Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 19:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe
- Size 3.1MB
- Sample240603-xranpsfc6s
- SHA256 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8
- MD5 a262c0d60515084c84b8067961ef302e
- SHA1 eaff791d69b79a0d90f5f265835be8e5b4eb48d3
- SHA512 4ad4b8e11b81d9bf036f6139dfda489342032e958b4110bce50889cd0aae5f2f901adf15bcba007f66eb072cabab939263594e10c91b240c5a549513147b5aea
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSqz8:sxX7QnxrloE5dpUpzbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe - Executes dropped EXE 2 IoCs
pid Process 976 ecadob.exe 3600 xdobsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocNP\\xdobsys.exe" 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBX1\\bodxsys.exe" 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe 976 ecadob.exe 976 ecadob.exe 3600 xdobsys.exe 3600 xdobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1436 wrote to memory of 976 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 85 PID 1436 wrote to memory of 976 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 85 PID 1436 wrote to memory of 976 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 85 PID 1436 wrote to memory of 3600 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 88 PID 1436 wrote to memory of 3600 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 88 PID 1436 wrote to memory of 3600 1436 18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe"C:\Users\Admin\AppData\Local\Temp\18170021e620efc0f345d16ba650c57d52800b24cf8fdc8e36f14a1ca0924cb8.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:976
-
-
C:\IntelprocNP\xdobsys.exeC:\IntelprocNP\xdobsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocNP\xdobsys.exe
- Size 824KB
- SHA256 fdee0b47e72983f97fc4c7ebe4b3576305e6b6c303b26e73b736b7ac4cbb2f14
- MD5 2a3ea482f4e6d0ec5f2660dc4fcbec36
- SHA1 dfc2170cc3051babb115bf9ad3c14b809395389d
- SHA512 55e03b160c275b150e4c8f9e06440313034882354cdf27427131b1d65f261bb419e9a22e716423d737c470f1181d3cb30c7fd1597ee3edc93608b481656ad3a7
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RG:sxX7665YxRVplZA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocNP\xdobsys.exe
- Size 3.1MB
- SHA256 afc629b5ce722be8723fc8bc225d494f56beb39f5c158c5e9dcbaf2796237fe6
- MD5 28447d7051652948a425da38d0a625ba
- SHA1 316da734ac93049a91576558426d7534e879f2b6
- SHA512 f926396d41cca0206b76c56aac84dacfca6dc38960d174c306828264101c3375e5b09382c313b1431ed8461f1c2ec7c0fa09b8e1fa6e8c361cd5dbaa75973be0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bSqz8:sxX7QnxrloE5dpUpIbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBX1\bodxsys.exe
- Size 3.1MB
- SHA256 919e4f01bd4f47ae67e4f8667bcc35eaea8b2e9215393e905cad6c36acefc245
- MD5 5ed1a8bfdd62c1705770c5107e5f7c17
- SHA1 a6b9ebb39c24885f81fbe97deb2957def773c56d
- SHA512 b5d87a78f6176f0c10a805b29a57e004a3b08961f79670d80f80adcc938193b3aa887c45fdeeb9ff52a162a3c2e27e973526457ea0fcc343fa754b08f6074625
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bSqz8:sxX7QnxrloE5dpUpHbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBX1\bodxsys.exe
- Size 3.1MB
- SHA256 d3344f025de4cb6edd924ef0c28188fe3dd7ef13b2a58bfa417e1bbdf9fbd039
- MD5 989f325fdc6be2987a10a3f195c16c66
- SHA1 fa3c957d3ef34279bba86d53e895bf3ba140d012
- SHA512 020971b514572f25397bbe4705ae58754d7495091eea6f810a24c8730dc7a40180e72b254060135e7dc8ba9c4fdb8cfbe8d93b8b4c459f78b9f2c92690dd55ba
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSqz8:sxX7QnxrloE5dpUpSbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 04b2fe2e184c1eca3e2eb375672b0c0d350c71174c0f0ba61aea48ca481a2cd6
- MD5 fdfcb5ed6d251ee600101b607b960dc6
- SHA1 c5bfdca61285d1e04a2dee3e515adc8df7be1cf9
- SHA512 b542cdda835dc7f4a69421a00117d0d9c477ca321cc1f2c6420b1a2a3174b29721f0e64d129fd5168c528a7e35130fc914d8fe2268ef0934eccb68499f80f32b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 0b2abc9d540b400a19ba2974871ce276d5961040f21160b574d387e4dacb58b3
- MD5 17de114a126a49f22d7cc74ce7834782
- SHA1 20c963f45bbaee792ded334d8f7ce24e35cb4978
- SHA512 a29f1ae5bf5d8fbe8e30e6c5708d7c689349ad72169aa7ad53b79be4e18fa57ac8425d19960ae666c327ff585a7527e704c5c4f5ba279e18dbbdbb656ef31760
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 3.1MB
- SHA256 3ea9885337a932f679b1ab85e8b6240529e4411ad06ec169c40413e34af7ba86
- MD5 1382cb01ace0f62e3040e44123c5c32b
- SHA1 fbfe439f6f37f95c56280b5da5b942eb27353232
- SHA512 86e979d0c342fd92b99c5f34a240aaad64e3872c4c13e1bfcb1212022957ac5798f3c2bd0c9339f2824992af4cba9ff9e38d3c02348f39b5cfa5201a7075b2c4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bSqz8:sxX7QnxrloE5dpUpNbVz8
- MD5 SHA1 SHA512 SSDEEP