Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe
Resource
win10v2004-20240709-en
General
-
Target
34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe
-
Size
4.1MB
-
MD5
bc17c58c6bbc66388a0e92cd6729c4b6
-
SHA1
bece640ff522a70203c31b97bbc4e34d50148296
-
SHA256
34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315
-
SHA512
8f02352dadc36f49ed3b49e30b2b704625405cf08155aba40dd08ea89605f71df57c083253c521bab6fcf29db1b87b808a2363c75208e30d5d59332032340131
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpc4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmb5n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
adobec.exepid process 3908 adobec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe80\\adobec.exe" 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidL7\\bodxloc.exe" 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exeadobec.exepid process 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 3908 adobec.exe 3908 adobec.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exedescription pid process target process PID 5064 wrote to memory of 3908 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe adobec.exe PID 5064 wrote to memory of 3908 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe adobec.exe PID 5064 wrote to memory of 3908 5064 34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe adobec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe"C:\Users\Admin\AppData\Local\Temp\34cd8e5f4b0383d628094815a2844cce0ab01811a9d1d775603899c62c92d315.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Adobe80\adobec.exeC:\Adobe80\adobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5b5c2a77270a60585e4b6731517f335f6
SHA1fd8c157088bae4985f100848974aaf2beba39844
SHA2560fb8b830ee7850f78ee702f879354351823e6789419490323ba875c9c8ffd692
SHA512ec88a161e61bf949f50f851f96901a0913b35132a916d7a416a7b7cce564b068a5c3fb150548bb3eb091333916d369932753249dabca61782f19c506212d6627
-
Filesize
198B
MD5995cba15bb83d2f9f2cdaa3880468c75
SHA1e243445da2612d587d88bfddb7bb8c4b15a40029
SHA2561bdd5ccf90b76b8230bae6bfd780ea3a1c505d34996de891066801d3315cc034
SHA512d48a9d475ea4ae86c9116607e0119944976d560fcb0133cdb81a502aff2f615db79c1b93105bb97fbab91e558de7f2319767f6e24d61c431b58ea7714484ea48
-
Filesize
349KB
MD587b1ef4f67b3122bbee3783956411f4e
SHA187707d181a4afa9c0d87172a600c9bd0ae696b56
SHA2566529477d2013023595c3b12a08de07d45a662d648121b70c7e4190c8615f804a
SHA51201bb6df4d6c120fa1038209c4ccd8eb5506bc66eaeec95975a26425362533acb60f3a6d1406cfe19cd583cb6836ab0e7193acbd88581372597e0d66553e5abb2