18eb5e6af3e1496fcc4d1346a2386526ec12e684edc4553a30f3691ddb01784a

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
Size

2.7MB
MD5

a1c6e96bb4f7accba8a1e06f3018f063
SHA1

71689e9f50e62e7e1ce301af93d27a9bd8b2b326
SHA256

18eb5e6af3e1496fcc4d1346a2386526ec12e684edc4553a30f3691ddb01784a
SHA512

00eac87ba9c1e5a4618ae247e8965b2d418b3bdeeedb3aa07991b451353836fb930f83a07637a79d291f6c010b88c0fc7c07e48917bda250b46347ca22e25269
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBs9w4Sx:+R0pI/IQlUoMPdmpSpG4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2408	xdobec.exe

Loads dropped DLL 1 IoCs

pid	Process
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvPZ\\xdobec.exe"	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxVI\\dobxsys.exe"	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2408	xdobec.exe
2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2408	2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe	28
PID 2888 wrote to memory of 2408	2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe	28
PID 2888 wrote to memory of 2408	2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe	28
PID 2888 wrote to memory of 2408	2888	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe	28

C:\Users\Admin\AppData\Local\Temp\a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2888
- C:\SysDrvPZ\xdobec.exe
  C:\SysDrvPZ\xdobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxVI\dobxsys.exe

Filesize
2.7MB

MD5
5e31dcc7159c44a2b84ea0158830e300

SHA1
5a953a0d17acea1f2560ed365a0cdead6eaeaa5f

SHA256
1629eff1c9e5c3cd00eb010429261b2c94d9821b0fc22e0b67ad722171fe32a5

SHA512
56a8e9ce93ea0e9468d7ce0603767271d72184f336d1648fcb55c1124807bb16dbedf5b840a8491254451f7a9e00e5cac659cc050ae9b6f29a3265f8fc4d5dc0

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
203B

MD5
85ec91be29ecfa7ab0c38063e3cf2fba

SHA1
d89afafe20853850e539f5278689143e7ac1a991

SHA256
85df576aea44c644dd68161678fc7fc8358c451ddbd7dc892c39e93f379dd67f

SHA512
7db6bb11406ea75595066bba20bfe897e92698be00813f7ae9ba77c8a42a534419b7c70a3110858136441ddd55b000a36e6c16e53b8398736c140a75eec6c63b

Download Submit
\SysDrvPZ\xdobec.exe

Filesize
2.7MB

MD5
c6e50755679cc99d522bf6571772c81e

SHA1
d03d07add3cd2467217d87c803786f3881222fde

SHA256
dbdc55dcc1e7971a0ddebc45959646878596ebaa6bfb0061ffda32cb770365a7

SHA512
b2393f1f173df3c7c168655b1e4f8db1e29e8712d5952a0680e930a0f168b2e22583fe83955118cf072872ff38ac6503b986004e06368e6250a68801de765ef1

Download Submit