Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe
-
Size
71KB
-
MD5
6da72e533a6781549b70afd4e7faa3c7
-
SHA1
f84313b36765c830716e244cf6572c83caa85cd1
-
SHA256
b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4
-
SHA512
96b7d3319b20faf798f9f7e3a24bef4477ac357327d8195418fe399c52b5e180ea768f4a1993dfbace827f5905f1932ccab48db5f2124efb8ba2c418594360b7
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slp:Olg35GTslA5t3/w8s
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" albecus-odid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" albecus-odid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" albecus-odid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" albecus-odid.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45584E43-4c5a-4c49-4558-4E434C5A4c49} albecus-odid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45584E43-4c5a-4c49-4558-4E434C5A4c49}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" albecus-odid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45584E43-4c5a-4c49-4558-4E434C5A4c49}\IsInstalled = "1" albecus-odid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45584E43-4c5a-4c49-4558-4E434C5A4c49}\StubPath = "C:\\Windows\\system32\\ihbihoat.exe" albecus-odid.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe albecus-odid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" albecus-odid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\obtoareab.exe" albecus-odid.exe -
Executes dropped EXE 2 IoCs
pid Process 3696 albecus-odid.exe 1296 albecus-odid.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" albecus-odid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" albecus-odid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" albecus-odid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" albecus-odid.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" albecus-odid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} albecus-odid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify albecus-odid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" albecus-odid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eavbakooh.dll" albecus-odid.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\eavbakooh.dll albecus-odid.exe File opened for modification C:\Windows\SysWOW64\albecus-odid.exe albecus-odid.exe File opened for modification C:\Windows\SysWOW64\albecus-odid.exe b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe File created C:\Windows\SysWOW64\albecus-odid.exe b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe File created C:\Windows\SysWOW64\obtoareab.exe albecus-odid.exe File created C:\Windows\SysWOW64\ihbihoat.exe albecus-odid.exe File opened for modification C:\Windows\SysWOW64\eavbakooh.dll albecus-odid.exe File opened for modification C:\Windows\SysWOW64\obtoareab.exe albecus-odid.exe File opened for modification C:\Windows\SysWOW64\ihbihoat.exe albecus-odid.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3696 albecus-odid.exe 3696 albecus-odid.exe 1296 albecus-odid.exe 1296 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe 3696 albecus-odid.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 668 b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe Token: SeDebugPrivilege 3696 albecus-odid.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 668 wrote to memory of 3696 668 b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe 85 PID 668 wrote to memory of 3696 668 b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe 85 PID 668 wrote to memory of 3696 668 b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe 85 PID 3696 wrote to memory of 1296 3696 albecus-odid.exe 86 PID 3696 wrote to memory of 1296 3696 albecus-odid.exe 86 PID 3696 wrote to memory of 1296 3696 albecus-odid.exe 86 PID 3696 wrote to memory of 612 3696 albecus-odid.exe 5 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57 PID 3696 wrote to memory of 3520 3696 albecus-odid.exe 57
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe"C:\Users\Admin\AppData\Local\Temp\b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\albecus-odid.exe"C:\Windows\system32\albecus-odid.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\albecus-odid.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1296
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD56da72e533a6781549b70afd4e7faa3c7
SHA1f84313b36765c830716e244cf6572c83caa85cd1
SHA256b3bd52c5b5c6896ce91c7c1c870c8cc9eebf9dceac599b4c8f011cdbfbda52e4
SHA51296b7d3319b20faf798f9f7e3a24bef4477ac357327d8195418fe399c52b5e180ea768f4a1993dfbace827f5905f1932ccab48db5f2124efb8ba2c418594360b7
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD56296beb0972c6e2ee0668f4f3632c58b
SHA137e5ff78e63e561a3ad56532b812e1a45f4f4c7f
SHA256432ff45343adce9170bdc77f01071aa699f1e12f3b609e1995796ac8916b4799
SHA5121810787b0ad3f18ae087352e395696248c49629e872b6e9469a33dfb8703a9bb14679152c02e8eba0666e478e25bf75be474380f8eedcb4ea93128730e9ca142
-
Filesize
74KB
MD55de72f9d06c3bc5de99ac02efb5096f2
SHA104999050e80d734a9343380d916a463e52060df2
SHA256b5791d7fd9c01882631d28c61b158b12d41bbf996b4fa29fd3dcb32784ac92c7
SHA51261284bc21b2af944e6f75c50990df16495c72be6a392184b9118cf17ed561e17232e32171b51352111363ca2ebdaf0561098e34c602d278c7adef087b45fe220