Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe
- Size 3.6MB
- Sample240608-1ws8dshg28
- SHA256 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21
- MD5 5883958800fe5864fd1004ba1e60ea41
- SHA1 bc5477c6b3a9848c1fd3664e9daa74718628c5f0
- SHA512 01e1eb4c472fad42a02f4289eafd22709e49e0bd74a50b1da071fc2cf48ec6d1803293ce735f21d3013864b10f1b1b432f5976de6870cd301c2929795e48655d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpwbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe - Executes dropped EXE 2 IoCs
pid Process 1436 ecdevdob.exe 2228 devdobec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidIQ\\optiasys.exe" 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeYJ\\devdobec.exe" 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe 1436 ecdevdob.exe 1436 ecdevdob.exe 2228 devdobec.exe 2228 devdobec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5112 wrote to memory of 1436 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 90 PID 5112 wrote to memory of 1436 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 90 PID 5112 wrote to memory of 1436 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 90 PID 5112 wrote to memory of 2228 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 91 PID 5112 wrote to memory of 2228 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 91 PID 5112 wrote to memory of 2228 5112 3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe"C:\Users\Admin\AppData\Local\Temp\3fcd36ab47caa90f17d137532bc60bca5b37699cbaac2e15b2a95d03658f6f21.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1436
-
-
C:\AdobeYJ\devdobec.exeC:\AdobeYJ\devdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeYJ\devdobec.exe
- Size 3.6MB
- SHA256 41858f7925a49876722138e7d2297a2e0bfb79b7b8c53cbe123f5be6d4637dfd
- MD5 c83013c2d175c08e0de5f2bce07f2082
- SHA1 9c828abd43a526568572fd832558c870541bc2b7
- SHA512 3c88986e0f9837f9ea47d30d232d319950a2ee4a3bf666aa9947018da1d96736526618a5481033f7b08c19b6bbd5f9aeb5d9ae6235a56a866e49cc4e4deabf66
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpPbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 99a68ec99e82ec9a819304ed35b022b888f69361de3d344ec0006f5600445624
- MD5 51681b7c7b8f47688f5b6479cf1b0a12
- SHA1 d37feb3a451f8db29f5886c475b630c77066e3cf
- SHA512 53bc1138e7771123d1e3d150619dbfb3f7c3349a68cc14d4fc231533a68b20ffc45243ca0c439b3b6eba6e02728a080c5a7fe6d9c6778fe52e67fbcacb11c648
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 57869fd7b88a63c07f5d4f83f2283fb9e9ffdb46f0c5f78989347365793aa0ca
- MD5 75c00fb4407872097e2223859168641e
- SHA1 2ec306d0ad559123afbfe929f55171a0d2e95a13
- SHA512 f6fd984c02932fb1f23e69e05e1a02fd02dfdb9a83ed17c254f75e84d2d9eca7f19ec50eb706a1463f9ae25ad91a46321516d1742612d3d7687cdaab634fd9a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe
- Size 3.6MB
- SHA256 329033b6358c248273618b7030541fefd01f7b5291b2f319119c557477b42052
- MD5 5c4d472a67ff8c66534b5d17f32b45e7
- SHA1 173d3eff39ffa30464a9bdd8e5e96e6ad9334b5b
- SHA512 992345bfd8e87bcf4d07ff61afb75ea4be7e10e808e4d9b4bfe06bd34142ceaa609d5fce77b040cc51a3d16b1d81ac955e84767c57185f7c2c102ba70998134c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBaB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpVbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidIQ\optiasys.exe
- Size 3.6MB
- SHA256 5e96f59de9309866926ff9715b687a7ad3485444793f139e2c37fe789f3cc0c9
- MD5 212c4829e8e3025580bb5db6cec1e764
- SHA1 1052064a84f5b9a93e87fc4f9130aeda9bfc9ca6
- SHA512 7cc219caf9c6c0fb490cf1963d8da9d0a626e13a7af38ee76402e67ecafee45480fa704ab7e2bcec7621dfe67e56915d761654c8228131cc7e677a868cd806ea
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpLbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidIQ\optiasys.exe
- Size 246KB
- SHA256 2839185d65b2564d446ace1d181975fac08f58ee924b8034d3146d8fc3f4dae9
- MD5 2206bb4600f4bf4a6a28ffa99b30aae1
- SHA1 1bc2ef22d0d66f1e5cc87f8ac8be04d370ecb24e
- SHA512 d305a04e8b95832ee508f7502c000c8e56ba1a03e3ace6277cf7e90dc404a77e0632c0e7d8074b0911cc5192e8ab85b757e14bf50ca5ffd9f54ea9b8e57045f9
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nz:6ne3n0DmAm67YEjAyu6qJ/+Wz
- MD5 SHA1 SHA512 SSDEEP