Overview

overview

7

Static

static

3

3853a3ff0e...88.exe

windows7-x64

7

3853a3ff0e...88.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 06:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    3853a3ff0e91028feb0405143eac51e0a4e47f43023c8254ae5a1cd7865fbf88.exe

  • Size

    3.1MB

  • MD5

    30810902e638b6e3c50f64732ee9e76e

  • SHA1

    18b4d052e75b1a481b11297e6639a7f17e97d1d1

  • SHA256

    3853a3ff0e91028feb0405143eac51e0a4e47f43023c8254ae5a1cd7865fbf88

  • SHA512

    aa582b4bebb8bbdcbd76a38d7b8d3dfc2e07b44a82cf450f2e8cdbe263802dea788bb7a3f847dedd420cf3efec25c2a981f1a3ceb1e486eaa2a0403a4e25bd57

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB59w4Su+LNfej:+R0pI/IQlUoMPdmpSpF4JkNfej

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3853a3ff0e91028feb0405143eac51e0a4e47f43023c8254ae5a1cd7865fbf88.exe
    "C:\Users\Admin\AppData\Local\Temp\3853a3ff0e91028feb0405143eac51e0a4e47f43023c8254ae5a1cd7865fbf88.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\AdobeK2\abodec.exe
      C:\AdobeK2\abodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2568

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          199B

          MD5

          e2004a18665c0e28131e33533fa02c9e

          SHA1

          8beff90e37d709140a1ed9da902424164be7dbcd

          SHA256

          682f2970b6e671052097d1998a14a77f83f8e2eb6cac249bdf8d4f1f98f871fa

          SHA512

          af72a70f1c2a746571a58bb75d5db929cde3a8664aa514622161a4fedbd464730212e2a900a0bce0e4598dd446ce84542e24d144729830b675c249dab0f437d4

          Download Submit

        • C:\Vid8F\bodxloc.exe
          Filesize

          3.1MB

          MD5

          cce015cf7113da25161f63e43bdfdb73

          SHA1

          b410a65708dbdf44cfc1e4cd9a392664160a05c3

          SHA256

          b29c324a26c2ea4879f93e091a8833572620988cb081cdca9cac32a50f428664

          SHA512

          0f6f72ec536ab53445bb7fd3d1252c3a263e7567b11091e39dc15a8af513d3ebae68676e81543eadb9d0e92eec6309e6a5beff277f40c8b03b1f44ed9590c86b

          Download Submit

        • \AdobeK2\abodec.exe
          Filesize

          3.1MB

          MD5

          87899417d6e009bba97a91328a3a95dd

          SHA1

          2dbd3fb0416af74af4277e6852db3b1294a7d21a

          SHA256

          33ad40adaa7d448ca9ee1db09785f58d9e04dd11126dd48b07ddcb9da389aeb7

          SHA512

          2e0001788d92ef1d5690a2565c006cdf3fb6cbd58b30488af56f2138c272c2a32dc0e7819fffac2d935b9703db6788f77d8d98ea880722c5da35849ab4391631

          Download Submit