Analysis
- max time kernel
149s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 07:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe
- Size 2.7MB
- Sample240609-janmcafe71
- SHA256 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56
- MD5 54f5d03e2319805d1aac18a60d1c4b6b
- SHA1 aee9c59a20757079fb07f27e175ef7b9b73cb140
- SHA512 30baee1258518b202f2ff1f030addb8c9c38fa5bbe640f515defbcf06f9c3877b12074b64271d05ab689f2dd07c2ea7dc2982e701790c0134781dcf9041536df
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBR9w4Sx:+R0pI/IQlUoMPdmpSpd4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4664 xdobloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesHJ\\xdobloc.exe" b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidM0\\optidevec.exe" b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 4664 xdobloc.exe 4664 xdobloc.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2572 wrote to memory of 4664 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 87 PID 2572 wrote to memory of 4664 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 87 PID 2572 wrote to memory of 4664 2572 b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe"C:\Users\Admin\AppData\Local\Temp\b7074c50988b381145bc2a19b5b0753ff7bfcdc6eacd91cb36b2de1e495b6c56.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\FilesHJ\xdobloc.exeC:\FilesHJ\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesHJ\xdobloc.exe
- Size 2.7MB
- SHA256 9721481abcff2954cf136e5b16d14c086c5c7deec80e18b07af46acfc537eba4
- MD5 58442aa7c76b101aed88222ff0a018b6
- SHA1 bdece6324e794bd42cebb7f9a25152c45ca96853
- SHA512 dcc9168845cbaec86e67d6795d812aa23a1caf0859af80d31782656cccb68e42d00232e9bd9071861c9ad194d75ac13a0cd3a52c3f39c0d6c02f5b5d1b33185a
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBl9w4Sx:+R0pI/IQlUoMPdmpSp14
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 52c22259f3378f12960d41b6fdc49b97e415dfa586c88f426b9d010e040621eb
- MD5 2ae43dda6439adcb60c802da9d45b12f
- SHA1 49a699a36249b6aec8086dd0abaa733f3fdfd388
- SHA512 3511e1062513727a8f19f2465d3e78c917a2a5bb5b099d38b87cd7d7779d82b33bd0007b867e61fa101ed4657b4f88e5843d2c599cf8928a6310645f1e217dec
- MD5 SHA1 SHA512
- Path C:\VidM0\optidevec.exe
- Size 32KB
- SHA256 cd18ab11ab465bcc490e3dacc862a43aa60ded6ec3e898eeae8ed188e9e61041
- MD5 ae489513a0f3d7c7f8c9b70adff0ab85
- SHA1 03cdf40dbaab6dc69db20669eeb828beae339ab1
- SHA512 c2e8764946765041a009a002dba4d417a0d09a368778eaa019eacaf2c149b6ee59a43fd1313141cee39e0e21ceed28b1fe96bb194604270c9884e340fb161ade
- SSDEEP 768:PLT5ZRHUj7TRxRVED1bHKFO3Hq/KDsDZe+exD:nD8RxTo1TKFO3H0KEZHe
- MD5 SHA1 SHA512 SSDEEP