862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/06/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
Size

3.1MB
MD5

425db1edb91bf0d643214c8d7266ee65
SHA1

a751ef0778d8691e9183afa3713956ab5c15bc5b
SHA256

862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae
SHA512

310b86a6356896a4b815c414349f22122123f44e665438e61d1da36a3264f5b35490d281f3310d59b2a96afcd979fc2a6cf9be9b9175a930bb747d42f6d4914b
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBY9w4Su+LNfej:+R0pI/IQlUoMPdmpSp+4JkNfej

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	devdobloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files9S\\devdobloc.exe"	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint2P\\optialoc.exe"	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
2752	devdobloc.exe
2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2752	2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe	28
PID 2380 wrote to memory of 2752	2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe	28
PID 2380 wrote to memory of 2752	2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe	28
PID 2380 wrote to memory of 2752	2380	862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe	28

C:\Users\Admin\AppData\Local\Temp\862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe
"C:\Users\Admin\AppData\Local\Temp\862e2fa21107d295702c1488196e45bd51516b8ab850d8be8b5221e1f3d6d4ae.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Files9S\devdobloc.exe
  C:\Files9S\devdobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Mint2P\optialoc.exe

Filesize
3.1MB

MD5
f680c4b4cdc881535cbb82615c04d7c0

SHA1
fa317f6d34b1d98fcf9319b97733ba9e6f6be2df

SHA256
54fbcfbce5d5944c66987e0b6f6f733f56d506225dca8f190a706e47f6922577

SHA512
a19b951713ed8b6952afbb9e0131aff19e72971c84032bbade3505942150daeaacf2989e4fac4dca76b933a0a77d805b141b16d1b50721cf5d4710e26761808d

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
203B

MD5
f218b08ee5d68bad54deb5c20dd9d795

SHA1
03f7d4766ee6320f093a58ad4cc6c02fb6332315

SHA256
1e256db193c92f60f0f4230f294f22eb846f3dc29ee631b3442f44c19c736fd8

SHA512
89b3ed3fdce2a3318481d8d71290a932fabb92ba0b116b2ac9ffe6b4df0703761b168b980e7a150e4ee614fb34b375e24b13497380c5fbdc751c3c8334f968e8

Download Submit
\Files9S\devdobloc.exe

Filesize
3.1MB

MD5
56ced5ebbfff18a0d9ae4db304c5fcd5

SHA1
cf858de558356b56c43f50f92777a8606b40ad9a

SHA256
6410e08a38610fe7f0ac62d0df54557f911d3dfb139f0be72e930e6c9ee3ab5c

SHA512
9b1c817ae74e2ea38324f953e8447dfdb2e510275941b76de715d07bfd17640d70ab20d599824eda643799670364e8ea2f15b4ec598414c17dfd2f92078a7d47

Download Submit