Analysis
- max time kernel
149s - max time network
126s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/03/2024, 11:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
virussign.com_b9b24219000f75286cbdb7c8e600061c.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
virussign.com_b9b24219000f75286cbdb7c8e600061c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target virussign.com_b9b24219000f75286cbdb7c8e600061c.exe
- Size 3.1MB
- Sample240303-m91yhahf21
- SHA256 a57a795d21b41f196e05995a2793aee9875061e835ecaab4f0a9dd17c1319c9c
- MD5 b9b24219000f75286cbdb7c8e600061c
- SHA1 7378262f7726f4af59421ff689449f315612d69c
- SHA512 f0c9825509b373e9fc47f979dcc6c32a02124d6e8762140439dadf8c11db0370a1d582f7c756652e255aa962820400581aea4e859b03af2498f627c84bfb4b33
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpLbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe virussign.com_b9b24219000f75286cbdb7c8e600061c.exe - Executes dropped EXE 2 IoCs
pid Process 2732 sysdevdob.exe 2524 devbodec.exe - Loads dropped DLL 2 IoCs
pid Process 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv4F\\devbodec.exe" virussign.com_b9b24219000f75286cbdb7c8e600061c.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax2F\\bodxloc.exe" virussign.com_b9b24219000f75286cbdb7c8e600061c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe 2732 sysdevdob.exe 2524 devbodec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2732 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 28 PID 2248 wrote to memory of 2732 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 28 PID 2248 wrote to memory of 2732 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 28 PID 2248 wrote to memory of 2732 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 28 PID 2248 wrote to memory of 2524 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 29 PID 2248 wrote to memory of 2524 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 29 PID 2248 wrote to memory of 2524 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 29 PID 2248 wrote to memory of 2524 2248 virussign.com_b9b24219000f75286cbdb7c8e600061c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_b9b24219000f75286cbdb7c8e600061c.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_b9b24219000f75286cbdb7c8e600061c.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
C:\SysDrv4F\devbodec.exeC:\SysDrv4F\devbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Galax2F\bodxloc.exe
- Size 513KB
- SHA256 bbd562374c944042649a15d3d58ed54e166e54dc6fa92b15b60d18e0ec37527f
- MD5 2be90d7847d19354cf6240fadd74c37a
- SHA1 15220ac8b5e5e5fa7ea480404025b977a7aa012f
- SHA512 2916433746ea37815544a3c5e2e9779581d86110b04ebbccce38d56a0a09af62a7466b5cce4d05dca5b841e089f936b501650913daf54400219629a5b4657b62
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVp6:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax2F\bodxloc.exe
- Size 1.1MB
- SHA256 c2a07c7b15b910c653d42aedcb5d476c16072d9463c3f358482e1a4485b4ae72
- MD5 bddcfd8b8a450271fecd0858fe65d00e
- SHA1 fdd07873371d041ceb1aba7a49e7070174e9a303
- SHA512 3772020868b941a9b3cfab2fc66308ab4ea1d8c04bbfc474c719f32abc4de74dc0f2fcb451b4da190051149c58308d2c6a9462fbaac0ee93f2b9b67cc1807e1d
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblys:sxX7665YxRVplZzSKntlGIs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv4F\devbodec.exe
- Size 709KB
- SHA256 800eebeeeb65f02f0fdcb548cea03b399ca70f6cd8b8460268f5635a2381a42e
- MD5 9d08dc0d4e8baf87fa327de1cffac721
- SHA1 76a44dd8bd4a3d8414d12fbbadb94cce4008e837
- SHA512 13ca10cc1ca734bb3495c0dd1e948aeb367cc67fb7662fd9c792ef7444f6a6048c0bde579955c1511a17d003901f1f72301faea0a6d2fdd9f7edf3445d7a3833
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCchf:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv4F\devbodec.exe
- Size 4KB
