Analysis
- max time kernel
150s - max time network
118s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
26/05/2024, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe
- Size 3.9MB
- Sample240526-ea3n2sdf8x
- SHA256 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad
- MD5 0e7f932db4e4ea318eb0d752595f512a
- SHA1 2ceca466f0b2e59b56f7f78c85e38274d2bf4823
- SHA512 8be00b31e293db13c4be9ded828ea246b88b304892603c8d2b4db2474c464c488b6b5e431c1ced98140d602a2bbae0ff236ca92572f28a8b3dcd3388c6bac84e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bSqz8:sxX7QnxrloE5dpUpRbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe - Executes dropped EXE 2 IoCs
pid Process 2156 locdevopti.exe 1596 xbodloc.exe - Loads dropped DLL 2 IoCs
pid Process 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintAH\\bodxloc.exe" dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocZ7\\xbodloc.exe" dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe 2156 locdevopti.exe 1596 xbodloc.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2156 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 28 PID 2200 wrote to memory of 2156 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 28 PID 2200 wrote to memory of 2156 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 28 PID 2200 wrote to memory of 2156 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 28 PID 2200 wrote to memory of 1596 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 29 PID 2200 wrote to memory of 1596 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 29 PID 2200 wrote to memory of 1596 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 29 PID 2200 wrote to memory of 1596 2200 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe"C:\Users\Admin\AppData\Local\Temp\dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2156
-
-
C:\IntelprocZ7\xbodloc.exeC:\IntelprocZ7\xbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocZ7\xbodloc.exe
- Size 3.9MB
- SHA256 dbeb5159ace1bc6acf2cec6a208cecc03ebe91fc2e200d71ac8c762c8a98e6fd
- MD5 b20b2f7be04a121a18425525238ac33d
- SHA1 39f7a24575c65b2588824a81affa66bbaf8fc258
- SHA512 f2853fcd7e8394f9720a213f1e7b35e27e64ec6723b797aa3ca3ec5c7c4550dae9914066a15f7c6fcbfd30b2d6c18ac26cecf60ba4930355d25032bfaa412777
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bSqz8:sxX7QnxrloE5dpUp4bVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintAH\bodxloc.exe
- Size 2.9MB
- SHA256 ad91412889acc90832f51971e6e56d703129f3d4df7b0aa0b256c25d42c7c472
- MD5 1129f3013c1f18f63988e66163854063
- SHA1 c73e3a9ec6a8baf6f6879a2ed7deee0671e5b9c3
- SHA512 6dca368c2076b30b98a125b74478e38da42018d4cf892ac786a8ff3d46a1159d8885f5412c158c37692c3a397b0ac2fad244c55d03b7a4aebd8f515b56dc79fa
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bSqz8:sxX7QnxrloE5dpUpWbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintAH\bodxloc.exe
- Size 3.9MB
- SHA256 21e6686d6627d5c3720d4a30cc8916002faccf366d2476399b8f9aa80df2a714
- MD5 d0216e77b8901ec8f90ae7405d39ce10
- SHA1 1d615962ce9559a034a3bb2cd00b64d326ffcf90
- SHA512 69a83384e78cda174114e9a3d2463b8df7bee2be19eed7401e24ab522afc586c66ddf87b46fced07d5711f8c087df118e81c223ddcc3cf43c8a93d7599004b29
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBGB/bSqz8:sxX7QnxrloE5dpUpdbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 175B
- SHA256 0158cb80e0429d0816cd42dfccd789f20fbfe5e6db1f20af71a594be2966ef3d
- MD5 bbcf972c9ad3314fa0cbe5ba8944ab31
- SHA1 9c0d3ed85f622d539dbbf53d57a848ee056d1eb5
- SHA512 3a8c7306cd405ba55a4618b0352db39480c07139b22859fcbbb4b38cca8a3ddfcee7a566c69d3ea114f7726db7d0a1c1926213e4b98dd622064144f73e16154d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 207B
- SHA256 9bd207c8e3dd854e5ce83e10271bde6a9e1ca1d49a62f63a899be40aeaacb588
- MD5 d6381ce1fd86542c1aebe0d2d25fabba
- SHA1 988fdabd018e7171a214b347274d8c70cf5a04e9
- SHA512 5ffcb605d904c24bc6e7732e9eaea2a17d3e2fc0e5d3c72da8a19dec9e1a3d7eebc3684f9baf87018612647493b58c819b7c8b0bf177573cd5fe18fa374f0e27
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe
- Size 3.9MB
- SHA256 1da5b585fda38d6a4d2f6602cfb9476047982374c2fe28d9185f89e881fcfdb6
- MD5 496c2cb2eedc2e791afaa107543f3b01
- SHA1 c5ae7f9c2a99280ad4df08d16f3fa836f88d7a02
- SHA512 378c792a43b806b2a0f8518fbf8102aa88c7b2f63644da9a183157871e9ff0aa5f04bd5ba03e93421b01c56fba5186e1a8151182b933e8c8ef3ea2f2c91cf6ae
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bSqz8:sxX7QnxrloE5dpUpzbVz8
- MD5 SHA1 SHA512 SSDEEP