9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e

General

Target

9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
Size

2.7MB
MD5

051265d04d5c4626c40c62591cefff1b
SHA1

5108848cae5f15ad42acf930d27cac27a14f6999
SHA256

9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e
SHA512

b64b571aaab1641d02fba83b1388e26ff705d873c5e902ea1325b3fc98c7a816b54b59a9f8503505e2f0a40c49e01886ab003983e2c89d0373afb2a878e3773e
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4Sx:+R0pI/IQlUoMPdmpSpj4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

devoptiec.exe

pid process

1776 devoptiec.exe
Loads dropped DLL 1 IoCs

Processes:

9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe

pid process

2192 9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe

pid	process
1776	devoptiec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc5M\\devoptiec.exe"	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidM7\\dobdevec.exe"	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exedevoptiec.exe

pid	process
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
1776	devoptiec.exe
2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe

description	pid	process	target process
PID 2192 wrote to memory of 1776	2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe	devoptiec.exe
PID 2192 wrote to memory of 1776	2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe	devoptiec.exe
PID 2192 wrote to memory of 1776	2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe	devoptiec.exe
PID 2192 wrote to memory of 1776	2192	9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe	devoptiec.exe

C:\Users\Admin\AppData\Local\Temp\9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe
"C:\Users\Admin\AppData\Local\Temp\9b6be82be5b993a2d72a8be7a64ec19f3fd7d69a7bcfec967636ba22d6fe511e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192

C:\Intelproc5M\devoptiec.exe
C:\Intelproc5M\devoptiec.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
206B

MD5
359a1ca70cc33de322216c78ae0dd084

SHA1
df142a6677abb3485924df516a43f193dd25fc0d

SHA256
a70b881b30f8d1f405caa7d61c919572854f829a5cf32d71b43d80a6de29d790

SHA512
1533ac063a7b9e020a668ecb617aec40036c40492ce74e7cdd7df7eed6c2ab32502818ed91c287a337c7280e96cef9df6aca5ff0fcb0549dcd984a23804a2bd4

Download Submit
C:\VidM7\dobdevec.exe

Filesize
2.7MB

MD5
a8f9977eb5f0ac1cfde230766bb0a745

SHA1
3f8e3a129898cb474df685c3693670cb9bdc5e80

SHA256
69d44e16d558f919af0daa7a240172666d1ac82bfb13e11d6bb1265553cbd603

SHA512
bb66bac37ee87d5b68facf033b0e167a88bca1f3e8574b61f186733d646a54e7a45f58127e068c2ce3657316ce150ad3d563afca62dd074f1229da0f6cd68124

Download Submit
\Intelproc5M\devoptiec.exe

Filesize
2.7MB

MD5
5829baff16586a0374d0eb308d67be7d

SHA1
8d0ca9f80328358e76e09dcb5c852d87077122b4

SHA256
3759a556924817fa47394b0151497dbaab815b90821d31e3f67ecdca0e3f61a6

SHA512
76cbed6f6740a53187d1e9ee2d5a12ded32f4c330a9244233766b3f491005e1ada75df44964103fdbb8d644da4e7e7daf4758272f1c29cfd8e732d8fbea31dba

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads