Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 00:16
Static task
static1
Behavioral task
behavioral1
Sample
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe
Resource
win10v2004-20240508-en
General
-
Target
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe
-
Size
3.2MB
-
MD5
101bf38e1feb37972931495c5944a871
-
SHA1
0e8d5d211d5e772899a73af292879be003979620
-
SHA256
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540
-
SHA512
dd214a0eaa868e860cdadf465d6957e61f693e351682f5090a6c89f9e2d3621bf3d930ca279294346ca47460690c36b2dbddf3422f9c9de5c80a76e16a5032c7
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpkbVz8eLFcz
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe -
Executes dropped EXE 2 IoCs
Processes:
locdevbod.exeabodec.exepid process 2396 locdevbod.exe 2776 abodec.exe -
Loads dropped DLL 2 IoCs
Processes:
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exepid process 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesDL\\abodec.exe" 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBHE\\bodaec.exe" 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exelocdevbod.exeabodec.exepid process 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe 2396 locdevbod.exe 2776 abodec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exedescription pid process target process PID 2792 wrote to memory of 2396 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe locdevbod.exe PID 2792 wrote to memory of 2396 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe locdevbod.exe PID 2792 wrote to memory of 2396 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe locdevbod.exe PID 2792 wrote to memory of 2396 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe locdevbod.exe PID 2792 wrote to memory of 2776 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe abodec.exe PID 2792 wrote to memory of 2776 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe abodec.exe PID 2792 wrote to memory of 2776 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe abodec.exe PID 2792 wrote to memory of 2776 2792 92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe abodec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe"C:\Users\Admin\AppData\Local\Temp\92703c317d1db2da3952bad50a09d9b6417ecb357a2e9dde52b22b5d3ed3b540.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\FilesDL\abodec.exeC:\FilesDL\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD58858df96e6548a27423d10a0f193afd6
SHA13dc5dfa28fd5f6844f3a66cb043b43b6127e72de
SHA256c2c5958ecea38409923c98dc722ef1bc491e1489687e69f8705f7261b8fedb63
SHA512a0b9155854907e7aecd9ef2565b2a5d2e7ad3bfa06a7a400aed2976961a5c71feffbc71258665443cceccc187396eccfea2ebbefbcc33285a832936d9015b510
-
Filesize
1.4MB
MD51803b2adc5be774fb431c33a5eb8743f
SHA1be5637b16deb89e3964a2f7bde7d0fd632e95ca7
SHA2567cb7f2ec92a8aa5eafa1bb9d358efce628715689e3be5758f213e4673d3e8e4a
SHA5127dc738b91ac81dba9a8450183ea746cad8fe9ba27351cf4aac01e9483c468d3f82243d23eadb66c06865e1476a6ba76da4e34261ffd24854a16001437cf8b358
-
Filesize
3.2MB
MD5bfb926bf00e893793307cf8355a87908
SHA1b4155cb9acfc66009ffa6a64c47d01588df7f346
SHA256b9b78aa09500939dde85c3c376fcfa47805073bc3cfef119f2613c97344f724e
SHA512cad23633ad9bad74e544227ea25d4c4989fe356b60e70e64ebabf7a8d20c1129470df72c5feb58a279acce72f0f5e815f52aba603d4ae79ee3350c6e509a8436
-
Filesize
168B
MD5e7f0ebbf0f1a022ed50b7990eccba830
SHA12405303823f01990616b3458c7b8d2682632fa0c
SHA256b8c6dd63b8140c096c67e9cbd83be9f1abbe4c921e6ae153516244a2b2c17ff5
SHA512f6d0fbbdfafc81376619d319f36779599a09d98db6ddc0870a1d4934a2cc7e38aa85023d91181c61821dbee25585cfb40ff19ae77f8481bb2c69fc0683014a2d
-
Filesize
200B
MD53a60189ee50a8544ccae5472fd8fc41e
SHA1ca05c3a9b46972c2eb04afb7c405c3f2b3b21785
SHA25604145af03ef5057778a3f84710600021841b7418aea8927e1254de0097e893de
SHA512bade3d6c7def7d43798dac78c0e993ebda00382288776910673716535370b24c919c0e9bae4dd5ced282489b43e74c6818ac3c6c11870e61b8612a4832f310c4
-
Filesize
3.2MB
MD5d100293f81bda9a9b45c199c94b2cce1
SHA13f58321fc6929b18ad98e7de03a39d17e23b9175
SHA2561375a5da0041f1c3c69ed9f2c94cc428359af24c17d18cf056feefb9bc506526
SHA5126fe7cdd43eb38d13a5c477c1c487c2a6d3ec3e6f3c77c2a2456055868d06fa07cbf1d1d01592e12d648da28add80a5134d5da4a6bc745439d5e6b5a912fe33ee