c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
Size

2.7MB
MD5

6e8824e96e5ba1fe3ce8f37624e0eab8
SHA1

db80266fe1bf57c06897c2b7c4e4dc4f04d289fc
SHA256

c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f
SHA512

c6e30488a3c4668ed44df2fafdcca4b881fb7a59ea73384845ea6cb576c95fb27df289a5a42dbf5bd1dbeab2d990cda66f811cf51cb787ea2470b030f81ce5db
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBS9w4Sx:+R0pI/IQlUoMPdmpSpw4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2884	abodsys.exe

Loads dropped DLL 1 IoCs

pid	Process
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesAK\\abodsys.exe"	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax80\\dobdevloc.exe"	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
2884	abodsys.exe
2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2884	2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe	31
PID 2740 wrote to memory of 2884	2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe	31
PID 2740 wrote to memory of 2884	2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe	31
PID 2740 wrote to memory of 2884	2740	c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe	31

C:\Users\Admin\AppData\Local\Temp\c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe
"C:\Users\Admin\AppData\Local\Temp\c90c6a0defb5450a7d1865f710bae626e31259bf1560f4a2db8ef116c5c6a81f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740
- C:\FilesAK\abodsys.exe
  C:\FilesAK\abodsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Galax80\dobdevloc.exe

Filesize
2.7MB

MD5
868f7d8f2a384ed019834e1f597fe455

SHA1
51ca25f5f2667a0136ddc3993fa68e2387dbb4e2

SHA256
89ecaf0852a35dbe43f835825789e3c0f8e94d243b01d36fc1bf7b49001c2b42

SHA512
072094f3bf15c79f1a22d50334e38bdf4f76e5edccd44b94132f0202c4940727f9a88fb80f1322bbc5f8db5f2de4fc4732c1e1a1e77d0bc68dd41990eca06e88

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
202B

MD5
ed6b1993e4a2271654bd53d0ca30a926

SHA1
9b065169feba4da9d9d9fd5a47ab95e9e1bd16ba

SHA256
792414dee5cdec7d06d62fdfa577a15f6ea090b8339891ce7e7d285538799ff4

SHA512
bbdf4f4dd6596b98ca3326c0234dc225e6ae6fa4bc0fe52ef026633a1697089a17d0a74dfedb8ee5d478f34b6a36edddee39ffb6fc0027174d83856b29d76935

Download Submit
\FilesAK\abodsys.exe

Filesize
2.7MB

MD5
4660ee172e606c8be04eabf7fbc8bc8f

SHA1
3693df2d06d960d88c6a0c9ed454c8eb6b5d5dc3

SHA256
ac56e2f12071a11e80122fb3a6135aecf09a20a785754fe05aeb914f8a251c48

SHA512
a7804e0a5ae5266f986ca98c460e765e93a91bf5d839d3ef6ca232395399c963e1fff18144606d0b6864c9b4ca3c5d90f15d02a077147b05bcd0c8dfdfc21768

Download Submit