Analysis
- max time kernel
119s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4b50138da7f9e67e5a35b5b4078af60N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
c4b50138da7f9e67e5a35b5b4078af60N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
120 seconds
General
- Target c4b50138da7f9e67e5a35b5b4078af60N.exe
- Size 2.7MB
- Sample240825-jcbqkasfjf
- SHA256 4e6e208b1331b81d0001b98456bb5e7a028503aa78f6421756b634e0a0d9069f
- MD5 c4b50138da7f9e67e5a35b5b4078af60
- SHA1 cd051e6ddb12ed78f79d41f762ee4871de0a7e91
- SHA512 d472725c3a77a26055462599f2c44db49117248cc4ac0eda46a0faf442c4bb85c698fe4d3bdd2dce7052c47ac47e4cd376256f66489da1311023d167aaeacc3c
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB/9w4Sx:+R0pI/IQlUoMPdmpSpP4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 548 xdobsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files1S\\xdobsys.exe" c4b50138da7f9e67e5a35b5b4078af60N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintMD\\dobdevsys.exe" c4b50138da7f9e67e5a35b5b4078af60N.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4b50138da7f9e67e5a35b5b4078af60N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 548 xdobsys.exe 548 xdobsys.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2448 wrote to memory of 548 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 89 PID 2448 wrote to memory of 548 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 89 PID 2448 wrote to memory of 548 2448 c4b50138da7f9e67e5a35b5b4078af60N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4b50138da7f9e67e5a35b5b4078af60N.exe"C:\Users\Admin\AppData\Local\Temp\c4b50138da7f9e67e5a35b5b4078af60N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Files1S\xdobsys.exeC:\Files1S\xdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Files1S\xdobsys.exe
- Size 2.7MB
- SHA256 c17463247d356f0f74f987ea2ae6d4e7ad31e2c7aff0b02c82dfd121d105e5e0
- MD5 a9698e154188901987e180dd681e91ce
- SHA1 d71d9900f5bf0e2820679fb1e659c251b8a45894
- SHA512 51e95119359f19ab4a5e2f5efd4df56a1f50f0d9078c9f4cd272daccd93afccb8b13a931ad23518eb45a681e5b039d479de507a4ff8c2d88979d44c6c0b9766f
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBY9w4Sx:+R0pI/IQlUoMPdmpSpu4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintMD\dobdevsys.exe
- Size 2.7MB
- SHA256 ac5175a451dd8da3233a25a00aa38b62e181a377d1e661dc37b82145770984e7
- MD5 987f4738dccc531c4f0cd0d7d87faf1b
- SHA1 fa4d703354ddf3ee09f1521109f8db09205d2d94
- SHA512 a07883662c4d8eefe0dc66af5ce9ba77b25a658f89dfed1172a990461f90f203b63392121797207143adb48a82c28f5ae9869e42f7af39de0e2d0815d6ad5beb
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBz9w4Sx:+R0pI/IQlUoMPdmpSpL4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 360c49d442c4e56b9a2b8847ec1eac86403470eb96f25a6d131ab93e85f055f7
- MD5 0b7efef2798c7cc252b990d36fff8105
- SHA1 dc6a3194f51eee2f6a36301fa727f267f2bf577c
- SHA512 524fcb711561a1aebe61d700c48806f7dfc43229e68e5f8042e63e7896d95f25d5426c1bc9592ff407383a71776f8cc8e71db0d39046110e973818080250dbe3
- MD5 SHA1 SHA512