Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 22:39
Static task
static1
Behavioral task
behavioral1
Sample
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe
Resource
win10v2004-20240508-en
General
-
Target
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe
-
Size
3.5MB
-
MD5
3ca78b4470ad81124f5a46b182f843de
-
SHA1
9a34af988758d6bfd26f656437ece55936a2abaf
-
SHA256
19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54
-
SHA512
cdd11b4c71d0c19baaae52f3b08c4a80a0aa240914415d7f8a04974c5a4f57c6c22e6fe6847ec2a79678ea0ad4d3c90216da19d1c8cac828c2075d7acfe5d62a
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4SLDtnkgXL35xZzlPBq4Ow:+R0pI/IQlUoMPdmpSpj4ADtnkgvNWlw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1800 xdobloc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotQD\\xdobloc.exe" 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxBT\\dobdevsys.exe" 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1800 xdobloc.exe 1800 xdobloc.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1800 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 91 PID 1476 wrote to memory of 1800 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 91 PID 1476 wrote to memory of 1800 1476 19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe"C:\Users\Admin\AppData\Local\Temp\19c6c2360216a8202273b4e0b159c52eaa4028698d085d3477860effedb36d54.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\UserDotQD\xdobloc.exeC:\UserDotQD\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD55fc1f9f32cfb77cb9db101e35961ddb1
SHA15ebd1979f26a5d2549ebf75a125241e3e8424728
SHA256091c739a335c593cc8f134193feadaff9d55db5695329aec1b532c475d41dafe
SHA5121aef814c98ccc925feb3ddc6e74da742e8eb21a58fa6a79b76c203116cc24e98b2a77a2c95ea440c57a615d7886977c00b161cb56ea0fbb7872e87009f059699
-
Filesize
3.5MB
MD5e993f220769f5e80c99ea09e7b80d088
SHA1c80e8d6bb1452c8f4cc2ec9d910a5c21b3282f02
SHA2563aa60f81e3204cd9527285d439c2a8e836d918029c49075f1121af62f4586d7c
SHA51248e4aa73abb0024862a30da19e6a91d9b3eac1fc2a9c63310d4edd46d0f871ca2920d6c543b44ced18654adb09fa8dfcc7cd974c35518e58193fb4c872e0ec9d
-
Filesize
206B
MD5d55613ef0eb295c887479f15f83b0330
SHA132f1206c279b44a49ed2724c5fe15491ed17bcf5
SHA2566b6bb33648c45a1d49a09f7a0f0b10e2f882032a534b6fd76b8e13ca3ce08553
SHA5129e4f2242a1abd63274a82ea07bf4d41b3a28442643c7a948e34d87d1e14283409695e0bdf5684b22f9b3c3dd07a5ba23009430a2a4a86567133450586599146d