Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe
- Size 3.0MB
- Sample240603-197b6sbb5v
- SHA256 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8
- MD5 549efc477a2e07c231dc039c2ca23d8c
- SHA1 f720a94f81831e568218210e605abbfc0b963d74
- SHA512 ff9a113325ae53cb4ce97e5f72bf861f7848b201724d501d144a47183d3da6e53d695b2f424a1fee111513241d09f117db58b2ca5289352c9c5b919c12f33d72
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bSqz8b6LNX:sxX7QnxrloE5dpUp1bVz8eLF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe - Executes dropped EXE 2 IoCs
pid Process 3184 ecxbod.exe 2500 devbodec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvZA\\devbodec.exe" 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBRS\\dobasys.exe" 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe 3184 ecxbod.exe 3184 ecxbod.exe 2500 devbodec.exe 2500 devbodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 904 wrote to memory of 3184 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 88 PID 904 wrote to memory of 3184 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 88 PID 904 wrote to memory of 3184 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 88 PID 904 wrote to memory of 2500 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 90 PID 904 wrote to memory of 2500 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 90 PID 904 wrote to memory of 2500 904 63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe"C:\Users\Admin\AppData\Local\Temp\63bb022fd98e54782c67572a85431913b18be3890dc87baa7156678b1b6887d8.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3184
-
-
C:\SysDrvZA\devbodec.exeC:\SysDrvZA\devbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBRS\dobasys.exe
- Size 3.0MB
- SHA256 2ed60fdac3acb7e062e6cb67f6fd8c5e3b095ff455103336d6cfd9c00dfb20bf
- MD5 8116d6775776e972c5a8bfeda5842ba8
- SHA1 061f909d17409c4f1cb3f4f767a6d6ddb4110e09
- SHA512 2ae06851b88ef5c129dc04f0942ba00ef4e704afd7b45088dd739535bcbe5442d0a29d02797dd570d3f301a478f6e570f46d9afcc8f04a9f6e717b1856ce8478
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSqz8b6LNX:sxX7QnxrloE5dpUppbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBRS\dobasys.exe
- Size 3.0MB
- SHA256 7acb538ff88a910c3895f17f97aff155bb583b16520fce251b652c30ad50870d
- MD5 a1e0a2deb5437a938ea5dd9c7e08b25c
- SHA1 0552989d8200bbbef777cd60f27e03f6e4997fdb
- SHA512 b61204df6d8fadabbae71d992f624c943172a284d6128a0b646c4569d3d3eb3a4dec20a340392a608e7352acfefb50e12b3456941cbd1976bb4b1c1e422577a9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bSqz8b6LNX:sxX7QnxrloE5dpUpbbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvZA\devbodec.exe
- Size 3.0MB
- SHA256 65b2eb7fa23ad0270231278837f910443aec178a1a8d2eda9d562cf09b690a16
- MD5 18a0cf50d4fa7793d80c31a05d14f2ed
- SHA1 32cb24cb4e1e95ca87cc4b234e07e6cf5cdd8a84
- SHA512 8c71ac2eaf5be5832a7b4265a437662de108d3bdf65cbf4926f580fa1e709e4871981a6148884db2b240c1c50f4849a813038bdf33d2f2985a246e8261dcee59
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBuB/bSqz8b6LNX:sxX7QnxrloE5dpUpBbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 efe38f473aa22f22a5e1d1733145a68f2848c142efd46b364e25d49069637372
- MD5 6795034521e17a2f6796f978349ab960
- SHA1 fbd63f492878e570bc9a4a71d43d7a41335eab7d
- SHA512 dc6df2f2b2d734f9db0243e64565c9e0e1f7b21010b2bf3b9d38484a7873f858a8d23ebd1c63f45ab90d89366d75b34c41a644a54251098b1c58910c1a32f9c9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 db64473a7ceac689fd9d44f3699392c261ef37cd7d4b39ca027439d45a500aa7
- MD5 0b1cfb10ab2c6d56638d4974b088d9ff
- SHA1 bdce0ae21a6da8cda6b065336584be0a6636cf2c
- SHA512 0f496eebc45f0fc1384f002e6dba21f172d6c5348a6e857c97c634524dbece37539e88235ef34466a313acbb1afba9c642fe3b87d4fc3fac9c40fb09ec6e7b4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe
- Size 3.0MB
- SHA256 732e6519ffd7b271feae50ccef53e1995a14b631d1b7b3d84725d97d5e287b6a
- MD5 917fd1c08bf380cb28c750ec35390475
- SHA1 3a36b724b0362c6b19fa95f80947036bbe35dcaf
- SHA512 934140a9e381710ee30fa11ec1f9968b74663b8ad15c16885ab028898a008b08b2deee1d10a990837f3a20028e51fedc799b722f5570fd1ab65de76caab8fce9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSqz8b6LNX:sxX7QnxrloE5dpUp8bVz8eLF
- MD5 SHA1 SHA512 SSDEEP