vobfus | 2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe
Size

204KB
MD5

a9bedff77a42ea393e2d152007c2cb1a
SHA1

da93a867fc4822c04b13238b6a960d477ff13cb3
SHA256

2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56
SHA512

69389e7b65e899062203486a440df58764f6f65d8f4aa12a32c8eedd00821ea64fab8a4a8bd3f660cb44d0f5be9716e1d52510746e3fe8bfa386f94f19d22eb2
SSDEEP

3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1h:Xo/BHng5HaVG4G/1z+QVMbg1h

Score

10^/10

vobfus discovery persistence worm

Malware Config

Signatures

Vobfus
A widespread worm which spreads via network drives and removable media.
worm vobfus
Vobfus family
vobfus

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3500	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3500	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3500	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe
3500	2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe

C:\Users\Admin\AppData\Local\Temp\2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe
"C:\Users\Admin\AppData\Local\Temp\2044efebbfdf46d92a131cfb206ac345f25c5d7e8f168f9001671e7c3e6e4f56.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AG58FPQON.exe

Filesize
204KB

MD5
97930f6aff51597e82dcde06ef73a136

SHA1
6e7c7b81f42826d0a86e1dfad4bae37b9cb7221c

SHA256
d33947c45811cc367e4117ced65814de351c803a55c3b4b8f4a7c6d7f957d971

SHA512
1cae090ffcd85df34825f62bec8a30c108566ca930050d76db1d94c164e8eb5fb6aeb7e1ad9c41226de778b505675739e0f25b185e427b55935255596e0cb3f2

Download Submit
memory/3500-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-74-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads