8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
Size

2.7MB
MD5

0ae37724f1218a669ee5d441511d1731
SHA1

7734e9beaaa5e8ba3fd87cb767968bb3a7a5187a
SHA256

8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486
SHA512

351c149e0c39e66f6cc3940ba6d71e2483e0376d2616c9fcd73dd214055983f81c0715ccd1aa698a84aa11de35177242a8ee7d14949893bff2b3e18881391202
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBC9w4Sx:+R0pI/IQlUoMPdmpSpU4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3396	devdobloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocVC\\devdobloc.exe"	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBTG\\boddevsys.exe"	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3396	devdobloc.exe
3396	devdobloc.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3396	3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe	85
PID 3792 wrote to memory of 3396	3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe	85
PID 3792 wrote to memory of 3396	3792	8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe	85

C:\Users\Admin\AppData\Local\Temp\8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe
"C:\Users\Admin\AppData\Local\Temp\8e3059d00f0438d84d2702a42a0e25aaacb187546bbd8cd01ba647c66d93e486.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3792
- C:\IntelprocVC\devdobloc.exe
  C:\IntelprocVC\devdobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IntelprocVC\devdobloc.exe

Filesize
2.7MB

MD5
191bbb40ce3d43f12c96f4abcbef4ec3

SHA1
10ba92710ac9988c8315d2ee3675b5217e5776c0

SHA256
8e53aef1c41411d409294b2454a83e6fe1ed11c1a94412b97ee0b98c9dca8e62

SHA512
110e636d437ec46030b8f1c71ccf009d6865e5ce295bdff42701746d52c238d1c20d5c06f5243a01d977ae50ae4f1b9ca5cf5308ca979a3ae86a93856074e564

Download Submit
C:\KaVBTG\boddevsys.exe

Filesize
2.7MB

MD5
fa4a2ed62b8f2f85cda5ef72fd219f87

SHA1
de98bd6581743a0619b3b87ff1aa07bc2e25d609

SHA256
02744baebc51c435677fcae4e2027c0ffcdafdb56cc24b6275e7370a47d0faf3

SHA512
d936e72436597d9d3021da4fd6b8005f951edf070f6b62cd76e01a1fac87e75a988c6dbf346ca82ef98571011e6e483069767eef1f187fa5562237cdd27061d0

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
208B

MD5
e704ec394a7f799fd60172e5bd3a76c8

SHA1
a6e095252b65e61b404078e4ef370f74ceb29cec

SHA256
339da01e243f46ad2472666febf87314d60b8fa14ef4b316b7ec447e5219b7ed

SHA512
166c22d8cdd82dcac696fd8c8666ab7c076d2e5020b29238bc49414f586cb131a00fba45fdc7624092fb738a417ec0292e756528c4d5628fc1d4639fbacdd257

Download Submit