Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe
- Size 2.8MB
- Sample240601-ch7xmaeb3s
- SHA256 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4
- MD5 4ab46bc2b7e82ae5cbe8ddb715bc2461
- SHA1 09ef2acba64b9106ea7230793ec44727ac6a92e5
- SHA512 7f79f829c9b665ab9f2818673a131647601da5205591da38ba8ba8841550418821507e21390ebf7143b88655d1d31cd03965c48fd3cd7e107122cb0b84fa74ef
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bSqz8:sxX7QnxrloE5dpUpWbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe - Executes dropped EXE 2 IoCs
pid Process 244 sysxbod.exe 4188 adobsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc8D\\adobsys.exe" b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidGM\\dobxloc.exe" b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe 244 sysxbod.exe 244 sysxbod.exe 4188 adobsys.exe 4188 adobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3008 wrote to memory of 244 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 88 PID 3008 wrote to memory of 244 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 88 PID 3008 wrote to memory of 244 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 88 PID 3008 wrote to memory of 4188 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 90 PID 3008 wrote to memory of 4188 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 90 PID 3008 wrote to memory of 4188 3008 b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe"C:\Users\Admin\AppData\Local\Temp\b2fb7c1155f2344ae9e7864335ab3e1737b489f2234d5be318aba43486eaa3f4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:244
-
-
C:\Intelproc8D\adobsys.exeC:\Intelproc8D\adobsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Intelproc8D\adobsys.exe
- Size 26KB
- SHA256 5413f4323302e1679a11a57735e607bb6ff9d272be4b1c4c1760047c276d331a
- MD5 df281bfeed20966154202479017c5833
- SHA1 4bf02ba05985093e394a2a23df43add0038675b9
- SHA512 a99e6ed87160371c89e4227c2f969aede9f83aa0e79fc383e7ec10c798f9bcbda8c8724403693b72590bdd31c583835bb832da6dc5552d02abbd633c705ca590
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/7TJRKahcO8oRZjqOy:xezkk/DUj7TlODVED17nKFO3nqp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Intelproc8D\adobsys.exe
- Size 2.8MB
- SHA256 1821d128618e57d0c74c7dcabaea7fec7007c023df86babf40cb06170681fbc2
- MD5 ef1e871b3f7e960d042dd7a696b764b6
- SHA1 73b6f04a9dbb06f479b385b1966257a88830b2f2
- SHA512 b033198ffe6319bbfd0897117e61cf5ed932458b1a88e722f70017a1d31b8e55d7b11bd8f0c4392ba93a0843dc5012139a4bd7a01c4962117c0f5bebb26c5c21
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bSqz8:sxX7QnxrloE5dpUp9bVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 e65828309136e62e4925d40a233b6bde509cf5039c4888d716b4770b733364d0
- MD5 22765bef472385b1bbc4f63a2832b384
- SHA1 e22ad9d1f465807389f4673c0dc5a1fbd086e6c1
- SHA512 435affbd86f9789bd500303d72c3171f7faf1582465de005ade569282c60e437a98448169c3f8039c66155e032f7e5fa421676b3d030519344f34cdc6cbd149d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 635db31270a66974bcdbced1672c23882a98c6581d58cdf5004bcfb8e7722746
- MD5 d9511d47bdcfff07646b68fe3865cd28
- SHA1 e25ee7848e04aa4363e4c765535c549653a0fc94
- SHA512 4009028877f39187ac5a42465285ee5a71c3f5d0238bfdf37b7c9dcb71c05531792212956944ced3d5f2b37425a48ac9266b14dc0f713e30c7689c29d8f11e06
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe
- Size 2.8MB
- SHA256 c55da6cf3ece27a66f5291f598ae6df4528362e5bd5c04c44f3e549ffb3944ad
- MD5 7660dc91f75f6328b337a543bc2ca5a0
- SHA1 b77f79c5478d76ed979e81efb7b339c3e192aabc
- SHA512 f2c8c60aa141482f4a8724132fc57c71ce69547590a2d513bde96e702b9cd906e753c748ad65982f3fb429110950288a139864800a3e50d46b7353de85a48848
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bSqz8:sxX7QnxrloE5dpUphbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidGM\dobxloc.exe
- Size 315KB
- SHA256 bb0c2e66b816aa8d8b5d3be885824cf1de8135434684977b680d07b596f40c28
- MD5 a5f5abe78aea816256f1a9c58d2d67d8
- SHA1 daf3591b038d8c6dd42c9337374100c7a612e917
- SHA512 ae2f8567cc511e9651c44bab0676603f918da71bb07d91f9ffd6bd474213823187d7a4b601509d172ca67ad5a5db265e53bc0a779d35cfea42e99d4ae2245eb1
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7UqpS:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidGM\dobxloc.exe
- Size 2.8MB
- SHA256 130dbc4a28e3f94a3d5a0e75e22e83a7628ba63b5d94651115b68621ee8cb707
- MD5 f6cca2b6d39f230d2c747bf7c79f5e4e
- SHA1 fc049f423ffb915f9c2804d8cfb7ed47b6ee5a30
- SHA512 dc34be34a58e3783bb412d4051b26f87634e2687a4e28d4d7aaeb03d2f7e8dbc354ccc7c5221f6db14002f4779011eca22527ba41e47b40ba83abf27dedc4d8c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bSqz8:sxX7QnxrloE5dpUpBbVz8
- MD5 SHA1 SHA512 SSDEEP