a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
Size

4.1MB
MD5

878a02e17c2d5d0d091e438f3a29224c
SHA1

5cfaf5b071625e825145fb92f7f0b55492fd7cd6
SHA256

a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36
SHA512

617cf9727a8c3c1022ec19e53043214bd59bb58de3794c30efea5bc0972a8ed79d1ff621128ae2814baaea56c4d15e44b0a10dbd1004ca833459ba47970d095a
SSDEEP

98304:+R0pI/IQlUoMPdmpSpF4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmq5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3704	adobsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ7S\\dobdevec.exe"	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files4I\\adobsys.exe"	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
3704	adobsys.exe
3704	adobsys.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3704	4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe	88
PID 4944 wrote to memory of 3704	4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe	88
PID 4944 wrote to memory of 3704	4944	a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe	88

C:\Users\Admin\AppData\Local\Temp\a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe
"C:\Users\Admin\AppData\Local\Temp\a954688fa4b5764877fb0b28e24579587c310fd2d85a3e3d8a8967ab02678e36.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Files4I\adobsys.exe
  C:\Files4I\adobsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Files4I\adobsys.exe

Filesize
4.1MB

MD5
84d90a1cd600e1b3066926eed46c3c7a

SHA1
af1c71663870e8852947cc63717a2d90941fb097

SHA256
050437ca81cdb748eb5745c03d3430b4750a64fc69af22af2e1061481ce099b8

SHA512
5cbf94fd3ca3d20c99077e419ef01fed567097bdd0d4e32db4399c6caf61b26124140871f831a6b5547a3cff5fbf2d6bdefeca0b462d2726f16ed995323ed3ec

Download Submit
C:\LabZ7S\dobdevec.exe

Filesize
4.1MB

MD5
85ac97ae8a2a21bd323bc17fd16cc7c6

SHA1
842f7a99264218ad106e1f5e8454aaf729a4fd7f

SHA256
d15284772cab4ee78551bf4d90816e210e96645f19a84b805a56a22de1689e83

SHA512
d63c506835636322299a689999750e6c6582377f1d5752f7de8cca7fd1e14a4ffbcbfa7e1f8adec9c87b09488affb9cc77deef7ad26eaaa6def3fbe7779bafc4

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
203B

MD5
ee9a7d67381c144060f5c96f6375f3a8

SHA1
acbdff9a90e1398663453a73737ec0f7ca83a748

SHA256
13f0394120e9f5259e19c8edd1bca5f8916c2715bf127698cfd28cdf501a5cf8

SHA512
527931635be44b5266d68700c0f2eb83e21d432135251827144b6369d9a4042ea2274d8d2aa0d68d89cf058c2d602d3f3b0c4551f125c3772fc405ef0d73c56e

Download Submit