a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
Size

2.7MB
MD5

91fc7785ddb5e889204495330a0bab50
SHA1

a2d207b6db88c19c3d4c0ae407561c587a324b4f
SHA256

a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8
SHA512

44b806a79135063c20531821d07ef7a3ea47a9f25f04f1c016e38d46504d91355107c3be895187e15015e0c3fcc336d95b2b5631ec45be5a6769f12a6e8c7380
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBL9w4Sx:+R0pI/IQlUoMPdmpSpP4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
868	devbodloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeD5\\devbodloc.exe"	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintER\\dobaloc.exe"	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
868	devbodloc.exe
868	devbodloc.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 868	1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe	85
PID 1640 wrote to memory of 868	1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe	85
PID 1640 wrote to memory of 868	1640	a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe	85

C:\Users\Admin\AppData\Local\Temp\a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe
"C:\Users\Admin\AppData\Local\Temp\a09c66fd66057ed34a34a1be153d8d4c69edc9f65cdec8b07e9974fd36a728b8.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640
- C:\AdobeD5\devbodloc.exe
  C:\AdobeD5\devbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AdobeD5\devbodloc.exe

Filesize
2.7MB

MD5
d8931787a3e0700ac6c953e4f03cff52

SHA1
dd905e92288a5b3de5272d11a2edca72c1634801

SHA256
8dbf38b61e12f8e815c034e2b14ed8494ce9e29fc79fe84b08e1f01d8b479736

SHA512
88a45de6d1393a9da8c2e2eee8dc7d13ee5fa8add5cb79e52af148f2a01cf48415b7a9eac813edbedc02af30ae9f11dde6e89f3d340816c89086b93c0630a95d

Download Submit
C:\MintER\dobaloc.exe

Filesize
6KB

MD5
391d87f7dfcdcf695428c50d11e173c8

SHA1
ab8fff10daa93adfc6c017c4bf21b86f4189f84d

SHA256
5c4697c99b2da7db0fca8855f6db02ac53bab7596f8df0142e4698686d92b38a

SHA512
17b5515b565376f6bf76ddde6de5651181ca90f9dae0eeba7bca03fef1a906b06eb1f64466827f089adf928db6f27741a3e81cad034e4e66209c1fe4b1f7f0b9

Download Submit
C:\MintER\dobaloc.exe

Filesize
2.7MB

MD5
638d4dc3bd92449598550c4458948c47

SHA1
14646e8d9bab6f50de6ff8fc29f1039159377d20

SHA256
d6fe04b97a9b2c68b7cc6810bb3773d79157dd3c49d936ade980a4d5ed77079e

SHA512
8b02c530fa7d319a15418ed1d7daf2e857db1365e77152a4725e89723187847b0b2f70039759aab8c9f31e10668f107dd71dd4bb6256de52018f4aede37ab891

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
60237a818d876705fb9ccd38b4c1c915

SHA1
3c92bfb7fee0214c01c28cf296e7b216b767f1c2

SHA256
e7f85e439e07d26cb5bc9f419eb574781cfaef359f4200a102fecf59c19a68e3

SHA512
204b540ccd4f365d30130001bd65ff9935a887498b4f277154fe50b995d507e6b5b7d6ffce4ae6dd59154e2304df18d5a7eee3a266349b260452cd9276ab9acd

Download Submit