bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58

General

Target

bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
Size

2.7MB
MD5

5d89ae3cd6222d228c977547475f9c89
SHA1

f583bd60397bc5d6f24f011cf2937e2289fb7f6a
SHA256

bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58
SHA512

4844606c204e258d68e83192e35e5abc147bbd31f4e2d027377d3b909891404936e025f0ba1cce02a0664d2ca5368bd4378b04c5b4428486a4b44386661ca240
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpI4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

abodec.exe

pid process

1532 abodec.exe
Loads dropped DLL 1 IoCs

Processes:

bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe

pid process

2344 bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe

pid	process
1532	abodec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvJH\\abodec.exe"	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZSU\\bodaloc.exe"	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exeabodec.exe

pid	process
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
1532	abodec.exe
2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe

description	pid	process	target process
PID 2344 wrote to memory of 1532	2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe	abodec.exe
PID 2344 wrote to memory of 1532	2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe	abodec.exe
PID 2344 wrote to memory of 1532	2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe	abodec.exe
PID 2344 wrote to memory of 1532	2344	bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe	abodec.exe

C:\Users\Admin\AppData\Local\Temp\bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe
"C:\Users\Admin\AppData\Local\Temp\bd4e3b5bab2e6418e701ab52535bd2e87614bdef9fd56035bfbb6c1b84caaa58.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344

C:\SysDrvJH\abodec.exe
C:\SysDrvJH\abodec.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1532

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZSU\bodaloc.exe
Filesize
2.7MB

MD5
408a8cd6a39c9e67541bfabc8aaeab47

SHA1
70ec09cd4b4b7fbb4ded064d32b80b2534fccdcd

SHA256
4b3130f307a20b3bcb02c5f113ae5d063a99ec3e9921ff2a187b0f297169f8e0

SHA512
0a79261ad77ce6045b5bd66658c96137602179e28f72162692df654c2253dbcaded9e3180883aeee65341c5af1aade3df791915afeaf2390d7e662cc9c9b933c

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini
Filesize
200B

MD5
8b5cb53bc27bcbed367d8568555a80b9

SHA1
5761f1c532bea7b944594c3832f4f79eca9f77e0

SHA256
5cde7c0662a8439a0a67ad483bd12b7236fda5876d4ff87dcf8564a7b921a2e1

SHA512
fbcb1968f6f31601807d331b10f3a08c740ab076f8d14e0f539e55c5854f2809a7e9808e5dd09d43cf2efdb2253361b282982cb6701794ae32d31d59f93609cb

Download Submit
\SysDrvJH\abodec.exe
Filesize
2.7MB

MD5
d02d401626271409be71732b71447f3a

SHA1
2dabd76bf1ef619273fc3ba618bb2403e82d6389

SHA256
ebd938ae4e62b83db7510f08020a16731cda46a08ad26ef4dca53b74116e9cc6

SHA512
cb40ad6678371e5b7ba9dc8aede25c99c037e672106facfda513d88d88b97f763d84b835a74c4b22bfd598f9d1b319a855d5a6938b987356e61f25db5e9c28a9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads