c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58

General

Target

c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
Size

2.7MB
MD5

2f4e3d65642c7cc9e97717163af40f73
SHA1

b4dd9ed28de9663fcda3e5e760fcd2a2e34e477c
SHA256

c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58
SHA512

6ea351a1c40c334c1a7ce08822fb505b6ba4037dc1503229fe6d2f8bd1f541ed59336a570786d83a687dc41b49f2905eb37ea74028514aa42db4a9a600bbbe34
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBm9w4Sx:+R0pI/IQlUoMPdmpSpw4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

abodsys.exe

pid process

3276 abodsys.exe

pid	process
3276	abodsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesB3\\abodsys.exe"	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZAJ\\boddevec.exe"	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exeabodsys.exe

pid	process
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
3276	abodsys.exe
3276	abodsys.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe

description	pid	process	target process
PID 4768 wrote to memory of 3276	4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe	abodsys.exe
PID 4768 wrote to memory of 3276	4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe	abodsys.exe
PID 4768 wrote to memory of 3276	4768	c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe	abodsys.exe

C:\Users\Admin\AppData\Local\Temp\c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe
"C:\Users\Admin\AppData\Local\Temp\c1a0eb10f74cee96f8b78868f23758f4597a4fe0f5996337a9978cd0849eba58.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768

C:\FilesB3\abodsys.exe
C:\FilesB3\abodsys.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesB3\abodsys.exe
Filesize
2.7MB

MD5
0b673284b3c8e3e2e467062811a063b7

SHA1
166a0884246341cca30b65d1d2f0d4aa0c27c837

SHA256
98690417878a02fcb7ead2a36b51198eb0d50c4edb35908f483c4c4657104f6e

SHA512
4c8f6d2f790facb35116520a20ca09973200d5fe01a1940dc0e170e125b14abbcc2287fc6406b266aed4513614cb1a020a9eca0212418ab75681b539bced91b4

Download Submit
C:\LabZAJ\boddevec.exe
Filesize
2.7MB

MD5
3168dfeae30d682f0482006b3e278cb9

SHA1
e320741ca1a03b89ae4829696222d55fdd197993

SHA256
c94b8b5dbf32aa079cd42c36559955f96b9b77c613332ad4036d003a83302a02

SHA512
16902763444b21bf31dec7320869567a90a1502f1471b949b5839f6b69bd1ff853f5ca9fb7c9562abd7ced494e6c3ad45868143ccc6a23bc49772d91739d6013

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini
Filesize
200B

MD5
1b282643013020538b6b9dee56379a13

SHA1
4e892be325de0fe2cb4e496a5647e6f234dadb38

SHA256
0a6678a394e0c405919f7654dfbe62c9d0af08e80b3c5b52837d685152531922

SHA512
fb5b76433358d6cebf65c71261bde9cd11b7edc0bca3d97e75d0b9cf00629079ecc26432111ba8a667b1f8df500fa69a8386d16474bec781feda7d08aab06989

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads