d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82

General

Target

d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
Size

2.7MB
MD5

bce80d299830dbd9b89f1ae6de0062b4
SHA1

4ea82785768fa695839379dd5f0bbe3c98ddfef8
SHA256

d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82
SHA512

f777e24347e3353687cde2c6122a887af6c3ec719b297b51b608c6a20bc4917971e32de21a01d32b6a91592f8b56cb941e1257a2ac8f379d184f2b309dcb4eab
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBW9w4Sx:+R0pI/IQlUoMPdmpSpk4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

devbodloc.exe

pid process

1844 devbodloc.exe
Loads dropped DLL 1 IoCs

Processes:

d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe

pid process

112 d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe

pid	process
1844	devbodloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxTK\\dobdevloc.exe"	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeGK\\devbodloc.exe"	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exedevbodloc.exe

pid	process
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
1844	devbodloc.exe
112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe

description	pid	process	target process
PID 112 wrote to memory of 1844	112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe	devbodloc.exe
PID 112 wrote to memory of 1844	112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe	devbodloc.exe
PID 112 wrote to memory of 1844	112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe	devbodloc.exe
PID 112 wrote to memory of 1844	112	d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe	devbodloc.exe

C:\Users\Admin\AppData\Local\Temp\d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe
"C:\Users\Admin\AppData\Local\Temp\d56e02395db6fb4f28668febb105a07fb3a95bdd42c9ba7e20a4c472de428b82.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:112

C:\AdobeGK\devbodloc.exe
C:\AdobeGK\devbodloc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1844

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxTK\dobdevloc.exe
Filesize
2.7MB

MD5
2d78ea4eda98d722cae2ae7176971b65

SHA1
c821e135f69e466d77fc68e19039f26020775a98

SHA256
482a1a8ca82cd012c6b84660df9944d9649f73d5978c263d3432b96799495c7b

SHA512
e2cc6a797bd518d1a3abc25a0851106b5414c9a9ff7dc5d32d2b76e2b3ad60c014819db73c1aef8e8b75915fc17c79867630407645a71b21b00e79fb94a65287

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini
Filesize
205B

MD5
8079c60c8d9e413e728e807528c414a2

SHA1
f25622c71c9e24618643c9443d7bac064da687ec

SHA256
6a45b60c5f844de8dfe06d16298dbda2b92d8d9f45a189083e31cb301c57ead5

SHA512
fa5c9a98ec865ab7b300fe072edde1375a21239aff9721dfd275a9cd354ee7e8eb7251e492ba4d723011704c298da940b2c573560e2cabacf61ccd9fed8324cc

Download Submit
\AdobeGK\devbodloc.exe
Filesize
2.7MB

MD5
42807a45b78eac7c07d5435ca682ce9a

SHA1
ab1c4d8fe5792b5ee8ec5593a66a817e6a0e14c5

SHA256
a96cd28de8779eb275faa06aa06473404e95cbabb18f8b13e8a170b2d3d24fb1

SHA512
674077cbedc9ac7b80b2dae4a057f21bdf5a4da5398307bfd1ceb057926fccab82939821a8173cd0c90db5ae7ca52e997e892a25373ca82ca58bbe43743b39bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads