Analysis
- max time kernel
149s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe
- Size 2.7MB
- Sample240602-19544sab75
- SHA256 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273
- MD5 1b9c6e67dd83ed1fa3b48e41d02c2f32
- SHA1 38ac5fd3ccab6e35959ac9f03f4c35e7f02fe241
- SHA512 50b1c62a004a014c84d16f3cd0b7fe4976945f13f72347fb109a74e10fc88cb8063ad7fa223430bab87c2061bbeaf3e67d2a24ab7059fb4c9eada60b9c63db89
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4Sx:+R0pI/IQlUoMPdmpSpX4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1112 devbodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocYR\\devbodsys.exe" 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB2E\\bodaloc.exe" 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 1112 devbodsys.exe 1112 devbodsys.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4564 wrote to memory of 1112 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 88 PID 4564 wrote to memory of 1112 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 88 PID 4564 wrote to memory of 1112 4564 59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe"C:\Users\Admin\AppData\Local\Temp\59342bab12b7f6029891c6e8eceb65ffd07aea5335cfc1316f274a132a1bd273.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\IntelprocYR\devbodsys.exeC:\IntelprocYR\devbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocYR\devbodsys.exe
- Size 2.7MB
- SHA256 83f84739bd9813f84885a14d2c47ac35154f671f58c0dc786abd616ce1f6f22d
- MD5 554f19ab4ff7587deb9c89b94da7ac61
- SHA1 d9f394c357209883cef142da14b9e32fd4a64d9d
- SHA512 a532bfd375b1397c231036af5e508e013a12aa79e0c8dc10f9e2e9592dc5fb1d72d6f42cfb411d5073ff002920e4718fd2e7f83e5506c5e1d4dccc51fe4adf24
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB09w4Sx:+R0pI/IQlUoMPdmpSpC4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB2E\bodaloc.exe
- Size 12KB
- SHA256 450f3553ef592c5332d0f992ffb02a92cd4c091b4ed4b5c61a6bcfb613b9a505
- MD5 a24d07f66e772e6d4aabddbc12edaf22
- SHA1 b08151be2c76ec954a9705d8c983edfa28d20651
- SHA512 8a83008c9d13d536c9560b47cb28e3125001593f54a475bca7782c808b0966616f8dcae976c803e1197253a032ae01e962c53a973efa2e7e8054a26c5d66f3ce
- SSDEEP 192:lNLT5nl3TzTH4HKnxRuq0dn8E/ES76xS7BzFqg+:PLT5lDnYcy/ES70S7Tql
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB2E\bodaloc.exe
- Size 2.7MB
- SHA256 f01c432f59b8477a9dd6e7096712bccdcfcf44a723b0463ef5852438e7bfc728
- MD5 bf213baaa13ff95047ccc7dc2e34d912
- SHA1 33afca8ac8316ca72a7d113a84d5a6d7f3e84927
- SHA512 2da0d2035506094269a8cb74a708f08fb37e0184a7213aaafaa5f129c37e9a16f551d1fd72f5cde1cc38eb1da8bac970c0380cacc7c042e5d9455135f8eb4a3a
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBJ9w4Sx:+R0pI/IQlUoMPdmpSpp4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 207B
- SHA256 5d5eb49d2fec6b49a31072596db73bb53da6b9b6fb930ff669817652a44c3c4b
- MD5 27a66b0391553fa43f4f1a5da40aa307
- SHA1 74a5157da5d46882276346bf6ab258de1f0b5e93
- SHA512 45231411690022caea6606f8e694c5b5d934e1faa5969ece5eae68dd049ecf73ce6b56d541032ada220c973fa8bd183c378cf948e0206bbf37f4c65f9032de6c
- MD5 SHA1 SHA512