Analysis
- max time kernel
149s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe
- Size 3.0MB
- Sample240603-2f9e4scc97
- SHA256 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335
- MD5 6f930a2c3adfffcc1b9d52ba36261b43
- SHA1 0bec07812b9415c41c0284f7a0f274d28d2365f7
- SHA512 1f15e1c6c60f1bf2475923cbc7b8bac0ed684ae0690860d0cb76f3c2990694d5742cba2721e331b5ce29d06bf2e5e10c1f986cf1137d7d675aad19e745a841a0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bSqz8b6LNX:sxX7QnxrloE5dpUp3bVz8eLF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe - Executes dropped EXE 2 IoCs
pid Process 5104 locdevopti.exe 2616 adobloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZLI\\dobdevec.exe" 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeUD\\adobloc.exe" 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe 5104 locdevopti.exe 5104 locdevopti.exe 2616 adobloc.exe 2616 adobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4980 wrote to memory of 5104 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 89 PID 4980 wrote to memory of 5104 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 89 PID 4980 wrote to memory of 5104 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 89 PID 4980 wrote to memory of 2616 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 91 PID 4980 wrote to memory of 2616 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 91 PID 4980 wrote to memory of 2616 4980 67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe"C:\Users\Admin\AppData\Local\Temp\67d089ddb48f1509394e493929e393ad9890a700a1f32c2951745c5f0e09a335.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\AdobeUD\adobloc.exeC:\AdobeUD\adobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeUD\adobloc.exe
- Size 3.0MB
- SHA256 4753b837462540bf0beb4a33832499cbd057fb853649e9a683b0a9dbcea66adf
- MD5 0d51c3fdf9d865088ca73cb9141cacec
- SHA1 1c03589ddebfed1bc8b81fd88bd224fa089d6ad5
- SHA512 d5fc857056cd58163bbb38f792fc6d84a9b57377aa1339a2442d3ec7579194df0375e3ce6209c084c1c5a712b33463609f1154ac9e2216eeac92d5c5de487995
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bSqz8b6LNX:sxX7QnxrloE5dpUpXbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZLI\dobdevec.exe
- Size 3.0MB
- SHA256 d2203d965943614c37055df0a40c9106b2c724b43b5021fca8df83052ec96ec6
- MD5 c6f45b7a13c6d3dc75393e9b5e92b484
- SHA1 5a928c31caba27c068590dddb0a124290b728fd6
- SHA512 726cfe8c1b6ff9cb93891582ff18dc5e682cc882d71027c38882bbac5fdca4b37d3ba5e4b65b37089bbf6e9a37187b66e8c6a4970a1178a40c41336b5210377d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bSqz8b6LNX:sxX7QnxrloE5dpUp5bVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZLI\dobdevec.exe
- Size 3.0MB
- SHA256 f3defc66f4fab5b468c2603167f2f54d81958b71f11c2d8e7ea48b4b1de82ad5
- MD5 d953abef56ad15dc18c2a35c219e8190
- SHA1 301f00296b7317829e10d8f3f2bfa3feced2d367
- SHA512 0689c860b8a0be125306e9928900a66cbf18245946a58e19dedb202ea695f6c2bc0869e61493b6454a79addfbc2f1d96e6332a6fdd91a06b16dc37ff623d2c55
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQB/bSqz8b6LNX:sxX7QnxrloE5dpUp/bVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 728c09d69a0ff43fdba23261fbe1b7f01b344f80447a37f6ea070a62dbe68ac9
- MD5 c540f902b11c348de3b67a0b8393b174
- SHA1 51c799289bf6e17dfbaf8fa267e8b8fe6755a203
- SHA512 e6084e47435b30f5d01438fe73fe6f5121597e1d25ef7c0df625e63cfa709db9e6ee960d1ab5ffa18e5e387e4373c87610c0bd6b2a219ea3d9938ac7beb1a981
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 460450cd18fe9937d60e5525b1733ede754fec2788164159c360a05b8ddb7e9e
- MD5 0d82f4fe0aa7166853d6bdc3748e29bf
- SHA1 021789fe1b5acf661dbf9c7d722450e990248f2c
- SHA512 8dd6cc7027fabc4553e8258b4128f2f569bc2050f62779d7fd1d88e34d991919d27019cf63a3529846303f8cd3618a3280f2b464017aae338350d475c487a54f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe
- Size 3.0MB
- SHA256 372f99d80df751a106e2fc021779c93d12180aa84b6db5d979c2d02245452ff8
- MD5 c3622e24374d1856c2e064cae0e0c681
- SHA1 6f00323d83b90985ac3840e65d5228a4b7b5c46f
- SHA512 66f6c52984e81263dd9a18d11925ae2ae5d4daa11304bbf4f315ce65418bb4a9a3d74d61e59fe5e6494b8c13d75479ca9da842a3e366dd9928baa724e8fe1bc6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBpB/bSqz8b6LNX:sxX7QnxrloE5dpUp2bVz8eLF
- MD5 SHA1 SHA512 SSDEEP