Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe
- Size 3.9MB
- Sample240526-ea3n2sdf8x
- SHA256 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad
- MD5 0e7f932db4e4ea318eb0d752595f512a
- SHA1 2ceca466f0b2e59b56f7f78c85e38274d2bf4823
- SHA512 8be00b31e293db13c4be9ded828ea246b88b304892603c8d2b4db2474c464c488b6b5e431c1ced98140d602a2bbae0ff236ca92572f28a8b3dcd3388c6bac84e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bSqz8:sxX7QnxrloE5dpUpRbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe - Executes dropped EXE 2 IoCs
pid Process 2696 sysdevopti.exe 2020 xdobec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotMG\\xdobec.exe" dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintET\\bodxloc.exe" dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe 2696 sysdevopti.exe 2696 sysdevopti.exe 2020 xdobec.exe 2020 xdobec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2696 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 91 PID 1616 wrote to memory of 2696 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 91 PID 1616 wrote to memory of 2696 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 91 PID 1616 wrote to memory of 2020 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 94 PID 1616 wrote to memory of 2020 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 94 PID 1616 wrote to memory of 2020 1616 dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe"C:\Users\Admin\AppData\Local\Temp\dbfbbea84b0da045752e33d6ce9a1bced8c08da67b3a652329011a84ee854aad.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2696
-
-
C:\UserDotMG\xdobec.exeC:\UserDotMG\xdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintET\bodxloc.exe
- Size 3.9MB
- SHA256 0fcd88e02d6d684b291e3ec66a41115ab8df2f33551cf756d4cacb43aaa697f8
- MD5 20fcf9070c61455f8e679864568fd174
- SHA1 bced69871292f06168c9c2edecb887f7962d02fb
- SHA512 3bae2a7693e4456a1cb7c8e8a36a7aba1b4991b8603db04169fb1367bf117aa49737e3eb8288033620d668b4364df8c6d063744213c844657751a2d4f511cc66
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8:sxX7QnxrloE5dpUpgbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintET\bodxloc.exe
- Size 3.9MB
- SHA256 9622b2db44433dfe096b001ae2e20aeccccc3346974e8f47f0a5e4a89bd892fd
- MD5 b74bbb90da929ed3aa61705c1009aba0
- SHA1 3be6a617ccdd6df9b501b84c36b3b02d65af702a
- SHA512 2b3ed05a69874b491e433969525859163678c0a1226d431022f917b38c3776d150100c1dbc1fe6944e2a71a490da4266be39e98e6fb48b3bcbdba6c4e351def7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bSqz8:sxX7QnxrloE5dpUpZbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotMG\xdobec.exe
- Size 3.9MB
- SHA256 fa4aaaa807c1b4b302c8a45ff9d88999c47be493ae50661d931676004de80e5b
- MD5 d94164064d2873c5660ff3b97f4fc701
- SHA1 1057aa4a869fc3a10a6919c143110d2fa92e93de
- SHA512 728a92aa04081caed999578984885b7f75d509a87c81aaa1207e2abe3a6103f2f1f81ef9a59a756138dd2c4e18207d65a9ab2db8e4fa307ada46f9b25c15f277
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bSqz8:sxX7QnxrloE5dpUpsbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 526551d8c25ab18b104ab300afcd23dad6210c6519c91fc94019c07c96cdad0d
- MD5 0cf1a9445465ef7c5b5379c8a0d3bfe2
- SHA1 549a24f5dad9ce43a35f8cded6a98dc9fa2fa38e
- SHA512 d6ea4109dbaa500a9b8d1f6c733d3b9f0b87927eb1c5dd3233c108c68a5e1831d3bd2bdbaf7b4848329d67282c31c6f98d3e2df9f5830b5f6edfb95a0faa024e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 9b7e76d8363ff82ab47a74669d654c2c032b2253cd5dfc6c3d526f407b599d9a
- MD5 31da296a5109e6e8250d153c57cd94ca
- SHA1 5a5ae3ba4ce15e07a0ec934092c6d4251fb864b8
- SHA512 bc709351b86151b1b856e36c708ef7c7aa2eaeeb2ace547aa394cffa455123001464491038e1fc8e05c0db3ae611ef32db2adec3223404b25de3ed1fc31cc48f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe
- Size 3.9MB
- SHA256 023f4907344700701558d3a2c591daf1b200f78ef975466291085d999bbca415
- MD5 9162f70f7f6ec227b5d10d60796bd7ed
- SHA1 0ef99fdaaa8abee3df6d73c429ffaf46b50a5073
- SHA512 5620f91d8572df6aaa6447581acc6490609847601298dcb69be9880c957bf41f188fbb56b0be9bca5bf20d8e179a91c8bd62654c1922450463ad81976459b9b1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBFB/bSqz8:sxX7QnxrloE5dpUpqbVz8
- MD5 SHA1 SHA512 SSDEEP