5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
Size

2.7MB
MD5

014f41799d9e65e6251e3dcfac45aa68
SHA1

b4d73758350a2d067f6ab9e179017129f18b8cd9
SHA256

5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672
SHA512

59555e96f55ecaa11c62f532d38c6327f57b3a9564cb825cc2331f5805e8a57e0f4be2adf5ddecf75f9e225c8b95afd1e0b3e8df7afd453bfe867297b7db122c
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBD9w4Sx:+R0pI/IQlUoMPdmpSp74

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2432	abodsys.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeNR\\abodsys.exe"	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintHB\\optialoc.exe"	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
2432	abodsys.exe
2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2432	2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe	28
PID 2216 wrote to memory of 2432	2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe	28
PID 2216 wrote to memory of 2432	2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe	28
PID 2216 wrote to memory of 2432	2216	5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe	28

C:\Users\Admin\AppData\Local\Temp\5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe
"C:\Users\Admin\AppData\Local\Temp\5bcced87ef7a76236649545f255773df4c5d13b68bc8b24df9f136813b949672.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216
- C:\AdobeNR\abodsys.exe
  C:\AdobeNR\abodsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintHB\optialoc.exe

Filesize
2.7MB

MD5
04933de749283e091cf29449d357a68c

SHA1
2d02679ea8f06a420f303445eff09b48f81abd2b

SHA256
b4a069642a1f3ae5bb603fbc3ec135a80b7a8fcd84a2326bd51d3ef55c56ee1b

SHA512
03f13ddf22c2af7dbf6ec71d385528c68e9c8c11b872c6c3a3ce2cf4faf3adea56f978722e7372aa9e7734d852d961777e6f5ab5773a04c7ae0a163a594993bc

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
203B

MD5
4f010778d8effdb8f49b6f226c650cfe

SHA1
2180358c3524476ffcd5f029f1807168fe89e5c7

SHA256
f1be0e87b028399f941abe36013616e5eb64c94ec8d328360bb8949d54975bb1

SHA512
a442435c7efeefd13ee966004c5691245fd099baaa9ce0689f10b7f31a8c9a0c07e617754253fb05316aa4bf5b800e584c9f62e923a3101c5fa17beccfd59254

Download Submit
\AdobeNR\abodsys.exe

Filesize
2.7MB

MD5
b469b89e5be2a1761aee5a9719fc51f6

SHA1
044453dbdf4af806c1515f4252b7be5495153b82

SHA256
ea53c5639d3eda9e70a33e00a37969a9346f978cab398f65af155beae42bf8e9

SHA512
40568ff3b7ae2bae5a28a2f47887278157f88a968b38e0be9f516d9d670c42953ce3f68b3a2c97950da76c21e66f80322f3bb362a60790445ff57c46b99f4156

Download Submit