18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d

Analysis

max time kernel
149s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
Size

2.7MB
MD5

6cf4d88c7c08b680c3a21b9e2fed18e0
SHA1

84576b744a68e02a4b3bb201081430d0bdc1c4dc
SHA256

18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d
SHA512

4e8454937446424605e981b6b96a7ce8d40cb3996eede1ca44bffb7d3d8bd3554312db757c7923f3420826f072521a26607288b12ac87941b9029753836d10ab
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBU9w4Sx:+R0pI/IQlUoMPdmpSp+4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2968	devbodloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotC1\\devbodloc.exe"	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBFT\\boddevec.exe"	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
2968	devbodloc.exe
2968	devbodloc.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 2968	3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe	81
PID 3860 wrote to memory of 2968	3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe	81
PID 3860 wrote to memory of 2968	3860	18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe	81

C:\Users\Admin\AppData\Local\Temp\18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe
"C:\Users\Admin\AppData\Local\Temp\18415b78273a0281ed9f9fb12806e6e34e7edfe2c01ade135d93569052d61c4d.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3860
- C:\UserDotC1\devbodloc.exe
  C:\UserDotC1\devbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KaVBFT\boddevec.exe

Filesize
2.7MB

MD5
9694ca76fb123a61719c31c1cf096d7c

SHA1
2dcf3df487650b0a458e009a22d1d6188cb03f38

SHA256
5f7e8ed6df069003af8191bbfc6c07f7118155ccc8b8e0af6c23eeb9889310ac

SHA512
428b8c23859852c93dafbf608dfb44e09c529d9f054543cbe5e5632136073a4edf436e093adf73c86de35e1269501cbd732e68c93a988bf6dd21ebf0f4f25d3f

Download Submit
C:\UserDotC1\devbodloc.exe

Filesize
2.7MB

MD5
b9bb91d4dc8b44eca03dda8af2a2582d

SHA1
b2380eca4d38bd2fe0d8b45a7fb91a4a9696fd06

SHA256
0164fec4ed7a6e24a30f4b05e56467eb63672aa3b3872a14ea648b2a6df723cb

SHA512
6bb4bdc33c7d535dd865fb16a4eb8eb87873578ff8aed6d4ec01a858a382568ff8e88f1a760d76a3c088421d074b649c77cdb1efd6544bbb4cfbdf13c7a2d759

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
205B

MD5
93aae2903e7e21845900fdc6d585e7df

SHA1
8c5fb75d66f6e59a882c72feab522fec0dbe92da

SHA256
97a3aeb3a952b20b6ef1b7be0f34ecb2ece215312bd3f64e18c341e4b7450056

SHA512
318a432aaacf4e50be36c9ffe63595b6d125bcd9225cd994fe0e57cbab272358a3ecfc9394f72b061686651dc18b66660ecb1c4dc928b625f411a9e0cb3a815c

Download Submit