Overview

overview

7

Static

static

3

a6f044731f...df.exe

windows7-x64

7

a6f044731f...df.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 01:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a6f044731fb8024e765126cbe3a879b9309d4086e61c9697fff46a320ede0bdf.exe

  • Size

    4.1MB

  • MD5

    4dac0566d53005f3551ba5847cb96876

  • SHA1

    7a98dc3b9e56f5aa0006f09e2d649c05b91f9c28

  • SHA256

    a6f044731fb8024e765126cbe3a879b9309d4086e61c9697fff46a320ede0bdf

  • SHA512

    8d19c8e4bcbdce17bfb2268e5d12eb9486466d6859a9de23285df5583fb91a0a1d574953a314e7eb1c68fd186ade2dd7f6ff27175c2fbe10d0920eadc7e023bb

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpn4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmM5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6f044731fb8024e765126cbe3a879b9309d4086e61c9697fff46a320ede0bdf.exe
    "C:\Users\Admin\AppData\Local\Temp\a6f044731fb8024e765126cbe3a879b9309d4086e61c9697fff46a320ede0bdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\IntelprocBE\xbodec.exe
      C:\IntelprocBE\xbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\IntelprocBE\xbodec.exe
    Filesize

    4.1MB

    MD5

    b36607f3c761452cc547d4ebd513a329

    SHA1

    2eea9934ca8becffddde2f63fc14c2c5ad234109

    SHA256

    9f79240a939ea0cf010d3b1c92ddb41f84fb3216bb4dcccf571d6f58b0d56a0c

    SHA512

    ab55365fda2b57e9cb6006f78d0d2758533ac171605f68813b54c2ca705b6831f0fc6c43878bca79cb00a46c6f5cabe74bc1fd22b8407a8539655636893f9375

    Download Submit

  • C:\LabZJZ\dobaec.exe
    Filesize

    4KB

    MD5

    3fdbc5f36297576773d652dcd32f1a0b

    SHA1

    cd5e22d81857505bbb0f6626edd595142f63d3a6

    SHA256

    b391a38df9bf384819e4c819a6b4f5cf693aacfc8bdd4100d50b4cc7d39fc0db

    SHA512

    1fe1f12b828877cbed519d8c8f06994ee87c8c3e7403c75b66226f219940a4bdbe490e7ad5033b3219d2a7c95341c7533cd497dd70312fcfefa0bf77014e8718

    Download Submit

  • C:\LabZJZ\dobaec.exe
    Filesize

    4.1MB

    MD5

    571ff1a87c67269aca52f2eeabe2b0c0

    SHA1

    50e54e5f8e176ea3eef128541c019fceb51dcd55

    SHA256

    4af88576d270349b2509e877f05092fdaf4f6ad6da0ddeada1d98738112af212

    SHA512

    72c046286f7a54f51c5dd71f83abbbff97e98a45aee111024274e40c83e47b72b917b59eff76ab4e37ef69c4c11b0f50e85636bf769ec516b3c30ca050a03f1d

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    201B

    MD5

    de7903007638d57bd5b3116142157973

    SHA1

    cdda1a3f23e2a662a00eef3c869ea4d2e684501b

    SHA256

    d14fafc895315e755a158e2c8c1cca90f9a5cf4fc435d438bdfdd04c5828623d

    SHA512

    38893383262c80c3cba6891e2c213a4c7624b56aa8e7224a826641aa6cbdf2582a24f6aeb80242977a7980523374abcb0b2828d2bb0a3ef127ac2e45611f0b74

    Download Submit