Analysis
-
max time kernel
893s -
max time network
897s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 05:02
Behavioral task
behavioral1
Sample
vodd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
900 seconds
Behavioral task
behavioral2
Sample
vodd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral3
Sample
vodd.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
Behavioral task
behavioral4
Sample
vodd.exe
Resource
win11-20250313-en
windows11-21h2-x64
7 signatures
900 seconds
General
-
Target
vodd.exe
-
Size
93KB
-
MD5
c13fd2efd94960fae11cd9f78ee9f090
-
SHA1
3855d7f6f42048ab3895e213e5d1847df7c9641e
-
SHA256
aa964bd196342fb080c53443b85cdcea6e117ada3eebe95043f23e264137d154
-
SHA512
541c367480d91ec10ac7eeb7a6c7aabe1f74c2b408b6c27362590b87eed0956e0396285c8c5c61a843a04a015c2cbcb642c8987669792ad865c120606d65a380
-
SSDEEP
1536:LU/r7EkrjaFIs7E5Ox8Jn8LjEwzGi1dD1DygS:LU7jau5OKVni1dpX
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1960 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57bba9c26679cdd8eee0bb90aa915a71Windows Update.exe vodd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57bba9c26679cdd8eee0bb90aa915a71Windows Update.exe vodd.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vodd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5400 vodd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe Token: SeIncBasePriorityPrivilege 5400 vodd.exe Token: 33 5400 vodd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5400 wrote to memory of 1960 5400 vodd.exe 88 PID 5400 wrote to memory of 1960 5400 vodd.exe 88 PID 5400 wrote to memory of 1960 5400 vodd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\vodd.exe"C:\Users\Admin\AppData\Local\Temp\vodd.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\vodd.exe" "vodd.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1960
-