dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
Size 2.7MB
Sample240526-ebct1sdf9s
SHA256 dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27
MD5 1c73a6b1b6f4c33bdbded9eaf8f5922e
SHA1 d28e9a417d9ca752aefb6bc1b4b4d43d6a224627
SHA512 8cfc59082db2e6e7a56d2d55146f25f77beaa8624d205e77915e6430622dc38a68fd47da7d2138d626214748308d21fbc7eee034728d751646679dc6fc290507
SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBq9w4Sx:+R0pI/IQlUoMPdmpSps4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	ecadob.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe

Executes dropped EXE 2 IoCs

pid	Process
3116	ecadob.exe
4556	xdobec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZYZ\\optidevsys.exe"	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotMO\\xdobec.exe"	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3520	NETSTAT.EXE
716	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
3116	ecadob.exe
3116	ecadob.exe
4556	xdobec.exe
4556	xdobec.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	NETSTAT.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3116	2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe	88
PID 2128 wrote to memory of 3116	2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe	88
PID 2128 wrote to memory of 3116	2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe	88
PID 2128 wrote to memory of 4556	2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe	92
PID 2128 wrote to memory of 4556	2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe	92
PID 2128 wrote to memory of 4556	2128	dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe	92
PID 3116 wrote to memory of 3532	3116	ecadob.exe	102
PID 3116 wrote to memory of 3532	3116	ecadob.exe	102
PID 3116 wrote to memory of 3532	3116	ecadob.exe	102
PID 3116 wrote to memory of 2112	3116	ecadob.exe	104
PID 3116 wrote to memory of 2112	3116	ecadob.exe	104
PID 3116 wrote to memory of 2112	3116	ecadob.exe	104
PID 3116 wrote to memory of 3756	3116	ecadob.exe	105
PID 3116 wrote to memory of 3756	3116	ecadob.exe	105
PID 3116 wrote to memory of 3756	3116	ecadob.exe	105
PID 3532 wrote to memory of 716	3532	cmd.exe	108
PID 3532 wrote to memory of 716	3532	cmd.exe	108
PID 3532 wrote to memory of 716	3532	cmd.exe	108
PID 2112 wrote to memory of 3520	2112	cmd.exe	109
PID 2112 wrote to memory of 3520	2112	cmd.exe	109
PID 2112 wrote to memory of 3520	2112	cmd.exe	109
PID 3116 wrote to memory of 3264	3116	ecadob.exe	116
PID 3116 wrote to memory of 3264	3116	ecadob.exe	116
PID 3116 wrote to memory of 3264	3116	ecadob.exe	116

C:\Users\Admin\AppData\Local\Temp\dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe
"C:\Users\Admin\AppData\Local\Temp\dc1bc516d598804e9750430c12bc59aff28eb5020c8574f24fba72ba48aedf27.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -a
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list
    3⤵
    PID:3264
- C:\UserDotMO\xdobec.exe
  C:\UserDotMO\xdobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

optidevsys.exe

Path C:\LabZYZ\optidevsys.exe
Size 1.0MB
SHA256 e85f6135fa783b0231cd9a79c85d5f4de29caedaab59e37e4cf05191b404aa4f
MD5 5eb35994a7aa036350bf36b5f3fd1682
SHA1 2c2c96de3ed06e3fbc063f9bf4b487b45df7138a
SHA512 6aee6d66e44323436cf5126025acee471eb329224acd2f233eed76751cdd37b89caac97eb9b9e67df856fe7b0ac63d9ba6be7be0b872c68412d6445ea093197f
SSDEEP 24576:+RjQgSjgCf8xC78xmlVaXPATazr4eoDlqWtGNB6pel6Mf7nGry0QzMiITu:+R0p8xHycIq+GI27nGroMPTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

optidevsys.exe

Path C:\LabZYZ\optidevsys.exe
Size 2.7MB
SHA256 adacdc10ae856db883a27dbd3743a9c89502095d45199ca99f115cff75e2aaf6
MD5 fb4bd73ab556c6ac8b5bfd627ad46dc9
SHA1 1bbf900f0e51877fe0c2251463706939a749651d
SHA512 2146728e7629e0eb099dfce91a499f4d8df181df763da243144e0bf35bbaf7a29d24bab6672c2e22f5046117445d44152e534e9ddfb677599aa8e63ece2ede92
SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB19w4Sx:+R0pI/IQlUoMPdmpSpx4
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdobec.exe

