1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
Size

2.7MB
MD5

a3ceca4d3d403615885dfb4e869a9ac4
SHA1

7fa1f9b8318608af67e85e9c7601721b89e4c644
SHA256

1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8
SHA512

588896293a9e8413bcf183aec0340742c8b89357ef678ab1484132f799cc66d5e1076e076fb155980151f7d402f604604b59b610fd06b84c3844aa3d918229c6
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBc9w4Sx:+R0pI/IQlUoMPdmpSpS4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1932	devbodloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesPN\\devbodloc.exe"	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxQ2\\optiasys.exe"	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
1932	devbodloc.exe
1932	devbodloc.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1932	3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe	90
PID 3184 wrote to memory of 1932	3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe	90
PID 3184 wrote to memory of 1932	3184	1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe	90

C:\Users\Admin\AppData\Local\Temp\1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe
"C:\Users\Admin\AppData\Local\Temp\1c2edf8ac660370d8ff4ed5cdecf6a892635acc7b4d3c2f811b1ec5b9b3cd8b8.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3184
- C:\FilesPN\devbodloc.exe
  C:\FilesPN\devbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesPN\devbodloc.exe

Filesize
2.7MB

MD5
b1b72d8d0c8c7bab9e6604751f347d3e

SHA1
7a4e04288aa06de057a426cec40810ceba75bce1

SHA256
63ded2d3aa0f433502c7a3bc50acd242f2aa6adc7e91fad52064020a9c1dd55f

SHA512
d67bcb8b007344d26941016afcd7c92479f545328a11f08813e47509aa790ee1950054619afcf1e751da84bde499df2b1da890e454023228aaa3d15acc9605af

Download Submit
C:\GalaxQ2\optiasys.exe

Filesize
232KB

MD5
927a53b57a8f8ddc719e6c02f1ad12ba

SHA1
6e72756ec5b9a15619ef3cf7baac8344669d3d4c

SHA256
41b7a8e8270708f6b5ba67ec8ec8d755fc12359f2ba7e40a9f803fe3dab64015

SHA512
b3149da7a9f5962d185b50960e582859e7171ed00046c28aad0989c757ec5e7f9dc9c31395353f6406c26cf8c51ae3dbf9defd45af4d281082c40ed2dfbcf916

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
206B

MD5
4329e98f7d1e16e7da0b73d94861e089

SHA1
2d7e77d7e7169d99a0a5597acce528fb73fd6ee3

SHA256
21a19c47c00a8124785bdbdc3cb8b51f06b22c29ceb8fac3259dd4f2ca613d01

SHA512
a3ebaf33948d01042539d81f5739c04bb4bbbb37ecb13ca9fcb77b22d97844602ba8f2beb28bb880c7877090c00b0ba4ef4415cc0de2b2c8ee974929a513e449

Download Submit