Overview

overview

7

Static

static

3

856a8fffb9...a1.exe

windows7-x64

7

856a8fffb9...a1.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 00:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1.exe

  • Size

    4.1MB

  • MD5

    73bb1465ada430e1bd62a6b9780edf4a

  • SHA1

    d5e44f50e33ad0a769844319eadcb8f5a0ee990d

  • SHA256

    856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1

  • SHA512

    9d0af0a80952fcc8e39e7964d294810aeaa593a3c02051c878260408d1fcd2c8a067cda1f5a08750613377c668768136edbe792f350b1483c3890d6326ec4c95

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSp74ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmg5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1.exe
    "C:\Users\Admin\AppData\Local\Temp\856a8fffb9e3ae7e61920c00936279fe00537e90092c9fc46369722ef49f0da1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\FilesWF\xdobsys.exe
      C:\FilesWF\xdobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4460

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\FilesWF\xdobsys.exe
          Filesize

          4.1MB

          MD5

          2bc4e9d6d489fe479ffb2879bfb71eb5

          SHA1

          4c21909ddf0faaf0051e6b559024fe06f2b4a0fb

          SHA256

          a6d2b5a03ecee288422db8fcae893c7bafaa1d8957d25d5c384a801dfff0b843

          SHA512

          883d215338463be45b226573947548d557283503fad1ce588ce055f79d1b88a40f6a9171556a8f8bfb94d3293a771ee650cf1156ecf04c4af0febc9a41e67253

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          200B

          MD5

          39b513c9d231f7f1c06cf07166a3ead8

          SHA1

          a8b166014b2e275a9027610fb65af78796c21656

          SHA256

          7f7782b2d73403a07b6705205d2f48455fe44ba6a04253d79bfc0ea8129822c4

          SHA512

          bea208c0366797216032f441094b19728bd5f3acbcaf221ccfbcad3461471d3f4b30366b694b6c6a86c72d90135238d9785164c591dfe2160b27f436b04c60f7

          Download Submit

        • C:\Vid76\bodxec.exe
          Filesize

          537KB

          MD5

          108e34e5477d8d2f0b369fd17d204759

          SHA1

          aaace701a7e396712c6d6e021b7cab100f185ef5

          SHA256

          bb07d8ba1bb73cc3ff1a104fe2b7b80874192f831ebe6ef7cb7db9a6500078b6

          SHA512

          fd5fc79fbb335514592359b694483c2661bddda07a8ee343b6b139caedfb2727bf114ff38fb16f85b915b1670302869d561d273ca7cd38dafd56bc8cf165d22a

          Download Submit

        • C:\Vid76\bodxec.exe
          Filesize

          4.1MB

          MD5

          8655db5c8b38bc8be9e5b305bd976a63

          SHA1

          70ac3337d4bda02c06fbfa31a633f05e5d5abdaa

          SHA256

          17d00ec09ac8fafde3d0c87af7c626a681d1ecb199e59dbc1a47ded5cfc83cc3

          SHA512

          96c942942d83d514542766086e4616ddbd96d6efb42a82be738a13fa3060d05d7bf02bdd774be9cdca73280dd3b7630c576730e687fd41c49e6ca12280b547e0

          Download Submit