Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2024, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe
- Size 4.0MB
- Sample240507-cav8vsgb44
- SHA256 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6
- MD5 0dd7492e7ee9c98fdaf03f7cec0e4015
- SHA1 f1d7aed2495018bd3be78c1fcc4f7558890d97c0
- SHA512 f6d4c08251c7c9717c6ad03d395dff6f38d653998186c8f9b6cfcc2e5743638708df1468f76939a424976531a41745899d5e54828119b80b395d8da7c2e22e8c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp8bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe - Executes dropped EXE 2 IoCs
pid Process 1408 ecdevdob.exe 4856 abodec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesJO\\abodec.exe" d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZY4\\bodasys.exe" d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe 1408 ecdevdob.exe 1408 ecdevdob.exe 4856 abodec.exe 4856 abodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4412 wrote to memory of 1408 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 92 PID 4412 wrote to memory of 1408 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 92 PID 4412 wrote to memory of 1408 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 92 PID 4412 wrote to memory of 4856 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 95 PID 4412 wrote to memory of 4856 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 95 PID 4412 wrote to memory of 4856 4412 d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe"C:\Users\Admin\AppData\Local\Temp\d84854c4efe1568b86c353b801cb377183501dbbd732805c56bbfde83000a5e6.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1408
-
-
C:\FilesJO\abodec.exeC:\FilesJO\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesJO\abodec.exe
- Size 4.0MB
- SHA256 417137f73ccef5d55bddd399ce45a03bccf925b903988351c9e038f1ccec2ded
- MD5 878bacb29210fa282e179ab48e6cdf83
- SHA1 7999d7db0ec189118d41c8afdd96e3dec6a35605
- SHA512 10e0f24e45ad3f7eefd2097f3128b65c7099261fd2f3fa1fde2f445767896c6bed3150f2b836bba5472fc5f487cb5ca0be7209bfeb47a802d13b143c918b87b9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBkB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpTbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZY4\bodasys.exe
- Size 4.0MB
- SHA256 edc009b2bb151ad19e3174113ddc27f4f3250fb622539b60a21cdb81d5a78625
- MD5 0d5f0f70b3b3f12633d2679880c163b3
- SHA1 fe64a7cdd5edad4e0060247284e61b9b3eca0028
- SHA512 e7e432baa432cb5ffa80165f6e5364e5871a0f9d40ecfae3b00922280889f002a8c46512bc7dd8641715831124ae435fb6751fa3200872cd361b9425b80df96a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBTB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpEbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZY4\bodasys.exe
- Size 108KB
- SHA256 4468ab84670d2d1f1ef1345571ca92da2eccb7e97b84fbf6eba1fe50f5b8174d
- MD5 194d6a8580113088ee1cb16ce995b7eb
- SHA1 82be3c34f30529bdf2e6b39f0c449d1962a96e53
- SHA512 17a671fc890ce788cf6326eca6d2c6134cdfef5342edb6d44b21d1061f179172855d2fb3c96795e8995d482391519bd1edf26eb5cbefdca064cce1a39ab94edd
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vy:6nyJ3n0Dm7+zm6wr6YEjAy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 200B
- SHA256 5b3aff7d1876424bbb00f3566e4f8ef63bbf0de41dcd7103de049189daa76f5c
- MD5 cca283e70a7f1606eef243196813e37e
- SHA1 156b3661b6a7a76a18db6aa571d8feaebaf49112
- SHA512 b2e0d5b9629ecf24b7c9e4f09afe834f7c46da0e6d22bb650c5d650030715e9095a174a48a9954c24459ece289d33b899793517029da6a67cd4315027513bca6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 168B
- SHA256 6183499a5b18440d344315ac083be7990389828fe2965cf2e583647485d7afca
- MD5 da23b1aa7237d6486694476b3a556be6
- SHA1 0004508aae157e1445b6fa9347a55e25ccd21656
- SHA512 9b7db598240559440e2852c4b648e09848e320225e4568943109f335ff3d3f43754b56b1f7f19e8797326c2beba3fa11d899b776b319116d243d5744cea743d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe
- Size 4.0MB
- SHA256 368b8de96ace235b30c5a7896b3d5a8db38a5561dfcb37a816deb896a072069f
- MD5 001ad2730c012b35640850dcac5209a4
- SHA1 c4837ef7ba42e03498c0a1cdd97f81cd86bfbe46
- SHA512 561c72bd9c40f5cf12af7258cc20dfcc499b8e9e403bb10769a646d794c2c24817ada7fe7c422439dde6110884cb03a94380615e6473e3d6bc625f9779a3c8ad
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpnbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP