Overview

overview

7

Static

static

3

38b6bdb203...24.exe

windows7-x64

7

38b6bdb203...24.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 18:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    38b6bdb203f62e238ea881ebf68ce7a0f0392bd1e4f24ac833336788118cba24.exe

  • Size

    2.7MB

  • MD5

    9582d1056e9446b70745b23e1815749f

  • SHA1

    49b46b339f00c7f5a49ad5154c85da1aaf95713e

  • SHA256

    38b6bdb203f62e238ea881ebf68ce7a0f0392bd1e4f24ac833336788118cba24

  • SHA512

    4a210f2709c748e555a3492f090ca696d69b3042f99cc2db9f541e80e59858542625be4aade09d0152aaf892a9207fcb4ae675de8deea8878f6ff3d96255a2e9

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpg4

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38b6bdb203f62e238ea881ebf68ce7a0f0392bd1e4f24ac833336788118cba24.exe
    "C:\Users\Admin\AppData\Local\Temp\38b6bdb203f62e238ea881ebf68ce7a0f0392bd1e4f24ac833336788118cba24.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin`EttHexe`Vseqmrk`Qmgvswsjx`[mrhs{w`Wxevx$Qiry`Tvskveqw`Wxevxyt`sysxbod.exe
      C:\Users\Admin`EttHexe`Vseqmrk`Qmgvswsjx`[mrhs{w`Wxevx$Qiry`Tvskveqw`Wxevxyt`sysxbod.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig
          4⤵
          • Gathers network information
          PID:2788
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2516
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -a
          4⤵
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:1964
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list
        3⤵
          PID:2672
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list
          3⤵
            PID:1152
        • C:\UserDot99\xdobloc.exe
          C:\UserDot99\xdobloc.exe
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2596

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\LabZFA\bodxec.exe
        Filesize

        2.7MB

        MD5

        5c5537c805b9ec2a792078ec6234d312

        SHA1

        87e846f2670d8049f61ab0ac4afe6a61a86d5018

        SHA256

        b7145e014e2514b12ae09e57dcf580d93d0646078bbc619b1fafa7f9685f6875

        SHA512

        016d6f663101133217f72f037a226275790de9cc22962d462c0f74af61f0d347d22b93ea4c00fcffb78b6e029070b996d1d612c2363b3946cecd8f2a345612de

        Download Submit

      • C:\UserDot99\xdobloc.exe
        Filesize

        2.7MB

        MD5

        0c24a3de6edb4244c6f1435e3aabdb38

        SHA1

        38c57a6220ac5dd7926090b2cc3b07c93d7e4229

        SHA256

        fbf21077143de2dac8493bdbc6e8c8b6c4b2d7a7fd0bcd2628122508315b77a4

        SHA512

        7c257e9b50e4c9640c86986dba45141d769ce5ac42056d8d26d0c4e7819ce30ec5e47810e0c1bc003794e4f3b1792d1bb9503c1bbe2e1c2b163caf03adfa7c34

        Download Submit

      • C:\Users\Admin\253086396416_6.1_Admin.ini
        Filesize

        201B

        MD5

        e32299be4bcfee20755868086e69a975

        SHA1

        283f866dc507b2ea24159a1c468c135f166764d5

        SHA256

        76884e86378958e5285896922f43879a875dc8d1388bcaf51b6d7a13aba745c2

        SHA512

        f91045a21c0682ae9ebe63d6265bb1ea59160825ae3e32482dd547f0e4cbabdaa6083f0d108011ab3147ba46e8d5144d41003b7b9d42053d523de8d71d0cd317

        Download Submit

      • C:\Users\Admin\253086396416_6.1_Admin.ini
        Filesize

        201B

        MD5

        4fa5f5410410d6869cf7288501263e82

        SHA1

        a70b6239e1f5b4a78cc87bf41867edc02d8cef7c

        SHA256

        d1475eefd771e380f207943fc69fdb8486f00302c1be7232936cb2b7b23cf975

        SHA512

        58a61b0dd4f6dd9efe1292c03ec9a4471a51dfef4395b9842e2798e6e58a84a82828d72f3d241dd8f0f4b0da545ae2a3ca261f3488d84a835aa8b48fdfc3e8b5

        Download Submit

      • C:\Users\Admin\grubb.list
        Filesize

        262KB

        MD5

        169f142aaed41bdea32b36e4a3b633eb

        SHA1

        7d4af9c17a555cf05f69db71c5de5b4b7f74dd06

        SHA256

        b54004c59f0cb690d633808fe7dfad3f5e8e9675d441bf270eae4588494ad744

        SHA512

        29eb64db94ff134984075d538d0f83a5eb7a240314579b4ced0816e3a26536a1c3131010846e866853928a3622763f824f3554f0cfe0a4352842e2272846cbaa

        Download Submit

      • C:\Users\Admin`EttHexe`Vseqmrk`Qmgvswsjx`[mrhs{w`Wxevx$Qiry`Tvskveqw`Wxevxyt`sysxbod.exe
        Filesize

        2.7MB

        MD5

        4cb4729e2ce1a2e37b5ede24ee7b19b4

        SHA1

        18da8cf588d0456bb55b6218eb64a84a8ec4e347

        SHA256

        59b16d12f7eb121db399ca4638ab24038d520277cb6c74456192f1dbb77fdaea

        SHA512

        a3b053d14c70da9630a7e9b120c30de4b7e60d0c6459dcb37562e206d61885deccd45f32e804e87d2ece962adbd8a3ca7777b8cd7a8541a5b5badd7ee389fd1c

        Download Submit