e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
Size

4.1MB
MD5

099fa7cae0ce13acbdebc318f2ab3048
SHA1

1902b00ae81200d2974bcf7b9e079fd0532003d4
SHA256

e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a
SHA512

a7d90fd3718b2cb69048a1fa96aece992e0e0ef2c038ada68f503803e9bf73f73a3d59019972634343a760a874987a678f92399351d08799643d1fd6bd207c07
SSDEEP

98304:+R0pI/IQlUoMPdmpSpL4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmk5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	abodloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesJD\\abodloc.exe"	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidJO\\boddevec.exe"	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
3032	abodloc.exe
3032	abodloc.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3032	2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe	88
PID 2188 wrote to memory of 3032	2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe	88
PID 2188 wrote to memory of 3032	2188	e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe	88

C:\Users\Admin\AppData\Local\Temp\e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe
"C:\Users\Admin\AppData\Local\Temp\e7627450969105c3e05b1d2973b5956ba6471031e063c2af4425059d913f3c3a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188
- C:\FilesJD\abodloc.exe
  C:\FilesJD\abodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesJD\abodloc.exe

Filesize
4.1MB

MD5
088f853d6222a657d46ec59880214ace

SHA1
8aeca0ed83cdd1e14c78ddc369632ac0bfa7e1a0

SHA256
ffeb41fb4c2b571f5b735cb6df7683e1592256abfa4d60414218a43d83d7368c

SHA512
79a99db277c0f6f70ca4e063bf7daefbbe32239b1a0c471b8384f7273044410538e5e53c00fa57729e7bc3b8ea7a958f28d49440f16332c962f7f4b1a42a351e

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
199B

MD5
3ac18728dfecd29947110cd0b92290aa

SHA1
cf5b8363655c3b6564f6ac45024b057407f163d9

SHA256
d2007b011f553e77f15dc8200279a009471eb8251104bf2ea57cad4aad9d93c4

SHA512
565ab0518f94dcdc7762aa731099352de2e8cedfba07cdaf306dbbb25dea44882e0fc6f4b30c339911d91ed855475b4fdda350ba9e5c48d856903096271b6eea

Download Submit
C:\VidJO\boddevec.exe

Filesize
4.1MB

MD5
cb5d56892f9aa09253fad98688c79e24

SHA1
ecb3c070efcc0b4bea3668518fe51c47f4c5e1a8

SHA256
5e14d0f925f1742faf4532b420f0756e8b4c07b71f8e315f9529f47883a41161

SHA512
ab12f3f15c8b4518045107b9735be3e8fd3f2bf557377ad94f7cc51c73cd2db1c696a6e8b55bc49137ebad4c7228fdacc124da1e0216fa42568b3b6a4bddc9ce

Download Submit