Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
05/08/2024, 18:11
General
-
Target
bd306605d20ad2c97f6c9b3cdf3baf70N.exe
-
Size
2.7MB
-
MD5
bd306605d20ad2c97f6c9b3cdf3baf70
-
SHA1
8bafffd195931d9545c795df1023823adec6018a
-
SHA256
bca031d4a3cb2f67ea0cbc1da4ffebe2266661166ca38b568e4f4560bddb213f
-
SHA512
0f84044a85980615a1f209dc2e890bb08319752d5f374147c7bef5b1c01e1cdbbadd37ba18f873e00c5336a5d273361ceb7383b13563cbbb8c3901b4b2258e32
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBI9w4Sx:+R0pI/IQlUoMPdmpSpC4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd306605d20ad2c97f6c9b3cdf3baf70N.exe"C:\Users\Admin\AppData\Local\Temp\bd306605d20ad2c97f6c9b3cdf3baf70N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesFS\abodec.exeC:\FilesFS\abodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5700c2f16b1ba985c6a89bd2fe6c407a3
SHA17d45f81f3b08345f3f1e3a4d86010f9129595ae6
SHA256549e7fd8c295462eae9fdc5e5b14ceca5fbcd1ee8b31672fb255424541e77bc8
SHA512676223d6a8db51bbb8bc3f174f59983bacc736db6e737359e995de44c8a08edd2a8d525d465c94611a109f845d50bf0dd76c6d6b4fc360c3500c8cffcbf75e1b
-
Filesize
201B
MD585102355c4df55b408b27acc710eb92f
SHA1b54b458bca03762cb01e9152f6d8f82641f21b50
SHA256c2959350e6947a35b4fdbd149ff7530ebb760e15f49d85396f35db783edfff9a
SHA512932f1a7f26ed7352cfdf3dd04bf58c54562e64fcdc1c7c4184c84ea9feb534f6c2b531b5346d9beb466d88cd536972b4a2bb3759e08c7053f81d2128110741a4
-
Filesize
2.7MB
MD598dd18e2260435b7500cc884c1f2a08e
SHA11b8f767671ef440961b3ee4ff6f2288de338864e
SHA25666218fb162ce62a811d3b46dcf6904cf3154fba157d82baa24b1e5b97180ef9b
SHA5122f5be80447c589e83805d62e46a2b506d6feaa65181f57d5bbcd50e9483f3e0c01054997632eb3cdf22800da8725b002747a2ff188cb90da9e54ad6e7d470c62