5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
Size

4.1MB
MD5

2f16d1977233e2026f9c7adf8f52ed78
SHA1

81401764d2025b71fcc8a5f3d3025763c5d45b83
SHA256

5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008
SHA512

89b8208c1870a7cfb5d0e66f44bb4419a3584b64b1262183b91e82f68164c0b3b66d5cc0c451ea3ebd49df0b85f13abe3b5c958a07ebb63dce35adfa5c6d410e
SSDEEP

98304:+R0pI/IQlUoMPdmpSpg4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmH5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2836	abodloc.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotDB\\abodloc.exe"	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZUM\\bodxloc.exe"	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
2836	abodloc.exe
1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2836	1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe	28
PID 1744 wrote to memory of 2836	1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe	28
PID 1744 wrote to memory of 2836	1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe	28
PID 1744 wrote to memory of 2836	1744	5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe	28

C:\Users\Admin\AppData\Local\Temp\5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe
"C:\Users\Admin\AppData\Local\Temp\5b3f5fef6ff3d55ae78c6303008f1c7758a92516c9feb9f6ce6f277673b46008.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
- C:\UserDotDB\abodloc.exe
  C:\UserDotDB\abodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZUM\bodxloc.exe

Filesize
4.1MB

MD5
dcc9b4039756e5e93515318be5392b48

SHA1
01d8978db7b436b627e60f99c40d7694a242268b

SHA256
b4c5b22476b8531feb780448b0a5a896c10c789ab92ce63304e643bda37aa9a2

SHA512
398b8792d6a5c75ca7790bb35e636daf72b59de2458e45f9e11b2d736217647e2d56035605215effa40d01cc39c87d5fadbfa56f423ffba5c058d32d6bd05264

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
f87d19fe9ded58588ec70278991f3394

SHA1
fcf18631096f2f4220137bd8101a200fa4ca21d2

SHA256
f1fcb7342c8ca72f2e514f41299c2903a0e1c6be367308f977779f905f1ed43a

SHA512
f31f61f75f3a9ac3b599b9ea01d8ad2c034d9070345473dcde28bd4201ee850f78dda2537bc912904eceb49ba4bf5597da53c5e09b794fc32bf4681d845af00c

Download Submit
\UserDotDB\abodloc.exe

Filesize
4.1MB

MD5
a121927c0c31336cf794980627c00a8a

SHA1
ce018e0506f75452af61460c8262c88bea463d1b

SHA256
30603d395b16e5856d74d8d9c1fd19b9dbaa17684ee24ae323d88bcad6e165d0

SHA512
5c5d4af7f3d446f17b83c10bce6dc08905c1fb29f2cfbcafe9254b1c1cdd5dc6063e97370aa458f98b827fc7899d68a79b945f8b3ffdc31f0921442f7f334340

Download Submit