ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
Size

4.1MB
MD5

0a01188a1754c5cd7dac55837dd0f2d3
SHA1

e56306e4157a8ef4a3db7e269a6d8c069ba7a75b
SHA256

ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39
SHA512

ead1e3f817b9a28c9e24f2a521f622d53682c2136551c0eb16fe8ec50524af8c963371f9dc0a9a11941d03827200b3e1b424d30c98de06a8e6b7e3a7f848c6f2
SSDEEP

98304:+R0pI/IQlUoMPdmpSpk4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmb5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3024	devbodloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvRD\\devbodloc.exe"	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxC1\\dobdevec.exe"	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
3024	devbodloc.exe
2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3024	2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe	28
PID 2416 wrote to memory of 3024	2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe	28
PID 2416 wrote to memory of 3024	2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe	28
PID 2416 wrote to memory of 3024	2416	ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe	28

C:\Users\Admin\AppData\Local\Temp\ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe
"C:\Users\Admin\AppData\Local\Temp\ae8cbdc87350193e841a506988a565d6e7cb5e53208d18b115620b785df94f39.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416
- C:\SysDrvRD\devbodloc.exe
  C:\SysDrvRD\devbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxC1\dobdevec.exe

Filesize
4.1MB

MD5
930d12d6392b48b91a8b625fc934df37

SHA1
e33a4cd39a62d6598f417cecfd364b87d0179145

SHA256
0c652c9341832ad2258fb20a0862091eed91ce215f338232e02eb7b979c38c14

SHA512
956bccbff22c5926a98592b70eff41af137c4caa84f11f699f27b9d67504917e3c0b71d4797a87d1d0e51f8dc2a04cc8b3fe6424084de79c39ffb74708e307af

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
205B

MD5
47557a8c2cda4f3b817f25634e7a21e8

SHA1
3b921c8ab3a4732e51e98cbeed10a1185fead599

SHA256
8214117b1ee744dac9c04726f618b6e131723f0faf52ad79dfc5ccf3bd77ac7f

SHA512
39221f154148539b357cebbab2ed40ba73f8028763934b4a936b969a46e276b8ae85f1fa3cae253c3f47b8697fc5309b25373197f279d817075c397843f27d78

Download Submit
\SysDrvRD\devbodloc.exe

Filesize
4.1MB

MD5
6a5a82f16ce7b2f89ed69089cb46c01a

SHA1
021ab248aefd77bb8bcb6f6a8dc99d8656357a31

SHA256
3c8c61ac92f1a0d30c6ec4000f5e405fac0a459a8338c1549a2ea8923e2546df

SHA512
dc57a261497620a1e7d38cb50cd1f48c11da44ebb7e86d59c8f68d6bcaa6f2e134875824f9290290a4dac153c63494bcabbf5125795419b60e70e950b2865d8b

Download Submit