Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 02:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe
- Size 2.7MB
- Sample240525-c2c7csbg38
- SHA256 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7
- MD5 8b695b08c07ca7a3f6d83c14346e8b77
- SHA1 9860851f0b1dae0159b9b83c91bd781a217dbb40
- SHA512 fe1fffa541b59741773b4221c01deb81f509fcd862d1c2b10e491a614f4ea36cf5a8216d4623f407406ed0b327db91f9157902385f635c0145907c244dd2b0d2
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBX9w4Sx:+R0pI/IQlUoMPdmpSpD4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4048 devdobec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesFL\\devdobec.exe" b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBP9\\dobxec.exe" b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 4048 devdobec.exe 4048 devdobec.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3288 wrote to memory of 4048 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 86 PID 3288 wrote to memory of 4048 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 86 PID 3288 wrote to memory of 4048 3288 b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe"C:\Users\Admin\AppData\Local\Temp\b8f8e52f587705440f4efb20bbc4b2646b07e48e42a1cc174886fe143d10b6b7.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\FilesFL\devdobec.exeC:\FilesFL\devdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesFL\devdobec.exe
- Size 2.7MB
- SHA256 c9d8b60e0c4d345226f0fce96a2f13dd5c0f9c3351c5121ca9e392066fc5af6a
- MD5 5b7a7e7ac39c7d6072ab3ab3a2cc8577
- SHA1 6d1934c1c9ca9ddfa24adac2517f6bbdf230a2d0
- SHA512 01b1dd251ff87293fc845a9ae7cf66086673499e70c0a851fa64b710921682ee1a031b0e70c69ee0ce66e80da55689aaecc620fe149b4a5f4a8d6319e30432e7
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBK9w4Sx:+R0pI/IQlUoMPdmpSpg4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBP9\dobxec.exe
- Size 549KB
- SHA256 6a719eaf76d30fb2e33f802d08b268357ca15f3d438e176b4b069cde7bd57798
- MD5 9b9980a4caa9f2e3ca0c945b4826524e
- SHA1 e6e8d3e1b6b843d9ace2468fa2e96c6a205e569f
- SHA512 8fe68d722e5d6852628c77aaa551dadb66f38f9311d758132d7ef48c2e114b0bc023e4021d7cce7184b6429266873ac827ba83ddde7fdc0300ec3689efcb3b10
- SSDEEP 12288:n+e3H0j/4cFSakgnCf8xCD/8xmlBLaXPATazr4ekzDlYFWtN7E/h:+RjQgSjgCf8xC78xmlVaXPATazr4eoDY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 0c23efd9aa403c5a8e8618461c06017fbd2d43f802233366add57db2f114c6ed
- MD5 a555447f2c3f4952875999a6df789b35
- SHA1 cc2f789fa32c727d6961892b77261af01df9017b
- SHA512 ed383154a94f52f66fe32e1365a92476de5dd8ea51bb4ca77d01a842d1476f351ec5c8210e278f46ccfe6fb3964fe9f4999db4049f74e249c9d5aee2ae66b312
- MD5 SHA1 SHA512