Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe
- Size 4.1MB
- Sample240809-gh17as1dje
- SHA256 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb
- MD5 6aaf5b05874d62ea41d71059c99fb717
- SHA1 5b55bee603538deb92dcbfdae91e2d1a2ea65b33
- SHA512 363f9f027c68a60906448434c3468184c6b07ebf4e0b696ca8c0f574a88b4943d1e2c30fc478fbe46a307f9aa5f21f75443e25f91c28f3da420123690d5152f3
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpz4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmU5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3648 abodec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe2O\\abodec.exe" 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZXG\\dobasys.exe" 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 3648 abodec.exe 3648 abodec.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1792 wrote to memory of 3648 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 86 PID 1792 wrote to memory of 3648 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 86 PID 1792 wrote to memory of 3648 1792 8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe"C:\Users\Admin\AppData\Local\Temp\8ded04ff1db9c74f8cdcaee10d27f3c8256564967f27dab141a61fdb3be9bceb.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Adobe2O\abodec.exeC:\Adobe2O\abodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Adobe2O\abodec.exe
- Size 4.1MB
- SHA256 8cc75430beedf05bc94f299d3b1602875ba25345f40863a5e86af208b1e35e03
- MD5 462a2bbb0361472a3a9eb087a22980da
- SHA1 a7576c07863e318945f106cbcb1df87621e06b40
- SHA512 77d98004ef51a6411336ba40f1d66a20ad0713ce8c93d3067879ff30b8be8baffa52f6d3338305026d7f4ff2bb14792d2a1a40676b5b06818c9bcd420a1dead9
- SSDEEP 98304:+R0pI/IQlUoMPdmpSp34ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmQ5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZXG\dobasys.exe
- Size 26KB
- SHA256 e0a0efd36c1fe270fcf32218baf493d8c47290ecbda67fc9a6aff68afd35da90
- MD5 e20e358751673be9b0ca3ba8a9dc2fb1
- SHA1 def1a5717070c4a5b8e21809bfa873a8e192706d
- SHA512 1770b4f24cb997b10a2beb5b1360305f2563cc25e4a4f5a109cf9fb45db97c5bc03889aad619554c4f1ed479bc29f99fcb1beb756c48dbed210ea2c296a4a590
- SSDEEP 384:PLT5lDnYcy/ES70S7Tq6xRVtLiD1APk/7zJRKahcO8oRZDqOs7C:PLT5ZRHUj7TRxRVED1bHKFO3Hq/2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZXG\dobasys.exe
- Size 4.1MB
- SHA256 bff249efa3a6922ccecc0c70076bc86bb6d08de002438b94943a363883509c95
- MD5 56fa286ebe3818f5ef37ec98c4b5df3f
- SHA1 beb3bbd7800aff817012d4fc087dd728dcdd50f2
- SHA512 27b6e7fe6fa1edd1b7f2ed4232341626a37db497ade9fc97401ba5eb4f0d7b0282bd06b0b9c4804defaff2279ca036f31b0d22996deaeac98b86e658a5572f32
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpx4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmu5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 200B
- SHA256 2059db1a9a9ebb6d644fa7b9e3ff33b5e75c05f1407c90aed1d545499a186894
- MD5 498a87bc200dbe1ff01c31c8e06a9935
- SHA1 b8565b7a99cdd169fde5a5ebc5c33cfcead1edf0
- SHA512 ab860e9f8eda818c567bf1955f865868d43b752615cffc58bb78bbf566b6a9031da181b7ba9404f1ca4d44015d7cd7bc186bb4954dc36837c6afc0b6f930c7df
- MD5 SHA1 SHA512