18eb5e6af3e1496fcc4d1346a2386526ec12e684edc4553a30f3691ddb01784a

Analysis

max time kernel
149s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
Size

2.7MB
MD5

a1c6e96bb4f7accba8a1e06f3018f063
SHA1

71689e9f50e62e7e1ce301af93d27a9bd8b2b326
SHA256

18eb5e6af3e1496fcc4d1346a2386526ec12e684edc4553a30f3691ddb01784a
SHA512

00eac87ba9c1e5a4618ae247e8965b2d418b3bdeeedb3aa07991b451353836fb930f83a07637a79d291f6c010b88c0fc7c07e48917bda250b46347ca22e25269
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBs9w4Sx:+R0pI/IQlUoMPdmpSpG4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2148	abodec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocMT\\abodec.exe"	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintZG\\optiasys.exe"	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
2148	abodec.exe
2148	abodec.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 2148	3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe	94
PID 3484 wrote to memory of 2148	3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe	94
PID 3484 wrote to memory of 2148	3484	a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe	94

C:\Users\Admin\AppData\Local\Temp\a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\a1c6e96bb4f7accba8a1e06f3018f063_NEAS.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3484
- C:\IntelprocMT\abodec.exe
  C:\IntelprocMT\abodec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IntelprocMT\abodec.exe

Filesize
2.7MB

MD5
97762bb2f163e0c3f8c212a34e2354cb

SHA1
357ec51b59543ca064fc8c06aa4a3f297542ea03

SHA256
e45ed99cc2446ab091cf654d24a31b46a87634e1d391ddd2e8209d41e62d2202

SHA512
b53df41a271b049d031ef640a8d35d72cfbaccf200e9ac5c4f8695ca2ca8fd14b4fae0711f3b364002f6618a12a5473a960399ab396f3f0e26bf5a9c841aa6a5

Download Submit
C:\MintZG\optiasys.exe

Filesize
1.2MB

MD5
fe1b44c6248615cd7732369578d14872

SHA1
1fd5ecc605c20ff70da2bc24cb7682de87c46741

SHA256
93a0770edd09c0e2a303643eda76d2e1a3f2ce589c35e4d31d9ed7b8d51a75b5

SHA512
2f5a4956250b1106a7b0e67168d022f51c030c35c4ce4ef351bc446045f0766bdb7d070f4d9d92b4bd9150144393702decc8178fdafde38b59825f96e0a7e62c

Download Submit
C:\MintZG\optiasys.exe

Filesize
2.7MB

MD5
5ab4be904580b4fdae164d3a876caa32

SHA1
70bb07b2e4cb109ee749fdf34626be3dd1a16ec3

SHA256
c50052d0a6ca64d638f81c6a5d3efc5eee4da156d4a7185cc7caf3053739be5f

SHA512
660ce667bacab4da32f20e42a498e1e10bc484311b6437f838508348e23207766c01bc349ce01e091fdd597ab0beadcf4dd342320b8639bb667896a3f4fb0806

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
205B

MD5
44ce6ddffb63b03e3fed3595de401644

SHA1
b213d4958fdc90da7d431eb3180f6c1e336acbd3

SHA256
a7248649efca49fae04a01f701b141fc8c9a090a0ada624cb1a27ae2d9ffc092

SHA512
91bbb03d2f492f439c9344d00beeee5cc7c9ffc90c7f8dec3b5613646643c2498531e4d668ba4f98bb410adba1cb7b2e3010f1524c07c664f7e4caa8b466ec6c

Download Submit