Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 01:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe
- Size 2.7MB
- Sample240603-bkn2vsdh2y
- SHA256 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948
- MD5 ad2bd504d9500d136e0f15203a36c611
- SHA1 e14e548d231e574a6f5584b0a69f56edab999532
- SHA512 40f3c47ef13778c384df9abe67cdaab4a0983de2594dae6b79b334352a6f9354bbb46e884837646ad8ef844efc62032345d533360c20dca736eb5e15457dc523
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBC9w4Sx:+R0pI/IQlUoMPdmpSpk4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5208 adobsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocAP\\adobsys.exe" 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidYJ\\bodaec.exe" 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe - NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\CC4G4\%B4@<A:\ <6EBFB9G\*<A7BJF\&G4EG� 8AH\#EB:E4@F\&G4EGHC\ecaopti.exe 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe File created C:\Users\Admin\CC4G4\%B4@<A:\ <6EBFB9G\*<A7BJF\&G4EG� 8AH\#EB:E4@F\&G4EGHC\ecaopti.exe adobsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 5208 adobsys.exe 5208 adobsys.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3500 wrote to memory of 5208 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 88 PID 3500 wrote to memory of 5208 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 88 PID 3500 wrote to memory of 5208 3500 94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe"C:\Users\Admin\AppData\Local\Temp\94dcbbbe32988536498c94b3f536be8e260f9da3c1a422d06a7c98cdb0a27948.exe"1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\IntelprocAP\adobsys.exeC:\IntelprocAP\adobsys.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocAP\adobsys.exe
- Size 2.7MB
- SHA256 989d95ff0c1329e4eb84cdeba3556aa09590ff4408e8acd61d3f132d7f7b7b92
- MD5 89b9d246decaf65f09ffa7b2f5c3e2f0
- SHA1 2e9e2724334aefadedece8be9d14f25ad620112a
- SHA512 1e72ad526139eb239cc22e1847b2f5753433e49ce2dabcd10a86093a889c1960ef9395cafd7f2a6b7679185b403c6bf1abc4b50d461e42ec2ccb91ff9b1e24c4
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBz9w4Sx:+R0pI/IQlUoMPdmpSpr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 e2bd21018efb9a38a5e057e6f0c10a5f1e447f59bd374783884e346089c2f1b0
- MD5 94b3149497160fabe5be61e78eec0c4c
- SHA1 de1c215e9aa32ef4b9e4fca5ea9259edb21e9b5e
- SHA512 6819b3ddcff3f0949945b51e79df462d17f034603874563b2ed74e5f72a2312b092211d2bbb8736bb5d3c5fa28f1eedf28f19a6fb858b79e330d6f75f4fb4953
- MD5 SHA1 SHA512
- Path C:\VidYJ\bodaec.exe
- Size 5KB
- SHA256 293da501871baaf7bbb94f933d180eeda1ab4e177269dbf9009f7b0affb5cf94
- MD5 3c1447a32f4850436e6a2de47925bc14
- SHA1 330b5e43ee4e330d7602e1d148b82ddb50b12a19
- SHA512 f9e04d4e15b7137a5a1aa19f435a3eac87106d592f2577822a23d928dcace63d581f7c5af90d73b77ffa94ef555dd29e8a1ec2de6d498148e5815c61b71b3b19
- SSDEEP 24:etGSBiMM308LLHHnl11brJ5LdNrNbXr7Ljd1JFzN3lbN397NlTN3lThdbTpl71Se:6rM308LLl15F5XlXzjbXzbHHTnTH3nI
- MD5 SHA1 SHA512 SSDEEP