b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42

General

Target

b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
Size

2.7MB
MD5

097254fe51decdec005d28c53d9ef120
SHA1

9576ca60d55e9c1352da9a9e8b6c46988bfd4c08
SHA256

b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42
SHA512

aeb71c4192eefc8e89311830f2e08be31de1beaf9b04d4ac8f8f5e8b4681ba5ba18f65a657fe25c41697465099edec7fa7cfef40d6a4700a6ef0e87d25f34e7d
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBO9w4Sx:+R0pI/IQlUoMPdmpSpU4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

devbodec.exe

pid process

3016 devbodec.exe
Loads dropped DLL 1 IoCs

Processes:

b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe

pid process

1708 b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe

pid	process
3016	devbodec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxX2\\optixec.exe"	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocN4\\devbodec.exe"	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exedevbodec.exe

pid	process
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
3016	devbodec.exe
1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe

description	pid	process	target process
PID 1708 wrote to memory of 3016	1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe	devbodec.exe
PID 1708 wrote to memory of 3016	1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe	devbodec.exe
PID 1708 wrote to memory of 3016	1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe	devbodec.exe
PID 1708 wrote to memory of 3016	1708	b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe	devbodec.exe

C:\Users\Admin\AppData\Local\Temp\b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe
"C:\Users\Admin\AppData\Local\Temp\b80a2ea6b0ffe656392fb2e6176f83350bec017b41551625294efd8f9258ae42.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708

C:\IntelprocN4\devbodec.exe
C:\IntelprocN4\devbodec.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3016

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxX2\optixec.exe
Filesize
2.7MB

MD5
a95d3283f135fcdf49bbd5536d25bedb

SHA1
f32219994e0e8ae5f0994a490feb5f6a0c4e49e1

SHA256
4eb855066d3548099109f13c5025a7552c6d47f1b1e6d8c9b97aa93e1a3e6c04

SHA512
45d12bd4aa35ed8a5ce2dcf5382d43e625b5a052d43de806312b6ddddb380aef17ccf1e8d0b24115feb71e5f56660f56b3ba25f13ffc0508f8218efe4f270c61

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini
Filesize
205B

MD5
76d36c1d9296fde9e7240740f1677783

SHA1
becd22ae840412d48edce3b4f91c58d28a5257f9

SHA256
ba52724de50ce30a01ab423efc61ce188b64d99da53c573327bf4411fc673642

SHA512
ea58cd8efeaa9cae4fa94485820630e46f44ef3054015aa892175b4bb3adedf35cd4191c5886c5ef3159734b0ca9fe772ab570d96d9cb5fd583ff32f90529405

Download Submit
\IntelprocN4\devbodec.exe
Filesize
2.7MB

MD5
74a800a6a7ce1c9a55bf3fe32caba3f5

SHA1
367d8a5de557b74f3057b6bca5fe93daae543d09

SHA256
fc4e0612bf588b89d64aacfe537f572257e4ab81a32840074ad8bdde6802c075

SHA512
8ac7b7037a08b92f6c0e93c7579e4894333c6bac7dfd48bb5e0f8a2f7db42586e9b6cc7875ad7dd2d6e02ad13b434fc1f38723f34bec0df942895c8064040e4c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads