb3051ca6ac37cdd7daa23d08ccb31efc26f569015a7a7cc1f64ed0067119c4775f0e700eae8a9a46e00d038b3429936343f5d06695dab

Download Submit