18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d

Analysis

max time kernel
150s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
Size

2.7MB
MD5

6cf4d88c7c08b680c3a21b9e2fed18e0
SHA1

84576b744a68e02a4b3bb201081430d0bdc1c4dc
SHA256

18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d
SHA512

4e8454937446424605e981b6b96a7ce8d40cb3996eede1ca44bffb7d3d8bd3554312db757c7923f3420826f072521a26607288b12ac87941b9029753836d10ab
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBU9w4Sx:+R0pI/IQlUoMPdmpSp+4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2052	devdobec.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotPJ\\devdobec.exe"	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax64\\optiasys.exe"	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2052	devdobec.exe
2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2052	2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe	29
PID 2256 wrote to memory of 2052	2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe	29
PID 2256 wrote to memory of 2052	2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe	29
PID 2256 wrote to memory of 2052	2256	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe	29

C:\Users\Admin\AppData\Local\Temp\18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
"C:\Users\Admin\AppData\Local\Temp\18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256
- C:\UserDotPJ\devdobec.exe
  C:\UserDotPJ\devdobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Galax64\optiasys.exe

Filesize
117KB

MD5
bc7f9f65bdf9d43eda0a71af40d555be

SHA1
ba767502f08d70c984d242dda7af1142ffa739b7

SHA256
e2af7b55011eef022c54dd59a5d5e3e017c90de5cf63a1cf8ff14fdc02cb022c

SHA512
204c3f747a21c850f3afe68f9a96e8cb4657e005941a4589334825f75fcb4a068c79dc56fce2bcda8acb7dc2729add605df8bcfe7df7f0d0065390e7d96095f2

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
208B

MD5
dc7f71cb968276aef5ca47a2950c36c3

SHA1
e2a9d011cf0f697f89ed8385f53aeab470f17a2d

SHA256
f5e9cea12c161daebc5741fefee824a6edab6ceef451a32b463e4ca6817de103

SHA512
e3bb6ec3fd2bf1f4643eb0e68269bd1d408923762a345ddf34082e04e5878c8e75854324a43cba64cc0659ad087a583fe0f7fcce1a78c091dbcda01e72948e5f

Download Submit
\UserDotPJ\devdobec.exe

Filesize
2.7MB

MD5
b7d5f28e77c43d707d5d02912ec5ae6f

SHA1
e9c8cf1d2838c581e60997542debb64797560813

SHA256
9cd466aed6b94682cbbbdce75e76703e5698fc38bb0c26d9f2964c884a1f4f21

SHA512
a109101654eeb39889f8498d1681a8ee16109036ee84b4abdb2110cbf3a17a57d07ba20ca09830499429318cbec4446a73d48a482e1f2066e6cc54bdb7195bb9

Download Submit