b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9

General

Target

b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
Size

2.7MB
MD5

178c1dd61b7e12c0a35022e517bfcf17
SHA1

5844af708f197d8225d060b9f28a92fa4e93db1e
SHA256

b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9
SHA512

d1710bf8be8ad3dd563edbb6fd6fb182cdd43fbcb1a01e7b4656b595557707da2432ad8adf497e74e019a56097f3ed620f3d189d03252fdce4f58ebe2f58cf10
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBy9w4Sx:+R0pI/IQlUoMPdmpSp44

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

devoptiec.exe

pid process

1836 devoptiec.exe

pid	process
1836	devoptiec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvCC\\devoptiec.exe"	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintZK\\dobasys.exe"	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exedevoptiec.exe

pid	process
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1836	devoptiec.exe
1836	devoptiec.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe

description	pid	process	target process
PID 1468 wrote to memory of 1836	1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe	devoptiec.exe
PID 1468 wrote to memory of 1836	1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe	devoptiec.exe
PID 1468 wrote to memory of 1836	1468	b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe	devoptiec.exe

C:\Users\Admin\AppData\Local\Temp\b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe
"C:\Users\Admin\AppData\Local\Temp\b6d7032d1adb5b271165b6160deb1a72f0d7f7fdce04d6ddfd26b8aeb3f712d9.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468

C:\SysDrvCC\devoptiec.exe
C:\SysDrvCC\devoptiec.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintZK\dobasys.exe
Filesize
227KB

MD5
1e8a9d96b5dff408db2c730243994aec

SHA1
f54c337e4c909cda28cec72c919e87b1212d1760

SHA256
9f71e228c9e29b8ecc4ab609f252d2173c605f077f654d172f9fb2d9a8e44fbc

SHA512
053afd15aa834ef96720f7b0e3ce8b5c88e16742309526ff30a8c35640bec731ea50f31d7f8cc84b2c274a87c0e4c08a19b7991aed4bba4a0f1d7a65beb8eaa3

Download Submit
C:\MintZK\dobasys.exe
Filesize
2.7MB

MD5
091ff96475700ce59996853dbda7b405

SHA1
242b90bf6e59c89e9a90c65a8aa91b283c4baf21

SHA256
a6ff0f230b37f140a81941d5c167ad88463b2480dabea45997dd7553cd9897b7

SHA512
a2040256fb32c219f0c8a2be64e06cad35e7448ee1f7df50333482c264bedf28a25119b8afb1aaecefe38803691b803682d3eb43c0377937b5f632d742debf0f

Download Submit
C:\SysDrvCC\devoptiec.exe
Filesize
2.7MB

MD5
148b16ed6ced329236aece358fbe0f27

SHA1
f5526f22843b5d0749e7c683f1a78f14cd08a281

SHA256
1c6d0674389e2cebb30eeaa0e6088db9e3f156df7c1b5dc3b10c35a775d685c2

SHA512
9b9efa3c419de24412b1af3f6bb6dfc1d1e6f5d44565d7a3696e854425cdbfe3aeceb791d283ac916b42e3aaffdf635748b3fd54587ce0aae0d2f8c98d5b96a9

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini
Filesize
202B

MD5
5c37bd59f450f5d0bc95482693f3e0ce

SHA1
304b17f129bc0dd21cf9ac8930f1130b475d2cb2

SHA256
a9c6278e18bb2aa6929117179f89d944daf799358fd2b4c03c29a1cc1ea5569f

SHA512
00bd5e94d1c33d8f0b40f9b00e666f27ebbc1f0bd0cad9d20014a1d7d8bb3aad557309eaed65d14d5b0b0edd063338fb1bad21216a4ab732f619ca1387faeebe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads