47dbcba478b90059ef54d8e44bd343a4cea8cc8eecad9af4e564370cd30845b7

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
Size

4.1MB
MD5

12adbbdb32d893e17f30e7128fb97af0
SHA1

bc6466bf9808ff2774edacf18b2b4bbc805a97d3
SHA256

47dbcba478b90059ef54d8e44bd343a4cea8cc8eecad9af4e564370cd30845b7
SHA512

8686424a70c874c8f9f06974a289dd8c2d94de2cd76648ea6deb7d195822edf8d474fc28fdeb6857ca8198a17fc4d00b2f4331111bfa014d8cdca0159ea1b2fa
SSDEEP

98304:+R0pI/IQlUoMPdmpSpb4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmo5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1056	xbodec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeW8\\xbodec.exe"	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidHM\\dobdevec.exe"	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
1056	xbodec.exe
1056	xbodec.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1056	4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe	86
PID 4344 wrote to memory of 1056	4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe	86
PID 4344 wrote to memory of 1056	4344	12adbbdb32d893e17f30e7128fb97af0_NEAS.exe	86

C:\Users\Admin\AppData\Local\Temp\12adbbdb32d893e17f30e7128fb97af0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\12adbbdb32d893e17f30e7128fb97af0_NEAS.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4344
- C:\AdobeW8\xbodec.exe
  C:\AdobeW8\xbodec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AdobeW8\xbodec.exe

Filesize
4.1MB

MD5
c1b9bc52636d95db34e44100b1947c27

SHA1
18fc52bdd30b7e76b51b37ed87d7e8c93729bda8

SHA256
84a5dc882303baff87a5bcb77d73f0bc394e3d62e796e786420638b4a27b3f45

SHA512
19c32ca8ba42f12b8104da924ff67bec0e3cbf4ef47f9249125d2167c255e418ba1e8c62558132eb12c595f7d5428777bc424385428084c981ff2b9d54500b6d

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
200B

MD5
391cfbdd3740247dbbc01f73d974df46

SHA1
49bc7cc9c7f61e864e151c3fbf38931c57d9de41

SHA256
0fb2ff19ac5abc738906f6df35a8bf5998b2c705b8da3384ecdae88e83178694

SHA512
f0cc92e22b391049b1563d7853855b2d42995288f6dc61fd8231496ac752cd858d2311e0586e2547869d40e77da344d55b1768d008dedee93103d3b1f5caa441

Download Submit
C:\VidHM\dobdevec.exe

Filesize
4.1MB

MD5
a479e164b4f5e54b501674e3e72b7093

SHA1
a715d0fe134c33f83eb25020adba5d0f0ebb8370

SHA256
68b4cde35808b97dfa4fd3fc08a28ea4a3f2b52fb12a9bd680bfc73472cfc7c2

SHA512
f5f8dd4fa5bb7fc192158616be14f55fe69778e0c90758d50137539c0bbbf7e9cc90c477cc8df098cc04e9da38480cfb78e90538465c36f254a4228b172ef0f1

Download Submit