Analysis
- max time kernel
149s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 10:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe
- Size 3.1MB
- Sample260716-l3teeahz5m
- SHA256 c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3
- MD5 7c7829b8aecb98a98d60085f2e1cbd6b
- SHA1 f03b8bba9c71f000a306a2cccd92fed66d53c1c0
- SHA512 3344cfe6b6efdcc9b19b51be1f7defb563fc903e83772b8d199e22d3b4d9d80debcdc098e7848118c19cd835287d5fba92f0d83c51b77a6444f28a9f9c29f6e8
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBR9w4Su+LNfej:+R0pI/IQlUoMPdmpSp14JkNfej
- TLSH T1DCE55CE2B633822BCC3336B5475B4BC05E55AE18256698BB33FE6B4E6B706407D1D306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 6092 bodaec.exe 1932 abodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocVZ\\abodsys.exe" c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintWY\\bodaec.exe" c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bodaec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4828 c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe 4828 c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe 6092 bodaec.exe 6092 bodaec.exe 1932 abodsys.exe 1932 abodsys.exe 4828 c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe 4828 c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe 6092 bodaec.exe 6092 bodaec.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe 1932 abodsys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe"C:\Users\Admin\AppData\Local\Temp\c422df53554928dbd689fbf1206426d3f675d01037dcad25c277323ed80696f3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
C:\MintWY\bodaec.exeC:\MintWY\bodaec.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6092
-
C:\IntelprocVZ\abodsys.exeC:\IntelprocVZ\abodsys.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocVZ\abodsys.exe
- Size 3.1MB
- SHA256 b0d66f3e63978fee1e8e9d65e5c29ddff5fea9fec5c5e52249f51d795e93dc93
- MD5 87acc3d34dacb7b2bff04865472d9af7
- SHA1 42663aff8b53659c56979b0b6544ed25930759d6
- SHA512 8cf6711a2f1c681312853d97494b6f761c71aa0fbbf05c2f3851422dd61049c3ad898556e357e9c4e0335584ad589b17d6be6fe0c3e86daeb6430f08672b36c9
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBD9w4Su+LNfej:+R0pI/IQlUoMPdmpSpX4JkNfej
- TLSH T148E55CE2B633822BCC3336B5475B4BC05E55AE18256698BB33FE6B4E6B706407D1D306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\MintWY\bodaec.exe
- Size 3.1MB
- SHA256 fb26b604011eba7e1eaaba83e1cc136a7500f276ff67a0e499b76a80d6fa6c0f
- MD5 64226528206bf7a75790128224bd60f6
- SHA1 88e529ae9e5a41ba6f6c9448d5ddefe2f70de02f
- SHA512 b61ed5833cb70386ba9160697d8005ddb8ee6a30987ec4a5e80aade17bfe78b8e97127d39b6e30a6984615d369b2b22ad25cfc74a258f1d85a404f29fd805a58
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBE9w4Su+LNfej:+R0pI/IQlUoMPdmpSpa4JkNfej
- TLSH T10FE55CE2B633822BCC3336B5475B4BC05E55AE18256698BB33FE6B4E6B706407D1D306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\1946247229440_10.0_Admin.ini
- Size 205B
- SHA256 b2009da4f40488266c8667f0de24edaf891880b66a6675287068b71907ed76d7
- MD5 f858add0dd151f7f0f6be76e004384fc
- SHA1 c2df9bba048a4f5b2617a6a0d26c44622e7b5938
- SHA512 78af491900eaf357baad98a27db60f5ba5518b5f1fa62b8c5da749180cae6044f741850b4d8c9c004493b002f4db7cfc35d528b1d715406b005be972c826d41c
- TLSH T161D02280C60A9507EF58122022884FA8DB972B80232120693828F956A340E28A68D528
- MD5 SHA1 SHA512 TLSH