f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27

Analysis

max time kernel
149s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
Size

2.7MB
MD5

1115f275e740119deecd7264e54972ac
SHA1

71424f85830f6f396fc4c350fdcd189ec09bef7a
SHA256

f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27
SHA512

eb558a5433af8b0d58e1b77d638f63598ce80bb4d9af5c377f2826de35b1e7cf0d609bfbc3c8d02b61a4f0b1b25b75d3e6896be69aa4bbbfb2801e2c3a7e129d
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBr9w4Sx:+R0pI/IQlUoMPdmpSp/4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
436	devoptiloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvGZ\\devoptiloc.exe"	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxH5\\bodasys.exe"	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
436	devoptiloc.exe
436	devoptiloc.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 436	2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe	92
PID 2720 wrote to memory of 436	2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe	92
PID 2720 wrote to memory of 436	2720	f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe	92

C:\Users\Admin\AppData\Local\Temp\f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe
"C:\Users\Admin\AppData\Local\Temp\f6d039bd7b33f7ef675757690d395e8816e3b4bf22a5c05e4f78f395ccb49d27.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720
- C:\SysDrvGZ\devoptiloc.exe
  C:\SysDrvGZ\devoptiloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxH5\bodasys.exe

Filesize
2.7MB

MD5
90ee82efa2c5a7479a4ff237fd73e3fc

SHA1
9b416adebdc4d27c47e716de99dc7f487333b75c

SHA256
35474e7a62f196d5fe6c748bd83ddc7a5f927a44a5aa40021ae036e29e7d598a

SHA512
6ab7c9dc2659b02c1cb1478cdc4f5ce485b1b9a996ab162fc47e176edcd111889a64678b99774f057077924b35957f95d5db9e6ecfe3bdb11d846cbaeb33558d

Download Submit
C:\SysDrvGZ\devoptiloc.exe

Filesize
2.7MB

MD5
9dcf80cb77ffb36af0b8a99e3fa47430

SHA1
8667d1db70467988ddad74fd2ca33991e7239a3c

SHA256
b210b18da632d685669c6037ca6be53b95446130d761cf53f2b47dfb0c5334bd

SHA512
e15a5368c85fecc9327340b6a73f3d44a309b5cf5e343e22baffa0947bd4925a781f269e022f71a168f55a3378f5e1a2687453489df125c6af21a6ebbe62c3af

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
205B

MD5
ccbde905d714aa9d9114c22ee138f5ef

SHA1
9a70cf12b2e3ea2ef296e96f9778eafc9633183a

SHA256
b39cf131cbdef422dd0245e816b94031372861566b57c3f826bf9968c8c2f8ed

SHA512
68bc8710a78e08a618cbdf4fb61d275967b0993b1312539e59a36016472bbba935f847d76d09a585aebaf8b07d5c52b3a9d02045a37f905b5945e384bf133960

Download Submit