10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
Size

4.1MB
MD5

4650eefb57da816bedd351a1fd6040a2
SHA1

914249e795ef96b546d0499382466413e85bcd53
SHA256

10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0
SHA512

a0bd0b6b537b32bdf0fc2c94a15169e2998ff0bc1b411b4f8f83c929c893df22a1abca8240dff1f3556beec5ed0ea119d581e9daae2ab51d0f3aab56895c9bfb
SSDEEP

98304:+R0pI/IQlUoMPdmpSpu4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmx5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
972	abodsys.exe

Loads dropped DLL 1 IoCs

pid	Process
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesRA\\abodsys.exe"	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintXE\\optiasys.exe"	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
972	abodsys.exe
3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 972	3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe	28
PID 3028 wrote to memory of 972	3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe	28
PID 3028 wrote to memory of 972	3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe	28
PID 3028 wrote to memory of 972	3028	10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe	28

C:\Users\Admin\AppData\Local\Temp\10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe
"C:\Users\Admin\AppData\Local\Temp\10972bce149ef9540057477d5bd0a34ede1558178c8536c48fdfd94304adb5a0.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028
- C:\FilesRA\abodsys.exe
  C:\FilesRA\abodsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintXE\optiasys.exe

Filesize
4.1MB

MD5
16510cf96310c7c03b4ad481464777b8

SHA1
fc5332af0ab83a014f48d259d5599441cd4323d3

SHA256
c3e7797a4165f04d9442fc397599f52d2305cf09c520311343a3677fc7686294

SHA512
f03194865997970e4071d77b46bb3684f9797f018391b7daf78e0999b71dce345462bd5d65970afb501b8cfd2f97c8c3a81688610868c51f8afbc0f6a9d09eb3

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
200B

MD5
5cbda554688ab12486c6c28831ae97c5

SHA1
406d59956c28fee47683103936304a53c3f72712

SHA256
3d2d5f70f235064afa5ba173043cbc74ce0754fa4f008df4617b0355f7d2c321

SHA512
676ece9e5a045f38108cce74df101f6babb5b07df81742da14172dee10479dc9dfab0eeaf69708ebf7926ad3852338e6fbc190034e4cb0463ca1919c60f39e15

Download Submit
\FilesRA\abodsys.exe

Filesize
4.1MB

MD5
90cfda14baae29082f810cc82c4887e4

SHA1
ffaba71147ff56564c4e8fc8bbd09a42b9c315e0

SHA256
04c140bb3ef97f659032e8fdc468cfd21883ae526b7c283821fe89811c384084

SHA512
e6c529c18700352fe0348d4049a1b580234cf08e2eaae458a5881f2115b7645f8c819067be9de793067afa75646c1eb7a4082fab6fe15ca92d3235c67e5ff142

Download Submit