Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 01:41

General

  • Target

    Obsidian.exe

  • Size

    168.7MB

  • MD5

    9e6830b2fefb386a0a4c65a5277ffab7

  • SHA1

    bf87fb7d3d99397bf03ae84e4866098555b94d24

  • SHA256

    7742ba6e1edf4631ad63856c4ae51f39d7f1e5eb50420ea8e12b6d5c14b5a412

  • SHA512

    b6d00caa455dad635b8f34cc853572e755eb783c71f355fc796715c55dea92f716cc7b52577599907c9f020fd4c7885dc5dc0625290604fbc14628cc5bd7a6e7

  • SSDEEP

    1572864:TOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF9i:XgmeNxNNQxqVO

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Obsidian.exe
    "C:\Users\Admin\AppData\Local\Temp\Obsidian.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Users\Admin\AppData\Local\Temp\Obsidian.exe
      "C:\Users\Admin\AppData\Local\Temp\Obsidian.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1752,i,13709281562533688934,7357689577998162402,262144 --enable-features=SharedArrayBuffer,kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:3836
      • C:\Users\Admin\AppData\Local\Temp\Obsidian.exe
        "C:\Users\Admin\AppData\Local\Temp\Obsidian.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --streaming-schemes=app --code-cache-schemes=app --mojo-platform-channel-handle=1816 --field-trial-handle=1752,i,13709281562533688934,7357689577998162402,262144 --enable-features=SharedArrayBuffer,kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        2⤵
          PID:1516
        • C:\Users\Admin\AppData\Local\Temp\Obsidian.exe
          "C:\Users\Admin\AppData\Local\Temp\Obsidian.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --streaming-schemes=app --code-cache-schemes=app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2156 --field-trial-handle=1752,i,13709281562533688934,7357689577998162402,262144 --enable-features=SharedArrayBuffer,kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks computer location settings
          PID:1872
        • C:\Users\Admin\AppData\Local\Temp\Obsidian.exe
          "C:\Users\Admin\AppData\Local\Temp\Obsidian.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\obsidian" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1180 --field-trial-handle=1752,i,13709281562533688934,7357689577998162402,262144 --enable-features=SharedArrayBuffer,kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          PID:1704

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      • C:\Users\Admin\AppData\Roaming\obsidian\Code Cache\js\index-dir\the-real-index

        Filesize

        48B

        MD5

        589117da020505f6f562908fabe591d2

        SHA1

        a0cce386eb73ea88a961bc5541abd79adeb8e688

        SHA256

        d0c1becea8d715e573a97da6d729102e0d1dc746b57ea7d0fb2636d048fc3056

        SHA512

        2c8eaa7e3f6a5cbd80b592faa560bcf41562f00df48d8b96c770ca7f29fa563bf43e0fb48b6924fcd906c7f179ae17dbcdf6a68c7c3576f3b8bb85d3f1d27609

      • C:\Users\Admin\AppData\Roaming\obsidian\Code Cache\js\index-dir\the-real-index

        Filesize

        144B

        MD5

        638714fe95bc4bdd5446af9aaa8d3477

        SHA1

        9c93f0f64fa6263bbb3e0c3a4b2d593c4d8f76d6

        SHA256

        27563c0bdcc83f7ea047c4531f65442fb857c7989b292a1b1190ed065b4aaa64

        SHA512

        0d7e072eac008625599d00dc294ee3e57b108b84428c636f9c047e2000589550337c445c44e9870a0b17e8ff23db8a2c49a50387c2d629297be93ed261018299

      • memory/1704-79-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-78-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-77-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-89-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-88-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-87-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-86-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-85-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-84-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB

      • memory/1704-83-0x0000023CD6870000-0x0000023CD6871000-memory.dmp

        Filesize

        4KB