Analysis
- max time kernel
119s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 07:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7803a8a43b387015377ee60032e50a0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
c7803a8a43b387015377ee60032e50a0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
120 seconds
General
- Target c7803a8a43b387015377ee60032e50a0N.exe
- Size 2.7MB
- Sample240825-ja18fathkm
- SHA256 e7f3606fb1bd8e82bd3887017b877d7a02886fb9c3f5d1d582a7db04a9b1e749
- MD5 c7803a8a43b387015377ee60032e50a0
- SHA1 f57b61da64192274025c43ee4a1faf2deecc20a7
- SHA512 35a721439b5785f82849e84c4d0b72b23732c1bb627de30ce741c239a863df6717904d8d31a626bef45350084cccffff68adcae1659a5c5aa66619013e6af837
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBC9w4S+:+R0pI/IQlUoMPdmpSpk4X
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3124 abodloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot4S\\abodloc.exe" c7803a8a43b387015377ee60032e50a0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint7Q\\boddevloc.exe" c7803a8a43b387015377ee60032e50a0N.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodloc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7803a8a43b387015377ee60032e50a0N.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 3124 abodloc.exe 3124 abodloc.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe 2892 c7803a8a43b387015377ee60032e50a0N.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2892 wrote to memory of 3124 2892 c7803a8a43b387015377ee60032e50a0N.exe 88 PID 2892 wrote to memory of 3124 2892 c7803a8a43b387015377ee60032e50a0N.exe 88 PID 2892 wrote to memory of 3124 2892 c7803a8a43b387015377ee60032e50a0N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7803a8a43b387015377ee60032e50a0N.exe"C:\Users\Admin\AppData\Local\Temp\c7803a8a43b387015377ee60032e50a0N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\UserDot4S\abodloc.exeC:\UserDot4S\abodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Mint7Q\boddevloc.exe
- Size 2.7MB
- SHA256 06a8fb2b9c01f1f4cdb2d85d17213f8f8677af9a026ed46fbcd670df6fc02e63
- MD5 c518b7f249be4ae9c3909114139b62b5
- SHA1 c46826fe0b49025987511b04a6874041ca5dce5a
- SHA512 48254de70929a81f4f4ad65c13d9a8e4df576defdbee4bdc86eb0fb3b62ec56b18e4d2a6db3e5d12b7461413302c76bf9bcc32820b7ab74a11df26beeb7772e3
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBZ9w4S+:+R0pI/IQlUoMPdmpSpV4X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot4S\abodloc.exe
- Size 2.7MB
- SHA256 7f25fd00b874eed0de242692fe7bdc20a09c8764d7efb582fb3f035d2d430ea0
- MD5 0500bc544f993a3a2025afe4b9c61980
- SHA1 430681f40aeea68a77c7c6f4ae9106414a1b1848
- SHA512 fce02c10caeb9b70574b7001c923511b57c9fe1a01d7c43552f66bf3e4c6d51fbfc2d4a04b7aeaf3aeb717962c704533be2f7b5acd1065494c183cf81827276c
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBO9w4S+:+R0pI/IQlUoMPdmpSpw4X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 7519346d624039353947adda672e950640cda5d41e08a1aa90e275b00f24bb62
- MD5 7b4d2e06bbedf9d5921f5746879dec49
- SHA1 d740b860cee98732f89dd0704177e2602017e8e9
- SHA512 4a11e869543fbb4b69127b6a799e493ca2d320882efadd42fee233b3422d940d3909e87bf92ba3c4c16793302484b3e80681e616d65ce46d96c52f2da6aacbad
- MD5 SHA1 SHA512