Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2024, 13:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe
- Size 2.7MB
- Sample240522-qfgjjsce88
- SHA256 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612
- MD5 02bf488dfddcdd8aa1b3dce981ca7820
- SHA1 7365e602170f8953304fd4071a22f0660a6134ce
- SHA512 ce1ed8af0073b1ff53a092b640194c7afe783752319c8b5f8ff3b7024178ff37d0fcd8befd73211ba0e484f254e4f0d379d8914848083ff8206ef59fcb74cca1
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBK9w4Sx:+R0pI/IQlUoMPdmpSp84
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1400 xbodec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvWZ\\xbodec.exe" 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBHM\\bodasys.exe" 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 1400 xbodec.exe 1400 xbodec.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4736 wrote to memory of 1400 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 87 PID 4736 wrote to memory of 1400 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 87 PID 4736 wrote to memory of 1400 4736 2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe"C:\Users\Admin\AppData\Local\Temp\2f9b7d1b71a39962f67214efb9070bbd20201ae9cea567e4e4a8661f19b84612.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\SysDrvWZ\xbodec.exeC:\SysDrvWZ\xbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBHM\bodasys.exe
- Size 2.7MB
- SHA256 1b1f74f0e0303529a68da0a3e85c148c9db66d5a4573bc0a54b314cc98ae47bc
- MD5 cda2ad9a95c596aa5356c8e81ce2771a
- SHA1 e959dc3045e42f21cf3283ea2bbdf2af7f9d82f3
- SHA512 224870f8fb00089e3109ea9e3de17604cd5cbdf10d85c909535797addbe99e90bcabf5ebf12ccbef10b450458f3d3cc480a3a38ab57604fb448572e805337a6a
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBy9w4Sx:+R0pI/IQlUoMPdmpSpw4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvWZ\xbodec.exe
- Size 2.7MB
- SHA256 f7be46e7914b60a0817c278bea0a1826c9b49f2f40a30b35277797a776997bfa
- MD5 2178deefd689cad4dfa1614c429fcea4
- SHA1 9da18d9da927e80fa0a795e93cd37c030904aa88
- SHA512 100bf3348852c32110f0bafb5866cd65b26a857cd7957afec9fc4ce42be93b6444cc8879d9a84cf26b0a70c5472bf122909f3be038ccf7fd03ecefede51e0395
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBX9w4Sx:+R0pI/IQlUoMPdmpSpb4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 4598ce01dffe8ca7cef6657ee21f4eeb6bc0e5cd73ef1bffd30cd921d48ebac2
- MD5 65bfb4cd14505bb2786b021290b573bf
- SHA1 59ca186e232f2f8dbd6358457e77f6806ceb6cb6
- SHA512 8e0bb34f6589acf9ee6b52288aaec5d606a4e92ad5a73dddc466b1e291da4922f120c179239d7818b01605e066ba8c15b245eb92f429db3e5446a3fba1b828f0
- MD5 SHA1 SHA512