Overview

overview

7

Static

static

3

6bcb6bf192...28.exe

windows7-x64

7

6bcb6bf192...28.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 23:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6bcb6bf192457e642d23d855848a1569838e93ae2c24c63e34cfd62f20b87028.exe

  • Size

    4.1MB

  • MD5

    12fdfaa437734d7f6cf88bea3f814cbd

  • SHA1

    fb9c5e3ce07da5ba9eb3cd6394cd49b3e20407b7

  • SHA256

    6bcb6bf192457e642d23d855848a1569838e93ae2c24c63e34cfd62f20b87028

  • SHA512

    af0eeb8a84cb6e5eb79256a902c507a89002a67e764ca435f24375e5f65ab45cc2bad3f2acf684561f17d3bb4b1c82d87770dd2b62617de44c857eb5ba7134f9

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpb4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmo5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bcb6bf192457e642d23d855848a1569838e93ae2c24c63e34cfd62f20b87028.exe
    "C:\Users\Admin\AppData\Local\Temp\6bcb6bf192457e642d23d855848a1569838e93ae2c24c63e34cfd62f20b87028.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\UserDot50\devdobsys.exe
      C:\UserDot50\devdobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\UserDot50\devdobsys.exe
    Filesize

    4.1MB

    MD5

    4c27ff2f3d41594fe31df687753039d5

    SHA1

    22ed25fff1db359c1ccc8d119b5ed806ab3e9b52

    SHA256

    353fef40121268acd6634b1d166de3987b83edcc54f6451394a6c9160828f80d

    SHA512

    e095ed19df93bee60ab7cbbbc7bec7d020bc3f53ba80163849ad35de2bd000861180f17e774baedc165f16962472e195c8bc1dd60595b2c5ea90f48722b67e79

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    203B

    MD5

    5b42de15a69018d9c7f0688e79ada586

    SHA1

    4dbe04bfd3b08aacc4f3be106c1827c359aa7de4

    SHA256

    27aaf07f0c1ae90be79309ffb75be1f2081d1ad7ccc4ccc9032a123e0f0f2e9c

    SHA512

    b8172b3a26c0d004a8088465c6a0308865590b6eaa7f7bdea2ce7725ffed1d7876b6b93b1ca1f28835bfaa2f6ddf6405c2f059378e2473aba7e83e0123601364

    Download Submit

  • C:\VidIX\bodaec.exe
    Filesize

    4.1MB

    MD5

    e0d2c031493d491bc6b6d5eb94ffe1eb

    SHA1

    fa60c13ecffca63aff2389721646dd7af934ef3d

    SHA256

    f428931e9d87cd5c9cdcf417539544777de17ad3b48d3a00f4aa9fd2ec5f64b5

    SHA512

    5e6b98e591beb5604cb235430e5b466765ed6509a644b657e57ec21a90266aec9c906ccc161216aee4853a5d29ad91f4c30d21205de4000b44e841e31c7fdff1

    Download Submit