Overview

overview

7

Static

static

3

0ee3e5e938...5c.exe

windows7-x64

7

0ee3e5e938...5c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/05/2024, 18:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0ee3e5e938e28ad4c693f5360fa8361dfdc81382fdbd57cc770ac20a736de65c.exe

  • Size

    4.1MB

  • MD5

    acf6cc95c592bf1c4b11a0db357c6178

  • SHA1

    a168407ab78929ef872c0b873e7e351dc2b16eb3

  • SHA256

    0ee3e5e938e28ad4c693f5360fa8361dfdc81382fdbd57cc770ac20a736de65c

  • SHA512

    9de87b5797c269da5f99984f974cc2c8fbccb3fc260ce040c3e5c9f37cf4bd62a75f9269bf9c274d657ddb43c8cd5f0ef4880be7cf7b91e36695f01aa07d89b5

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpn4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmM5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ee3e5e938e28ad4c693f5360fa8361dfdc81382fdbd57cc770ac20a736de65c.exe
    "C:\Users\Admin\AppData\Local\Temp\0ee3e5e938e28ad4c693f5360fa8361dfdc81382fdbd57cc770ac20a736de65c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\FilesL2\xbodec.exe
      C:\FilesL2\xbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2900

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\KaVBNG\boddevloc.exe
          Filesize

          4.1MB

          MD5

          0acb1d33290ceda91e4cd6b12eee756e

          SHA1

          9228009bc75fe8bf0032074e2dc0b40e570b729a

          SHA256

          c48b2724292f9000bd4861e3a1d19b482a315a06319583a8907746c3d2a2dc4c

          SHA512

          170bf8c73a30c256215a4ef4d3070d3f1b68ea3690ac40976642717b63b765c0ff8e905e4f01c31afe46bc7cec8807b627582d07a6cfbca1d12787795c166eb8

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          203B

          MD5

          763ca5ae04cf521a434d6376b7df9947

          SHA1

          b2df2e586c43e467b71aa8116e53fcf0fed29158

          SHA256

          0ce33725131831828d44e33ddd13cd92bec7ea26fd0bd12707787a2a86b2e6df

          SHA512

          ec17651527576eb19453b1e4476cee1ad29c487815ff5adbf6c7954153c21504143baaf6bc88c57fd3dcef813f8a85d1bb3e913b7598e188c078fa45e08109eb

          Download Submit

        • \FilesL2\xbodec.exe
          Filesize

          4.1MB

          MD5

          7df218b92a33b71c9a58d18a6420c874

          SHA1

          bd86d063d7d6bbe98c2082216c129cbb1dc3db8c

          SHA256

          f4138b8236563c3ebe5bd3833e7c1c97f9cf6103fefd49e36d02fad440e1e7a6

          SHA512

          191536a199b197af906dfbbb742d77e345a2a6686be586eb9a4652688fcab3b7915334972513ac541859225dc47c4f7ab61d870007c326575a8cc63179cd0506

          Download Submit