abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71

General

Target

abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
Size

2.7MB
MD5

e9afd8cdffa8bf482ce7075c6f538211
SHA1

bdd30b3daf619ca266b908ad89881d0fdf0a63fa
SHA256

abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71
SHA512

bf0ad84bd7924971c44a2a2df14d3ab57f7006aca5eb707d6a865e9caeb4b0699dee0a168de4146d9a92c966b40e4d19d5d0f284b24b6674f6cea48c3f9cfa73
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBL9w4Sx:+R0pI/IQlUoMPdmpSpL4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

xdobsys.exe

pid process

5840 xdobsys.exe

pid	process
5840	xdobsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesSU\\xdobsys.exe"	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidWA\\optidevsys.exe"	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exexdobsys.exe

pid	process
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
5840	xdobsys.exe
5840	xdobsys.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe

description	pid	process	target process
PID 3100 wrote to memory of 5840	3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe	xdobsys.exe
PID 3100 wrote to memory of 5840	3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe	xdobsys.exe
PID 3100 wrote to memory of 5840	3100	abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe	xdobsys.exe

C:\Users\Admin\AppData\Local\Temp\abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe
"C:\Users\Admin\AppData\Local\Temp\abd78941ed82bf79223c6002179d23f86b9d277289bcb3cccdb8aedc2516fe71.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3100

C:\FilesSU\xdobsys.exe
C:\FilesSU\xdobsys.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesSU\xdobsys.exe

Filesize
2.7MB

MD5
86027326d72b3114eb7a03478d0147fd

SHA1
4a7a562b707d7ab704db49ce34771fbc7c5c2847

SHA256
78394517edd56fef85855025303d1138237edcf586f33d2695c1e15a9e991ab0

SHA512
9be61c2b553330951ee13978b6ea9bcab37dc4811ad3137b7fa7e23513f3cad66599aa279c1be35dcd6153d1f299e931840f55ca0b5789437f888c9fd9a5e0f8

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
201B

MD5
f3336a7ca09e6c3845e0e7fd782a1142

SHA1
26ff2c412706734a24833bc2b99bdd4d27c8a3da

SHA256
f7f7efd276ed093f0a9a9198865d8fefa46bc553e5e0ec3850b8ede2e5e94fc2

SHA512
9bb0badf80f47b3f989fa101de937cb1c7ce7d965c71c3ef6a855333fc9d8ba6502d09d7a23729bf3ba4d8984306c0d019f1a10a9f4dbb5ade220a3ff905ba86

Download Submit
C:\VidWA\optidevsys.exe

Filesize
2.7MB

MD5
57786953a8faaeae14eac1a0bd852418

SHA1
a3e68be186ff3dc7af2bc2aca7c32843bdaf7bbe

SHA256
fa9a73ed4a34988d3942e3bc66925b5c7b0e314ce3d3d3555ea9a99817fd5475

SHA512
81cd8f7d64f9617b6f7c5a11caa700c5fe3241c3564f16a889f2e195b0f684c6f81f6a144c3b9070b9d8b813462a01ab0b4d2c1b741d2aca3a1152b99bc5a4f1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads