Overview

overview

7

Static

static

3

8f1fcd2730...ed.exe

windows7-x64

7

8f1fcd2730...ed.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2024, 00:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    8f1fcd2730696a1df8a86e6581717399e7829f736b8a888f519de4305d357fed.exe

  • Size

    4.1MB

  • MD5

    77db23350422b7624d7a3e2aa25e33b9

  • SHA1

    33dc22a2e9dddc3fb493b62370d7855c0271c079

  • SHA256

    8f1fcd2730696a1df8a86e6581717399e7829f736b8a888f519de4305d357fed

  • SHA512

    af7ed7867f391f0112c7c3958a2b637b3618881da430ebbfff5e7e411cd05aba363d05671d1557909abe5478711ecb0579262e98bf854197bdb9739bf8694a1d

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpi4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmd5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f1fcd2730696a1df8a86e6581717399e7829f736b8a888f519de4305d357fed.exe
    "C:\Users\Admin\AppData\Local\Temp\8f1fcd2730696a1df8a86e6581717399e7829f736b8a888f519de4305d357fed.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\AdobeNN\devbodec.exe
      C:\AdobeNN\devbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3516

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\AdobeNN\devbodec.exe
          Filesize

          4.1MB

          MD5

          292fa9cd6d0660866c875024312c77c0

          SHA1

          3387a32e0fbec019237cead7cf8f5ec9bf6a24b7

          SHA256

          d27563e836239c59b9a769004ee50632664c59a9bbb68f1780c1caf82f866782

          SHA512

          025896150a0dc788b167970e58f6ff1848f86f33daa9dd6b07a13746443d1a0ddef0974cece75e5f556deecfff1318a92cb2c66b4f41353e36386a948b429887

          Download Submit

        • C:\KaVBZ1\optialoc.exe
          Filesize

          82KB

          MD5

          6771f161ef13b71fbbe7a54a37a53630

          SHA1

          c4231c532c76f3f26ad03ced483e35e3de46054d

          SHA256

          2bf7d5bf8f522c83f3e34dba8e63ae557c45b18874727dc86b319522ebbc9f79

          SHA512

          a9d7c6ca1cee6eaa5765df91de73ccd0f69ce57967f91bbdf1e866ee3e0bfbb2237d557916409d1114323bb9f21e615c4ccbaeb57b8fb761b1e42b7795aa010e

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          202B

          MD5

          0ec6b793b553c16e1e78d9ba4d82affe

          SHA1

          022a6d13c947602775a91bfda1d18d7492c77c8c

          SHA256

          d52deced259866177b1fce8510b40134cac53a117d6b91a69f953c752cc200a8

          SHA512

          6c27a62aa168706c5cbe9cb6ee4b4d9c7570c6e581e2c04154fe3fe00a0cd808c45c38002628650497614ee63b02857a116a26c5fbd9f3c2ba3f2e050932463e

          Download Submit