6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
Size

2.7MB
MD5

63bd0aafd5888742a139490a563293e3
SHA1

a0c20bd1f68946ac72b47621068dbc3305bef957
SHA256

6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25
SHA512

c3cd60a8ad4b4101424091a5f203d49fe236310cd60cf6d33a379891b9baac779dbab5c1d08491e3c248d9ac15b93210b0af765cc431bd9903bc477607d5dfc5
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBy9w4Sx:+R0pI/IQlUoMPdmpSpg4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2140	devoptiloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeDK\\devoptiloc.exe"	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZPD\\dobaec.exe"	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
2140	devoptiloc.exe
2140	devoptiloc.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2140	5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe	87
PID 5108 wrote to memory of 2140	5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe	87
PID 5108 wrote to memory of 2140	5108	6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe	87

C:\Users\Admin\AppData\Local\Temp\6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe
"C:\Users\Admin\AppData\Local\Temp\6c11bc8e2a408a1a469c59ebb5394a156e6e0ff0a57837c16866d057ba29af25.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5108
- C:\AdobeDK\devoptiloc.exe
  C:\AdobeDK\devoptiloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AdobeDK\devoptiloc.exe

Filesize
2.7MB

MD5
91f3069d83e705061f10729f56b5aff1

SHA1
fe473bbb78841cf00fca5ebeaedddbb312636ba5

SHA256
d1b8ede59a8aa7ea26cd9aa13e127bd72a9e404bb010bdbed9346aca6f3e1fe2

SHA512
3bd76dc3b7b3450c5883fdfe9fe8a87ec9b200d89038076411709501ec276ebfd79356a35d1bf637cfd2927b8e9da22a3a05593f8dd3d6d1638bffb6081f99ee

Download Submit
C:\LabZPD\dobaec.exe

Filesize
19KB

MD5
13b7be4099f3920c0a076cbbf5b83643

SHA1
a81de9811a57ec2cdbfe1e3a6cbedfbf2fbcfd4e

SHA256
7897ecdf3ddcd3490c17f2cc193f10a2e0b047eddef77884b9b5f187f0d09004

SHA512
fca7da7ace3651a9ca715a8593ce988a8b4f41cdc02d53bb79b7379add25e21edc3c75d7da18fcd92f433fd130cb2c29ea8d686055b1dbef197d00c85fdde05c

Download Submit
C:\LabZPD\dobaec.exe

Filesize
2.7MB

MD5
c2766d0495193eb0246a70dea2574918

SHA1
9ae299cfe13962a803fbd88a5c69d3d754796239

SHA256
000ec25fb7617c820ceb50aa9e0f2d5decea111d353f926f607aed5b70920d6b

SHA512
e0fb60ef3a5a9343a871f86f4bf4bb99019c723a6d25ec913c2246164ae3a6155aff9a904ace21fa0fd849e1021e849ed05988e1dcfd6b9510f01112e7388645

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
7abae5cd492c981fcb4d02f5b7630a56

SHA1
0c07485b12c5f5ecc68a7a08bb4dbd9d4ae854a5

SHA256
4cae59fc41c575552f8a0589614b40813bc9d6ccd8b9ccac3a869a66ff528151

SHA512
13763236631dc8c92f59a6f06a54a67193c5e73768f1d014e48aabff1f00c2a3febe9063e3ab34fc99d91f897df62d9fc7a0f22967bcb8f949ae0e72ea63a656

Download Submit