Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe
- Size 3.6MB
- Sample240603-1tpgesbd79
- SHA256 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd
- MD5 3d10b78774e161e9fba86df9d62e4e78
- SHA1 fc377f08ee1de762c31b8313e4847633dd872b27
- SHA512 c519d6c1871657dc36ef7851423b722b366299fbf3d8a77c9695ad6ab50b3996223613fb45b5e7f3fadeb6a82273100f144fb0a5d84755a88b9576270e53b7d2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBhB/bSqz8:sxX7QnxrloE5dpUpebVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe - Executes dropped EXE 2 IoCs
pid Process 444 ecxdob.exe 4960 abodec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocJ9\\abodec.exe" 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZB6\\optialoc.exe" 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe 444 ecxdob.exe 444 ecxdob.exe 4960 abodec.exe 4960 abodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3068 wrote to memory of 444 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 88 PID 3068 wrote to memory of 444 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 88 PID 3068 wrote to memory of 444 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 88 PID 3068 wrote to memory of 4960 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 89 PID 3068 wrote to memory of 4960 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 89 PID 3068 wrote to memory of 4960 3068 59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe"C:\Users\Admin\AppData\Local\Temp\59cec334ac8fd59dfef393459a8a352f5ab7541949f09f2753eb1e4ff21ed3fd.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:444
-
-
C:\IntelprocJ9\abodec.exeC:\IntelprocJ9\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocJ9\abodec.exe
- Size 277KB
- SHA256 4f71744ec99d241efa451c07b5c7b2e379995fe588d6d95697823f44673cb0a0
- MD5 b32bbb2ce9938e6d8ad9a5300f03cb5c
- SHA1 c895a9ea51d95fa6832fc29d5b2f65e27cd77c4b
- SHA512 6fb617d905726e796d7fe3e35da235b2debc34ec384cd785e6a1a96ec90939f999f0a9c096f4ebe5a41abfcc35fccee7fbd027bdf020d8dfc819c1cfc632ca95
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNa:6ne3n0DmAm67YEjAyu6qJ/+WS5axBa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocJ9\abodec.exe
- Size 3.6MB
- SHA256 33cae61338374a761c992301ea57b0d708c34b59e0f66b27faecb98ad975d752
- MD5 14cf710a090605a42fc9ea9ca2b5eff3
- SHA1 12bc62a6ec04ea3ae5e069d2b57db66bb18b0a3f
- SHA512 b02ac59aa11359187507649b044ae2de793aa8bed6e7bdfc134ad54f3dadf0eec255f44ee81c1cef5efa4a79b7be51fd0492056acb39312fa5bbec6b0db5430d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBFB/bSqz8:sxX7QnxrloE5dpUpSbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZB6\optialoc.exe
- Size 3.6MB
- SHA256 d7f4fb9377b4aefc68d6ce743efeda3f87f20f1ead4c5fd17b9776a7cfb84e3e
- MD5 8311331b129ef7950eecaf126d0112a6
- SHA1 6f883cba57494c133c8d6c05844f3ea37ad8b0e0
- SHA512 b064deadb069cc5294a181f06d017fd5ccfe5ee3812b032868b44a1b08f59a792917041818c7da2bcf8ac6e2c7cedff56cafcf01139740b20744866f35844a3c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8:sxX7QnxrloE5dpUpJbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZB6\optialoc.exe
- Size 609KB
- SHA256 c18b198a1504daf2f6e6664d2c9b6d097f3f5d092bc2ebd5570767186def320f
- MD5 bf50bb9b0056a36adb221755f4d1d47a
- SHA1 570e8e71ea7ebb482fb4c040525d5742da19afe5
- SHA512 7e2d41a905156b88d329157f5b2e134944b19eef0531c89663bd6f7c19f5b9963d6912afdac96169d2e9d1e1a7247d7023193b208723f48754db360be62bff21
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcy:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 27676e7476e276e5dbee6f6a6c9d6263d3ac099b5cc9883800482ad15f62109f
- MD5 2787b018da4677a85f21d67a731db289
- SHA1 189b717777fc73e8b5e3b5ffde671a340a2bdc81
- SHA512 41d60ddbd9d6e8692099b8b761096097bf6378b7a28b6fff6f2d53af8b6f728a0d1ac8886ce89f08e9bf531eb5e46f21aafc7cfa4f0f0c98eef3612fb1afa59d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 a5d991a1d505fc1cc5d8ca8546567e3ee1a873cb58c1a871f26502f4085294c8
- MD5 95ed6fcf0679cbcc563f17f6a6b6e61f
- SHA1 9e5ebe97da8b945a684395adfa9e79e13e84eb38
- SHA512 8aab381f5bc351fd57b3194136f295c232c3a14457dc4a6a59fcf1293b87b4b719381466f1e7601cdcf3ad6d828f95aa189352bf1057d7326ec57c47c3c40967
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe
- Size 3.6MB
- SHA256 3680f9315be8840445f51741d74720e3ecff56b1bb181f89b5c1c4f032b48098
- MD5 55b06d7aa76f026a8a448a7802e6f69e
- SHA1 d77cfc56898be72667bd57b9c251d39d0b87c5ed
- SHA512 2a1e6d312b2972065368b0042d173740b9afbbc21e32a3f9cff76c9633bdc9a80e9acdaefc24a858ba02ef1b4e0e90b027f152fab2d13e631acb78fece91819f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bSqz8:sxX7QnxrloE5dpUpHbVz8
- MD5 SHA1 SHA512 SSDEEP