Path C:\UserDotMO\xdobec.exe
Size 2.7MB
SHA256 12f6c4aa89d02d94509c9b352d851256ef14789f874ba49c6d0cce786341dd4c
MD5 cef121451d0f82cb047dafe2bf340741
SHA1 087205a27a7af05c1f30a4d8e130d19cd92fd5bb
SHA512 a8633c12c0d5bac9e52b8fcd559049c4bdbfe1f8b148a0bb0959c00739259c23d92bc96d22c8b3f8a50b02c05ede2c090d7bd07bfcd838da11d8180526248b0c
SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBb9w4Sx:+R0pI/IQlUoMPdmpSpb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

253086396416_10.0_Admin.ini

Path C:\Users\Admin\253086396416_10.0_Admin.ini
Size 203B
SHA256 702b281791a9a0064a7cfe805fed545dfa72f11354a730aad2fe06b9432769c2
MD5 d27ffe36bf42fe51856382250f56e646
SHA1 65cedce57a5e24e12d51e0d07cc9aff12b2bdea4
SHA512 d039edf07d2e437230baca0dca4cf7f9f0c32f3692593f688a2190bb4d0a10ee7915e27bd094fe9a4d0a9b0e7329a15f47763102d02b12e128a85f66ba48d49b
MD5 SHA1 SHA512

Submit Download

253086396416_10.0_Admin.ini

Path C:\Users\Admin\253086396416_10.0_Admin.ini
Size 203B
SHA256 dc06efaa785233963d999086aedeebc928ea1cd83f7c22d948206add1a4eeb09
MD5 fa641b5f000687c318846d992dabef05
SHA1 03239f069a80c89554282e52d3c002a3545bfb9c
SHA512 bfa3bc9bc138cdde97bac722f987a92d2b05e6a44a4b2cebd025168670e35474921133f53aaaf5803762632d0f9cca41dae54293df2483f7447794c76d609356
MD5 SHA1 SHA512

Submit Download

ecadob.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
Size 2.7MB
SHA256 794573842f2db4cd032644eec1251773cb442243641c5869a8b7dbea59ca2d8d
MD5 5577bf373cd8633d8fb1318837ae7180
SHA1 5e0a9d40604cf3a90a8b0c4950fd73a225a7800e
SHA512 3e9e37607bfba6c8cac43b87aee115da139cb21d9ae0e9634f151c9282531d88a60bdcb4352eb82d31bcfe9f9feacd55ec3b40edf9f9251c327b7873a52e99ff
SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB/9w4Sx:+R0pI/IQlUoMPdmpSpL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

grubb.list

Path C:\Users\Admin\grubb.list
Size 40KB
SHA256 b62887c913a4d76017e281905e89774af22761adca77506b1949b8f23154c8ba
MD5 218905650bb57cab81ae2b14a4d7baf7
SHA1 1a008da6cec936e3d071b855d64a6f7da1099091
SHA512 9596eabbcab4dcecdb2d0bdd17d150fd38c949961fd04620ba2bb326cde60341c1b5bc078a148ad136d9eefd2c6e701a49b969f303ea56b5f8627035f583bca6
SSDEEP 384:o6/XOYA6Zt/nv1Mn0Zolo6LvxadWoRGPslqjA6UdhF:o6/XTtH6LvmD
MD5 SHA1 SHA512 SSDEEP

Submit Download