Overview

overview

7

Static

static

3

bac51e5ff6...01.exe

windows7-x64

7

bac51e5ff6...01.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 03:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bac51e5ff6bfad4df0d437fac9acc39b6545e44eb25b2733f07863e550173201.exe

  • Size

    2.7MB

  • MD5

    2bc07e2966e81f9cd1531ea93c2e23be

  • SHA1

    5ad22c422f4f1bb7715ac364fa01134b47f5150c

  • SHA256

    bac51e5ff6bfad4df0d437fac9acc39b6545e44eb25b2733f07863e550173201

  • SHA512

    0e093a3c07906d18b7ea7eee8bb0b01abc43c9e5eeaf9dfba6f77dab254068d19e35084db8f7964d083c2d2193b42e12ac0633b01500c9b8924dcf142784d695

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB49w4Sx:+R0pI/IQlUoMPdmpSpW4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bac51e5ff6bfad4df0d437fac9acc39b6545e44eb25b2733f07863e550173201.exe
    "C:\Users\Admin\AppData\Local\Temp\bac51e5ff6bfad4df0d437fac9acc39b6545e44eb25b2733f07863e550173201.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\SysDrv4Z\xoptiec.exe
      C:\SysDrv4Z\xoptiec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\SysDrv4Z\xoptiec.exe
    Filesize

    2.7MB

    MD5

    8f171446deb939a1028d2fe26be4a4e6

    SHA1

    977fb1ca069f2dd8be4e47ec9ecfc1b9072b03b9

    SHA256

    dbb61a184880a0abca71b657dd96e0f18d8f72a1558cc72bd40c106c40cbc56b

    SHA512

    50982edab3791a7ea5bff45a320b597ab7efb6c8ec1c38495dd6152cec53b4f64e4fdf8753c61f2c94c23514aa85eab9db0a07c8a181fc5f8edba586083e2215

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    199B

    MD5

    764ffe5fb6d52b33f647df01e8581c14

    SHA1

    eae13e8a9e1fb362edadad8bcf71f8bf678a7eae

    SHA256

    63f23d35ccae7fb0be1a0c18e17ecc31c58887fcffeae5275808c069ff7a8ef5

    SHA512

    cc5a33af1a6f70bbd901a3eb75ca33717ce0304b271cf82916d7ad37e3087ca0a4f63e34c389dbd70cf614e97569677554f277dcd88ff2f400b05f528d56b671

    Download Submit

  • C:\VidBY\dobaec.exe
    Filesize

    2.7MB

    MD5

    7902b9ec2555392a40b499b2bcf145f7

    SHA1

    de368ec8d762169258b7ecf2251c5d58a41fd429

    SHA256

    1f38029b20ddb95088ba77447c022e82a474a1050ff14c3c42f508a26ac568bf

    SHA512

    e82277d05c6ae71bc3704a7db2271941302d9d15689d7d39d11f72251ce46fbeb62df6760a402778a286ce663668091f8ffe86e24d7863972ed698ca70b64eb6

    Download Submit