c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
Size

2.7MB
MD5

a7d4edb9a2ac8ba958edc0a9ad3b547d
SHA1

54c614eb1e55f702ed76356807ebb176daeec325
SHA256

c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67
SHA512

f7254734b15c528f8a45e6de8107c7e5dcb285aca1f2757212951a0f5272805c0d83f1f774af908598384f096540fa4e8b6435c6192b41439580c2e2a998ec78
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4Sx:+R0pI/IQlUoMPdmpSpB4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2740	xdobec.exe

Loads dropped DLL 1 IoCs

pid	Process
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotPU\\xdobec.exe"	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZSB\\dobxec.exe"	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
2740	xdobec.exe
2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2740	2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe	28
PID 2264 wrote to memory of 2740	2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe	28
PID 2264 wrote to memory of 2740	2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe	28
PID 2264 wrote to memory of 2740	2264	c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe	28

C:\Users\Admin\AppData\Local\Temp\c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe
"C:\Users\Admin\AppData\Local\Temp\c4f2fc0376ff24eb277058e9e8a90c430d390c4df069e2200e40d33bcb5c9d67.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264
- C:\UserDotPU\xdobec.exe
  C:\UserDotPU\xdobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZSB\dobxec.exe

Filesize
2.7MB

MD5
a5b08120d31a59fcad4f56e7da10d4e3

SHA1
4434b419c9c84fe14f094cd80419676d1c83e71c

SHA256
8d76afe7f83456df3d17418d3dc42e8648eeb4e00a51fcaa60d963faf02e8b7a

SHA512
d3e8a5b9919587037f64a224d97e81a05b0a71ffddde4ef1a2985daec8252c06e7f7023a2eb63f497b88e0230363178a592b8dfc7ffacc4150cb17e74c34f1b1

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
193B

MD5
765b8d2afe5567911f766bbfa9a9f4e7

SHA1
0707b72770985397a03e17be0290092256b1e995

SHA256
2d5a7556fab0e8e13146e3f8f65425191d1903a285cf91d233e82634d5cd4e77

SHA512
6d7aed761d22422da76045d406d1daee10a829827c1c1a72688ab40f827a3a1294e71d293ce66ce85c9b652f0e1bef3852b14d439e62dec99c7a7895978a849e

Download Submit
\UserDotPU\xdobec.exe

Filesize
2.7MB

MD5
73a1f11b5bdddba526523bacac50abe7

SHA1
4d0990219655df5f989e20aa5300e2a256154edc

SHA256
b8c8281451fc388700da3f7a7dd78d5bd664572384d4085f2c3cd6c5df052ece

SHA512
a008c35f667d0a9a4f5dfd13738fe55d10a039222803bf16163e9472d7c7ba99fe6177dd12da312f2b0d1a566e7958c89c6cb97561c1afc1ced7307fe17bab46

Download Submit