Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe
- Size 2.7MB
- Sample240602-2dmtbshc61
- SHA256 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87
- MD5 b650d4adc3bc5b156c8c50b939d4216e
- SHA1 329c95add6dc22402477a5b6963400d7a4acf98f
- SHA512 c7f77bf1c49eb56f6dc73b78d001b640491ab7238ebd74f907feca537f07859da7ed19c1fda42c3b7c9bf432ef453a1916898d6e8e279ba004b2db895563e28d
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBf9w4Sx:+R0pI/IQlUoMPdmpSpj4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 772 xdobsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocNP\\xdobsys.exe" 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBX1\\bodxsys.exe" 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 772 xdobsys.exe 772 xdobsys.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3360 wrote to memory of 772 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 89 PID 3360 wrote to memory of 772 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 89 PID 3360 wrote to memory of 772 3360 5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe"C:\Users\Admin\AppData\Local\Temp\5bffd68a77a95a580e9f17e41a6982c8288a64bc310315028a9511e99e726e87.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\IntelprocNP\xdobsys.exeC:\IntelprocNP\xdobsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocNP\xdobsys.exe
- Size 2.7MB
- SHA256 58bd6c2b80a42b6303dd9748f0f76481caf1a27cc5cdbfc1586766219d5fd34d
- MD5 ea6307fe4b9f6ae357191f71e7c73d80
- SHA1 189bd03d54c4b3d5c9a8d9854438c18a8ae0578e
- SHA512 91bff3a80ab91565986a83a5aca62a33c0ebfc46518694ce74c1bd3737526f539851bbbd9e0f34773a7e70381cad0a76232acfd0285c54d2f3379b0cc078bd8b
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpE4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBX1\bodxsys.exe
- Size 25KB
- SHA256 49c3175f676bfb91b578d248b72386d1238bd37e982918c02dfe6e10dc376777
- MD5 c7029369c014b701af5519cf91eec60b
- SHA1 f90f11ecbb69f11bdee61486d016cb5434d31f48
- SHA512 7c3b07bea20568ba916d8e2d68b9bd4d5ee97e72f00cda271e84ef59944b2562e31249c84511027af6d1f3d6e725a86c6524a3264e9bc72a0a895c3cbc1b0f2e
- SSDEEP 384:PLT5lDnYcy/ES70S7Tq6xRVtLiD1APk/7zJRKahcO8oRZz:PLT5ZRHUj7TRxRVED1bHKFO33
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 cb7b6508671015b7b34c2deab301a880076bc2bc83e196811676d93ed095af1e
- MD5 ed84a413a220f556f912f16339727dc1
- SHA1 912146e1e654af540b1e49d89c79b95bbaaa4850
- SHA512 b1dbca928b1d149035c979b614134159e6c4d01354b0ef0eaf441d78d47d7464f3941cda58cbff0d6e0bca2b9470a67685525d493e9b19ff4a151ca79f0cbdb0
- MD5 SHA1 SHA512