c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66

General

Target

c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
Size

2.7MB
MD5

b06f2149acb5ffdb64375948c5638153
SHA1

13cf2cece119926cc3e36bff3447dc69cd12b7c4
SHA256

c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66
SHA512

f21ba228641a2b9efbabb123b877262d40860801502ae489967f6cdbcaa346adc3e732c2f74b209e7f7fb6e949dc7cc68732f82926000deca3a468a148ff2ada
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSpb4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

xdobloc.exe

pid process

768 xdobloc.exe
Loads dropped DLL 1 IoCs

Processes:

c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe

pid process

2924 c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe

pid	process
768	xdobloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintVH\\bodxloc.exe"	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotTE\\xdobloc.exe"	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exexdobloc.exe

pid	process
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
768	xdobloc.exe
2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe

description	pid	process	target process
PID 2924 wrote to memory of 768	2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe	xdobloc.exe
PID 2924 wrote to memory of 768	2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe	xdobloc.exe
PID 2924 wrote to memory of 768	2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe	xdobloc.exe
PID 2924 wrote to memory of 768	2924	c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe	xdobloc.exe

C:\Users\Admin\AppData\Local\Temp\c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe
"C:\Users\Admin\AppData\Local\Temp\c69406b187eccd8c319d5f05e52e3128db84b99d4648c08d9aa2af8cc3352b66.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924

C:\UserDotTE\xdobloc.exe
C:\UserDotTE\xdobloc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintVH\bodxloc.exe

Filesize
2.7MB

MD5
5643bdefa981c94c749c551e5ef2cbc7

SHA1
8df99933f832685dd772dc4c21ef4b2d645cf484

SHA256
576e6f9e58921141a4e0c7b4a77382f7fb9fc3d8ff5008523d9c97c3e943fd68

SHA512
6209f825b491217c5eac5f01bdb7a661afefe51814f7f5fc57db1038bcd8a2843d87d3a5b4bcc457c3eece15f099e6d4ae3e63fe63284e91146d01fe1d360f9a

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
6c19c2484d22252ae9ceac256a2ab684

SHA1
40fde44e4be7b14c50ea5b815a3163983fd2f4eb

SHA256
2f63e6162677a78d9f2ca3529aced329e4657f157c2d2f220d3a5040bdbdc884

SHA512
617474a542569f58e44698b5fbfd5ce68f8d51db252fddc6e73b02f14d4b3b1459ab2432d22675ca5e9725debda8cebe6db07859a6de48053a33cf6308efc361

Download Submit
\UserDotTE\xdobloc.exe

Filesize
2.7MB

MD5
62018a5331fd720841da3c24af9bfb52

SHA1
84d5b9543f6f45c77aaf041cc754d34d24804003

SHA256
a71f872ab2a1b34fa148f15fda265f8bff7a5d3633b4c21a2538e2ca538ee050

SHA512
12864cbf6124d31075a6cb0cc76b768d15feb7380df3a109de4018f37c7a88e54d6432285d3a1c43b741482bca8e736a54c06bb8030b6fbe3f0fa7a538e5ac23

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads