Overview

overview

7

Static

static

3

f49f1b838e...78.exe

windows7-x64

7

f49f1b838e...78.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 08:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f49f1b838e4e6d8c9a885350148d5be4370a586a4b1a3618679edb7afdda7e78.exe

  • Size

    4.1MB

  • MD5

    7d6039e13f707c1588c82057f2d52dc8

  • SHA1

    26f229c1ba526db9e480871ad64312b20298618c

  • SHA256

    f49f1b838e4e6d8c9a885350148d5be4370a586a4b1a3618679edb7afdda7e78

  • SHA512

    a7cea438b05351ce525a743111ed2f87ca135d56b64c6ab88b1c89886be4f1a77620e9711faedabab362c22aecd73d2612fcab496b776406f2f30f2ac4d8c20f

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpy4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmd5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f49f1b838e4e6d8c9a885350148d5be4370a586a4b1a3618679edb7afdda7e78.exe
    "C:\Users\Admin\AppData\Local\Temp\f49f1b838e4e6d8c9a885350148d5be4370a586a4b1a3618679edb7afdda7e78.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\UserDotX4\devbodec.exe
      C:\UserDotX4\devbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\GalaxG4\boddevsys.exe
    Filesize

    4.1MB

    MD5

    997d2b69484ff215689287d5e432b52a

    SHA1

    536ce6469282ef6c994b42e7fac888e4928d9ab6

    SHA256

    7c5103c44f9840167c810a869b9f48b0bd7cb1e4cee9fe982c4f94ffcaadd314

    SHA512

    46eea15b7abf5e067860f9a5a9dadb9e474474e291fe94bd9516b06ebcbe7e985dd612243a6913fa0b46678576451283f6465cde0510deca09503b564ce6c0e2

    Download Submit

  • C:\UserDotX4\devbodec.exe
    Filesize

    4.1MB

    MD5

    1f59edf29bf75c143fc75039c8d31a90

    SHA1

    a16aaaa3d5db849cfd3a04fc6bb0a5e6755cb5d2

    SHA256

    f7c2a6c030030b06a7893636a57fc5fa1385182d8b889d46eb518e4ee3cd6065

    SHA512

    a96161561db79dd1a961b2b211627f4888a79222f6c56efab8a22a7276e6e23156fd26e8d0085c2a921f4fbb91315a0bd0b0ebd4a81ce3c5a13a71978b291a78

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    206B

    MD5

    661ac74b36e4aacae37a3b2e97ef0794

    SHA1

    ebc86edb8d45bcbda72bf07294ff3186ff177ddc

    SHA256

    b0f4d1d48312d526b682c1b2c8671a690b5d24b215c57880a11054aa88d6a5c9

    SHA512

    665d6f7ae26000d491a2601c5995cd1e94bf483a671bbf7a727b228b2bdf03f4acb5453958230d9a8cbb96f8671e8079b4494f0e469f1fdbdcd26ef6e616826e

    Download Submit