e2cadb0766cf2fc20a527c917f4475388ef3fbd73b8e0c6d071b695afbb1dba3

Resubmissions

04-07-2024 17:22

240704-vxyavazeql 10

04-07-2024 17:19

240704-vv7rhazenr 10

Analysis

max time kernel
299s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
Size

3.7MB
MD5

4bed82d2182d95951a4dd3b090868cf1
SHA1

0f72d100c5030fae1258c9cde8a2b447dac50030
SHA256

f92f9a9950c0af5708121ca2ae9f029844ca129ada544fb592cee918dea8a209
SHA512

cedff70bbee2fc1f428f74676cde80e0b5b1846bfd19f9e411e10507c1f1b31458541fc1fea8cc631d716fdeaf7528158613f4a31c8b1b18a512b25d6b3966ad
SSDEEP

98304:+R0pI/IQlUoMPdmpSpt4ADtnkgvNWlw6:+R0pIAQhMPdmC5n9klR

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1200	xbodec.exe

Loads dropped DLL 1 IoCs

pid	Process
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvOT\\xbodec.exe"	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBIM\\boddevloc.exe"	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
1200	xbodec.exe
2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1200	2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe	28
PID 2616 wrote to memory of 1200	2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe	28
PID 2616 wrote to memory of 1200	2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe	28
PID 2616 wrote to memory of 1200	2616	[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe	28

C:\Users\Admin\AppData\Local\Temp\[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe
"C:\Users\Admin\AppData\Local\Temp\[DemonArchives]4bed82d2182d95951a4dd3b090868cf1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616
- C:\SysDrvOT\xbodec.exe
  C:\SysDrvOT\xbodec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KaVBIM\boddevloc.exe

Filesize
62KB

MD5
2c56adba38fc0c1343cf810ea14ae8bf

SHA1
3cc4fd2010dbd6da1c40ce9df089c9ef8654f89c

SHA256
506b1f35d95407d13fb7ebd989c77fd7dcff34955072246f6750ea489d1a7adb

SHA512
2c9e3dadc2b8ac9cd65c89732341f02f96c5b6f720f1b774c6790e51c4fc187ec628e8ee07c37db4bfaf1ca04cd46fed156c21d1ac907028ae5b760308bcf48d

Download Submit
C:\KaVBIM\boddevloc.exe

Filesize
3.7MB

MD5
814a0a6173f4081e8f6454a14cf530f9

SHA1
6ed4d30b00c01663ed3b92f30b6ed90f85b84e09

SHA256
5d542a2ac8bb59c2ffeff1c4fd29ba7594386fadb93c9ee61a437d04eafa7db4

SHA512
ef0d4824afffe877dca7789fbbe80755e387125ad66be7b14e83b4fa5df4369628059c158b7bb28264a4c6d3d8af5698da9bb8a1bfe2ba0ecc80c062d552e347

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
203B

MD5
62c63201d0847d644b5228b9b8dd80b3

SHA1
b305d4a546193242907e38cb0b6d41b670d90efe

SHA256
f464c9df170f619f27172d4289596a9674437c4f44069272390e85d6c65f8e6f

SHA512
39d702b70d37623642b330ccc40d5b8af714eac047da1badcb5eaabd527776fbc412e112705aec4cdcc3653d0963fcb1f7cabae1f0488c5a0e8720ab6d1af19f

Download Submit
\SysDrvOT\xbodec.exe

Filesize
3.7MB

MD5
051882ac83f6a682ad2f1111f5f03afc

SHA1
44576ed3c868d2c13207023b645263f5c5502dfa

SHA256
3011a8031483254dcfb87a5cdbcc9570db9f1668275da8055cdc8be23926003f

SHA512
7f32ac973214cf0068ab945a6a1307356722b484f93b23d624d46714bf688a0b0c3c324562606ae9cf5ccc56f8dbd1a1cc8dbf76a5b860669f03bfb80360c75f

Download Submit