f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
Size

2.7MB
MD5

79a427acd6827825e0e08b9654624415
SHA1

e5f24eccd06b13e8fbe91108092b130caa333124
SHA256

f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2
SHA512

8ea543ea357eb9fb378f19180344460416b12b3328761fc40c26d0dc999eafe8f12bc966296bc9b56106cd324657ee579e93f5f7177e5ba2e7736de55834e346
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBi9w4Sx:+R0pI/IQlUoMPdmpSpo4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2956	xbodloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesVJ\\xbodloc.exe"	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZGF\\bodaec.exe"	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
2956	xbodloc.exe
2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2956	2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe	28
PID 2100 wrote to memory of 2956	2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe	28
PID 2100 wrote to memory of 2956	2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe	28
PID 2100 wrote to memory of 2956	2100	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe	28

C:\Users\Admin\AppData\Local\Temp\f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
"C:\Users\Admin\AppData\Local\Temp\f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100
- C:\FilesVJ\xbodloc.exe
  C:\FilesVJ\xbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZGF\bodaec.exe

Filesize
2.7MB

MD5
f7828e5decec796e1489b361c73f7d53

SHA1
5042d75d2cf4d8285f1394fa580448cbcf15fc37

SHA256
894e081ddd8b48924cc65926dff8333dc2bed304ed3dd9a864811cb14b251606

SHA512
4d06a68594d22af89be6c566053363cd25495fa3f5fc5bf9ded06c4389ad5437b4d287595d0aea9522d041fbc7a65a6eba3a92c2a8b617d37fee5060d9dd194a

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
200B

MD5
e7d0f0f7fa80266d55d8a7202c74de31

SHA1
eace7367f39475a4381750a2feaf7dc39cf44bb3

SHA256
ec7aa518bbd0fcedad3ec885208b42f4b6cea1c7ccf3b7588a0d60609907af65

SHA512
05cba02994d5922ee15ccf4aee4d466a931daab97876f2619c36d959629d65e7a054ed97425effbb30a0b62e3d507914952b1321ecdb59fc54eb520e52ac44c8

Download Submit
\FilesVJ\xbodloc.exe

Filesize
2.7MB

MD5
835adc7de11856bf760e337a15d89aa0

SHA1
b48c7ee9827c31f0643457abba511cf81f65fa7e

SHA256
f5364e785dbffc47be305f2e0efd8cdb30368a612bc40e083d48c17910d1a397

SHA512
cb565053cad9498729fb9ebd4a70e404360b1464de3dae87a3ec08604ba88401fa622cea40d06c9141461249f0f59b5b55bf700cb1629b291ff084ebdc5f03ee

Download Submit