f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
Size

2.7MB
MD5

79a427acd6827825e0e08b9654624415
SHA1

e5f24eccd06b13e8fbe91108092b130caa333124
SHA256

f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2
SHA512

8ea543ea357eb9fb378f19180344460416b12b3328761fc40c26d0dc999eafe8f12bc966296bc9b56106cd324657ee579e93f5f7177e5ba2e7736de55834e346
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBi9w4Sx:+R0pI/IQlUoMPdmpSpo4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3748	devdobsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ8B\\dobaec.exe"	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvWR\\devdobsys.exe"	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
3748	devdobsys.exe
3748	devdobsys.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3748	1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe	91
PID 1492 wrote to memory of 3748	1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe	91
PID 1492 wrote to memory of 3748	1492	f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe	91

C:\Users\Admin\AppData\Local\Temp\f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe
"C:\Users\Admin\AppData\Local\Temp\f8c082409d7997888ab5741cc0d59c3ccc8aff27c81bb1e8e9d9d08709c63fa2.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492
- C:\SysDrvWR\devdobsys.exe
  C:\SysDrvWR\devdobsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZ8B\dobaec.exe

Filesize
2.7MB

MD5
7d7775a284552ca08716e0297d3ce9e8

SHA1
2b0616b1a7e04e0d0cb661762e0cd79837c84f76

SHA256
fd6500934dcf0fbbdd52b167ffab0491c32a954ff80597dfaa4095d158ab89c3

SHA512
25295c1d1050bf5f23a2ce738190c964c4160806bc3285caa439ccd50217244f351ae31499f484318957e1024b8c870f14e6fd2b7874e5c8f8ad839981b99ac2

Download Submit
C:\SysDrvWR\devdobsys.exe

Filesize
2.7MB

MD5
a889490c9600434bf09a0a0205cfb30b

SHA1
2920d7b7bbef882576aa3ca2d62dc410bd17af4e

SHA256
95e38929c3df7c95214eba8c28b2c024e8f36a5b2010b6e7be90af2ff3cf26b4

SHA512
78e860a702a5f3af204db8227ebe18c7bb8faff9578dff35ae4c3c680594e42f5c391389f8ae728aa7490bc7063fd57fa4a3013229b923087b2684960aab6641

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
21b68b2a1b1fcb7f6c520e8d514e1fb6

SHA1
9dce53be45c0b81468a29c37d2771d2abee8e891

SHA256
23b96ec433f3394be9df0621c26811549fc911550a887efe8bcb13bab64f1216

SHA512
844fd77391b4d6a051c4061068479f7d73c34212cd587b26d640f2f5e3ee8b5630850a30734709896044fe2fe736b21aefa34cd4d3b848e7b2ef0d3d80180054

Download Submit