3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
Size

2.7MB
MD5

05b45e37a7682f6188894d34725379dd
SHA1

b7b6c10af66fddc0246cb5cff7428a0a08cc5b7b
SHA256

3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978
SHA512

36882571e178878c644fbe5ab48af1f1abb706541bad951ca0bffd76480c00348ca45cbc8b164d9f616d763c4c32cfa545c61fdc3d601df04d5d1e32559953cb
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBC9w4Sx:+R0pI/IQlUoMPdmpSpw4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2564	abodsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv90\\abodsys.exe"	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBWX\\optidevsys.exe"	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
2564	abodsys.exe
2564	abodsys.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2564	1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe	87
PID 1632 wrote to memory of 2564	1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe	87
PID 1632 wrote to memory of 2564	1632	3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe	87

C:\Users\Admin\AppData\Local\Temp\3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe
"C:\Users\Admin\AppData\Local\Temp\3f1c24b579db7a623016a311d9f2af6772caea771960c88660b1821b7137f978.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632
- C:\SysDrv90\abodsys.exe
  C:\SysDrv90\abodsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KaVBWX\optidevsys.exe

Filesize
2.7MB

MD5
3818ce2a60cc38740f58c4d9b351f729

SHA1
b2e62889f847e4569e2ac569e5a053097248444a

SHA256
90d7d21cee1955e4004e89554fe0738903e681f847377485e090f0f833488bfa

SHA512
f04ff9c202d9e803546cdc217da666b094ccfed5099f1dc08cf2a13ce23d2ffd1162a9c7a5630f5a1b98e018ae9d57484768b5e706b2be8b03214a88da5e3f37

Download Submit
C:\SysDrv90\abodsys.exe

Filesize
2.7MB

MD5
2d94cb20500eaa6de6b73ca5df0646e7

SHA1
d7e50497b98b32c6470dfafffb107d2cd9581076

SHA256
3317885c1d35fdb9346029da3e6bb83df0d2482af046545f38be5170b5357f76

SHA512
0f4f9b8a2852fb5a4af3eb28db2c0ae7432724d2027d6a72ff51534ade68734ae8157658e39d897afe3e23ec2d7db1a9be81e1c967f75600b2a6ff97e385b3af

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
d077eef518cfe790e62f39c352a35b89

SHA1
4447fcd5e7733c9261dad5b937491bdbb8e3db94

SHA256
f0675730af5f56cc69208a646c0b6be299cd2cece81c79230ffe6d121136855a

SHA512
357a45ff250a1fe8c5d29b819fe6ec25d881463c426994df6ab7a39f5d03b873a57da35291c231a02cce71ace7cbbb9ac060f28c3d76e11d38f2d0a2a5427451

Download Submit