- SHA256 bfdcd2c42a3d489e44a0b5657fecb7ffc22d8181a10f4caa3ccc824bb09e0960
- MD5 ed44b9bcbf1b9df92a5949e628ec3378
- SHA1 9fb00c5b9cad48449b08e2469ed9f1e87b8930ff
- SHA512 0efa325bf182f2beccc30edaa181ea9b59f613bd6d813f3dcf4381e4f212b181c4dbec0ef121ed4583ea414a977499d0ff897a090ab97ea66d3c06d8e1ada754
- SSDEEP 24:etGSBiiMk9vY8lp+j+HHHP9LblFN7pVVbrpb7LDnzL:6BMk1Y8lp+j+nlXlnpVZlXHnz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv4F\devbodec.exe
- Size 7KB
- SHA256 b686b642556e0715a8e375b78517a863e25728749bc9e6584d67bc11ae899474
- MD5 fa39c55b8fa4be91bdaefb455788e70d
- SHA1 6cf4d2587e1963dcc330ea748486db119b9ad040
- SHA512 8346ee553ee93c37388162dcb95d229162f034dbc46b19d6a134da070a5f066023b33eb6d89853d972469d65fd2da6c34ff155113ef3d690cfd98e2335ee394c
- SSDEEP 96:3k1Ycg+n1FZlXnzDnznTT3jkHnHO1n9dn9/:0fgezXzDzjUHK9d9/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 173B
- SHA256 c5585c62d5622f6a9d7a07f6f4d0ed76524edf8d6de0b5e7d291169907971243
- MD5 2f294850de3f67ba7d54d887a96b81e1
- SHA1 665569bb9d02581f9761bdf511e147857b469515
- SHA512 e2e498fabcd6c1b88758ebb94a5be096eb17964c7e2efa4572c153f7a6fd7080c98eb0c49a231b00773bbbf3616deab9a8e2755cae5e4a50c7c110c08d029521
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 205B
- SHA256 4ca0cfe0a9bea3c0588d6de89d67278514413fdc89529b9dec0d38f25ad44ff8
- MD5 101745277f2143d678f2749199e14575
- SHA1 e25354ddd8129862d60f5c4cf2f707fb6116af77
- SHA512 a09e710b87f49884e161690aa73641feae2e16dd59fe5349097b7395e63b88e2ed80f55bf11ecf6fa00a02757767a6c96d936d572107eed17dd14e923d7b6176
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 637KB
- SHA256 b582c35e22b4fb4577d6ede6f8e7bcdab9954dc4a8454a079fb19d753626460b
- MD5 fe47f5711a158a42adfe6823f1aeb829
- SHA1 db5d3fa946a744b83f9b1f70fe941f4ee48f9adb
- SHA512 2da4ef3d5753965cf0a59e96eebd31357859013690beff4540ec71b40e7e1476fdcda48d77e8235c6a53a0e9860b903326a256e6557b604793ab8881c4286bb3
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCd:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XR3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 1.5MB
- SHA256 5ace50d2f4ed3171dd43fec616d4ffc2d87ef00dc4ed735fa8e1360268983ab0
- MD5 e6996ce8f6cdb03f907fd1fe14dab339
- SHA1 41036a73988f7492cab14b2192fc4b05be853d4d
- SHA512 e2a4548cc7d94423bed9a3a631384bf2a7adb2a8ad562e7773271861743559d48a14dacda9ba256862821ed7df5c1bb18e4503344ffe1201fb49384a5b80e644
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDD/:sxX7665YxRVplZzSKntlGIiT+HvRdpo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 1.3MB
- SHA256 471addf6c9dd9785066ba99d56c600c5b16dd687222ac2e1fe9f2ee8709932f5
- MD5 8f95823d331b2a3624ad062726c25f03
- SHA1 d174813c71350941cbd0fe637abc6aaace8845d0
- SHA512 3f2b9361501fe1ee7a123bbac6dd4a2aaa82e300f94d6dd821387c068f4993d422316416064b8a1f3d40702618153e8144546f5a8fb1b13a3c2010d5b1155b94
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDW:sxX7665YxRVplZzSKntlGIi2
- MD5 SHA1 SHA512 SSDEEP
- Path \SysDrv4F\devbodec.exe
- Size 65KB
- SHA256 4e2a46a374400fc21540c91eb3e5ab1502f3b6f02768003fc64292e8be038db7
- MD5 e6853732bf0f76611823619d585b9cdc
- SHA1 4144322ee984028b85f473ded480d358d7f40281
- SHA512 36455141d136afe72da10b47727f65d6ae00572b6cfaac35f76b8abdcbcd43c48cd4549524875041988e34ba5aac2eddb11264a7a22e9c760b5ba355d3df0a37
- SSDEEP 1536:ABalOBo1TKFO3n0KkZHqX7+g2lWXQmMc0t:6uOByTKI3n0dZHm7+zsMc+
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 1.0MB
- SHA256 990a993bf933949746cae6d22d34281a3e3df91fe5895f914d58d1f448eb4973
- MD5 f8966372db0337199c1316038f2f69f2
- SHA1 27800b6a6368f0c103656d07b6a64dfd11f8db15
- SHA512 9e7a22bac8a62998cae2b2bae36ae0563c3639437f385b8d68c46bd017969b6c036ffe5eb935d548c881afe406bd76735c557545339391bd6a534fba773cfed7
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtoO:sxX7665YxRVplZzSKntlO
- MD5 SHA1 SHA512 SSDEEP