bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497

General

Target

bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
Size

2.7MB
MD5

1e82ef583d875429e3022dc9e16fbfef
SHA1

d7e31fe9dd2806796078355e88c19b759e4b288c
SHA256

bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497
SHA512

6f2dca48899851efce3d79bbd5d522eeb08a1218c5c9f6eeb72118dbda5dbd17860d8519e5eed7b64911badafd6d6dd6f41c1b199eefb352cdcbfc4b7c3af3f8
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBM9w4Sx:+R0pI/IQlUoMPdmpSpi4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

devbodsys.exe

pid process

2020 devbodsys.exe
Loads dropped DLL 1 IoCs

Processes:

bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe

pid process

1936 bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe

pid	process
2020	devbodsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot9F\\devbodsys.exe"	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidWG\\dobdevloc.exe"	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exedevbodsys.exe

pid	process
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
2020	devbodsys.exe
1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe

description	pid	process	target process
PID 1936 wrote to memory of 2020	1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe	devbodsys.exe
PID 1936 wrote to memory of 2020	1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe	devbodsys.exe
PID 1936 wrote to memory of 2020	1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe	devbodsys.exe
PID 1936 wrote to memory of 2020	1936	bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe	devbodsys.exe

C:\Users\Admin\AppData\Local\Temp\bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe
"C:\Users\Admin\AppData\Local\Temp\bacdfc23cd441e75db7bcf8c60a311dede024ff9e081914ae29c9d8cd3ecb497.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936

C:\UserDot9F\devbodsys.exe
C:\UserDot9F\devbodsys.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2020

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\253086396416_6.1_Admin.ini
Filesize
207B

MD5
8ecaa20f98d6deb7e320172cecdbf4dc

SHA1
b2184abdc1cb145f6bd12b196ef47d0bef212397

SHA256
2b042730ed78b029c96dc94ebc3bd273a959e1221d811597b901a459088a3c51

SHA512
be7025bb8383ad60210948e270458ba3fb4415540b2449a6877e15c6099246cafc67e3d802545d50ed693f766563dcc9277db95bd3c88b433f7fdaac8f76e2de

Download Submit
C:\VidWG\dobdevloc.exe
Filesize
2.7MB

MD5
bc71d5e07688a24f0619447000a0a3a4

SHA1
f407b04c8f9a8c48b5bbd3a53c16356243945407

SHA256
f9c82d502d3ed59f6650aaf0119ebc59be2ac15d8f41e7c08c59fe0adbed1a18

SHA512
aa6216df4fc6d10bd7b92e6d52c38851d879f9acddc6d84f2f6297edbb3a5442c76a6aa28ae37d7c07089a1e8b446dfae066a7f352c904f61dfc326290165188

Download Submit
\UserDot9F\devbodsys.exe
Filesize
2.7MB

MD5
8101b01a4d1cfbdd57eee92aa7831ea2

SHA1
c9b7e8b217ca0e61e66fbf243a8f64d868d91e28

SHA256
8c3a90e0ff95dd37a961952024a45f92637160d3ecbefbbea4eca65a402a80b2

SHA512
2d64b6467e1d62e60aa32a040f6f5f94688ed5f8b6e3c2f940bd7add6afb7a9df1336d6962e59020dbbaa3f91e9b1158ec6a47b1bab2ef59e49325e389a3ea0b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads