827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef

Analysis

max time kernel
149s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
Size

2.7MB
MD5

8b1c3511b87070a70f82e7ee0c6b3163
SHA1

f8c7206a4fe543c872c933806d7a0979f757a9d2
SHA256

827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef
SHA512

9cbf6ccd20e8fa2ca05611c434ca40a474f023c8b6d81f810d62333614031d498479987ca5d00ba300df84016cdccf8bec665c9aaea8fecc1d55aa269990ce7b
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBk9w4Sx:+R0pI/IQlUoMPdmpSpu4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3880	devdobsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeHE\\devdobsys.exe"	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB87\\optixloc.exe"	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
3880	devdobsys.exe
3880	devdobsys.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3880	4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe	88
PID 4052 wrote to memory of 3880	4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe	88
PID 4052 wrote to memory of 3880	4052	827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe	88

C:\Users\Admin\AppData\Local\Temp\827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe
"C:\Users\Admin\AppData\Local\Temp\827ae34ac60def097323ccf49a89d396079b39696aa36b5ada59023c0e5f25ef.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4052
- C:\AdobeHE\devdobsys.exe
  C:\AdobeHE\devdobsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AdobeHE\devdobsys.exe

Filesize
2.7MB

MD5
b6151471ebb3afdc739ed8113f5917cf

SHA1
aa07846b4e6b640f2b77380fbef95012c98d7044

SHA256
8d26b608e79a5567be08c3e7fe77f0ead9c5fa0f0097db21a5934e99d5134226

SHA512
9d5f08ef81e5a5699db5141c90e0ddf7bc981db490653b94a139a066a816a5f03c3dd2af0ec85c9cbe9c4bb40c9c91bd7e3411c8f72b1257e26fdcf0a6f9f58d

Download Submit
C:\KaVB87\optixloc.exe

Filesize
2.0MB

MD5
249849cf8553ed9696c4cf701bf4a275

SHA1
01347a9569a60f162dd88a43188eb6a1ede62513

SHA256
edc1f91aa3b3c1be7d52c6553c54d1aef551a8d454e91efc2940ad183606d1f8

SHA512
29407fcac2b510bbbbff6a8c43c59f8147b0e093458af8db83f72f6dd9128cebdc4cafa59c0355c6c9c2bdf4d3f155fdf00d6a69eaa71c7a671a13b063e58895

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
cdeb7032edb0f896f9f7a4e100171508

SHA1
6c6cf10cc89470d938bfa14627e5e175e8090608

SHA256
3fe1eb832bb97858c7c934e07d663a12c21e3ed76f2e78e60705c9f207b110e8

SHA512
9362703b1a18b6288653ec8ac7c0689ae4bfc0c4b53d6c07be84aff36273949d92ed0f9929f9bfcd24223dc2c26a502ac6322bc4449a6550ffad39232432c173

Download Submit