57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
Size

2.7MB
MD5

8fe596f81a362abfd41fe74464b8e672
SHA1

4b1a892cb73a3b359ad6a4f9e322e33d06202cd7
SHA256

57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8
SHA512

9b9fcb90297263f01f6daf4de7f926476bd8ec20e022ad1585b3d5927bc71728c75659a3f3ded2649565c4df2cf3dfdfe0ee5505a661b47df444c880c94897b4
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBz9w4Sx:+R0pI/IQlUoMPdmpSpr4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1068	xdobloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocCZ\\xdobloc.exe"	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZXW\\bodaloc.exe"	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
1068	xdobloc.exe
2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1068	2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe	28
PID 2004 wrote to memory of 1068	2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe	28
PID 2004 wrote to memory of 1068	2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe	28
PID 2004 wrote to memory of 1068	2004	57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe	28

C:\Users\Admin\AppData\Local\Temp\57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe
"C:\Users\Admin\AppData\Local\Temp\57d12c6d11971bf8c2c46ec2761b484189fb992989f9a6f25c2b80fc92b232e8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004
- C:\IntelprocCZ\xdobloc.exe
  C:\IntelprocCZ\xdobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZXW\bodaloc.exe

Filesize
2.7MB

MD5
a9d381bd7d232ad3197da52fecba45c6

SHA1
463df5a18666037d47660c5c4ec4914ebc72bbd4

SHA256
d48881283faccb3ff3f639994710f43f91469f91b586ee36670a0c474d98e843

SHA512
275987eeccb50de0140d97cc2a72cfc3ec73a5f04420792b9ed212dd4002a14df266649fdc16ef8a7788b7e2eab08d54b9146e6620617bb3d9b1bba6d73867a5

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
40c90e96610052d533b7fa61a3705a63

SHA1
5f95964bab83f1c8230432cd81cf74673f1bfe0f

SHA256
bde301dc9948490391f5429397ec445bed7a78906046ed255aa04b0f89b792f1

SHA512
663355020b1c77eca49f163c65eabdaba5c75a83758c18ec05f4c63d8464508997c7a55e1ecd4ce30e5777ab39e58db1f09dec01ce8a3cd597484456d7975b00

Download Submit
\IntelprocCZ\xdobloc.exe

Filesize
2.7MB

MD5
533cf8c096dda4ea4bb1b077b3a6083f

SHA1
c21df0787b7089544291a849372067c864fd7f12

SHA256
ed0658049e8112a5dbfcf4713176c02d440ed9bb98ce9397cbd63c04d43968a4

SHA512
cc84fee98e4e10af6691c27bc4d729f2ac5667f90b5e56e93eba4ee9e16c765d3796b4831c0184b234ef8d1dae28da1723b66130e4263807bdda7449f56adbb7

Download Submit