Overview

overview

7

Static

static

3

10a43f3d7b...74.exe

windows7-x64

7

10a43f3d7b...74.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 15:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10a43f3d7b0b8841c04556e494d3df3719d837c26dc71bb2a98fca2130bf4c74.exe

  • Size

    3.1MB

  • MD5

    ee3e48ab4e8259a440d034bb0ffc9fe0

  • SHA1

    bd20c0bcc4e6907c83003eac87994aa4e4456bb0

  • SHA256

    10a43f3d7b0b8841c04556e494d3df3719d837c26dc71bb2a98fca2130bf4c74

  • SHA512

    dd6f3022851150e78bc49b7546e9068160be704d74b1ec5755ea6a75d6298ace170b06cbd1bab4eea67c655dc734d9f06ee168b20c981e711427f6a12536b1e6

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB39w4Su+LNfej:+R0pI/IQlUoMPdmpSpv4JkNfej

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10a43f3d7b0b8841c04556e494d3df3719d837c26dc71bb2a98fca2130bf4c74.exe
    "C:\Users\Admin\AppData\Local\Temp\10a43f3d7b0b8841c04556e494d3df3719d837c26dc71bb2a98fca2130bf4c74.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\UserDotXO\xdobsys.exe
      C:\UserDotXO\xdobsys.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    201B

    MD5

    b5bdde3639e9fd11e2dcd7b32c79999b

    SHA1

    b3fd750358490af9da1bf75ecf7fdd91abc3b4ca

    SHA256

    9c7224464801ff4cca7204f74c8cffb913b2640cdeaf6fe950916bc4d1589eab

    SHA512

    b981d804e32fc73801e011a7d1319cc2fb4450bdb0bc31cad2e2160fa21154e35cae5513209697e9f4672cebd15be0dffb0fa2f14bcec6c17c0f9dcb74788386

    Download Submit

  • C:\Vid27\bodxsys.exe
    Filesize

    3.1MB

    MD5

    b214769b26e9ae6416101712d8e697ca

    SHA1

    1838e14d731cbc6b6c7cc76d8d8454b48d21c211

    SHA256

    a44738d3b1e579f9cb28f522ba43da15b500ff38bb5a889d39fd2c7324323073

    SHA512

    7b08225da0dff3d5ea7eee279df0f4502c5739e94a321d9a360323d8279cc308a85efd39574dd0fe69ae7f88b243c6110846e49e2c12d5cf2b60c8799c69c1e0

    Download Submit

  • \UserDotXO\xdobsys.exe
    Filesize

    3.1MB

    MD5

    e375dae865f1e5cb2b64526f322f842c

    SHA1

    e7d0680692cc0f92d536790807a65f5dead7636f

    SHA256

    a9fe6294f7664600e72350baf9856bb72e1bdb2fe65d517b12065df3a487865a

    SHA512

    8dca6cd5194b21e797dddb76eb55e1ef7cc7df3e5cefdec49812a47a73bf1ca491cecf6727929ed287621369a8a1875d82fe8ab77d11d348fe307d778df90244

    Download Submit