76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
Size

4.1MB
MD5

f5f093d8abee3daf51d723cf46340aa9
SHA1

3b7e0a0ec232d31f6f32bf8e3b100eda6b7770f3
SHA256

76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a
SHA512

41d4a5ca07059d65a50907cca6527b3135bb26e18684143ab039b81d6aba5423efb9384ac5872f0a32140505f9e657c39486e1d6f0dad619a4c09eb6c382a31f
SSDEEP

98304:+R0pI/IQlUoMPdmpSpU4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmD5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4088	xdobloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvEZ\\xdobloc.exe"	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxFZ\\dobxsys.exe"	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
4088	xdobloc.exe
4088	xdobloc.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4088	216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe	86
PID 216 wrote to memory of 4088	216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe	86
PID 216 wrote to memory of 4088	216	76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe	86

C:\Users\Admin\AppData\Local\Temp\76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe
"C:\Users\Admin\AppData\Local\Temp\76fe425e228b2d552190f01af817f873990e57ee03e7ba51caf824809943e05a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:216
- C:\SysDrvEZ\xdobloc.exe
  C:\SysDrvEZ\xdobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxFZ\dobxsys.exe

Filesize
21KB

MD5
85ac8e8d98995fc09cc8e14b9d872d90

SHA1
adaa24efc93ffdc30c0f3eddaed74ed35e28744b

SHA256
4147383c7efa7821c6cfc8b7a765239587b96326516b35b8a29b5759d56b432d

SHA512
71b1aead94e4cf1bea92e76c1e652cc34c48ae4aa8a1a8f508276c2025ed5821c7ac8d66d8f165cd451ed36fcf9d03a044f936e5ad0acf3d006044ed8f1b1f3f

Download Submit
C:\SysDrvEZ\xdobloc.exe

Filesize
4.1MB

MD5
85a2416bb5098b8069628ffccbbe587f

SHA1
b62bee75123b9e5c00d4a5b3409cfb3544d60d49

SHA256
0af124e8d6e4aa8a359c4b6e49bb1553f50df11ffedb041b89be4e4c57220d5f

SHA512
53aa54110667a46bb98b6fa045691a72d1336efe3131e7532ccd267e721d92a7ed021c7d4c2ad9d995246b717e9e0b43b60a1899f58fcd9efd38c544ff9c8b53

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
201B

MD5
370987b4a09188122315ddcab9769c51

SHA1
e943cc683ab3ec0b0400e31c0c18265119f6c1d7

SHA256
5d592ea2e75d8c88e6668e532475be3bdfc516ba8abd892e15a1f88890f1723b

SHA512
c24850a1315c8449b6db48665c74abcdd1ea3e4e9bf2ab2b9c5509cb224901f9f053623a1c7390d85afce8f003c7abb4f3dde138edcc4174d80f8fcf4f55b432

Download Submit