Analysis
- max time kernel
149s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 19:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe
- Size 3.9MB
- Sample240608-x98nfsfb91
- SHA256 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5
- MD5 9bac1aac3ecdb3e4fe8bbd12a41abc8c
- SHA1 8c7c2df279c97d9afc66d7890f7b9ace936be4d8
- SHA512 08507bf18f0cb9d2f4117a766d0c1c698b100b06235e09b1e30b4557db8bf7f00ad998c71b9654c37d2ce75122713ab9c904006f8237b230c8c754a952a11bd0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBkB/bSqz8:sxX7QnxrloE5dpUpLbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe - Executes dropped EXE 2 IoCs
pid Process 2712 locdevbod.exe 1768 abodec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeLZ\\abodec.exe" 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBFR\\dobxloc.exe" 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe 2712 locdevbod.exe 2712 locdevbod.exe 1768 abodec.exe 1768 abodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2712 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 85 PID 1520 wrote to memory of 2712 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 85 PID 1520 wrote to memory of 2712 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 85 PID 1520 wrote to memory of 1768 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 87 PID 1520 wrote to memory of 1768 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 87 PID 1520 wrote to memory of 1768 1520 185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe"C:\Users\Admin\AppData\Local\Temp\185492fd4f7cfed03fccc280500ad6a1386d97ebbb510b20e8e7f783f1bfe5e5.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2712
-
-
C:\AdobeLZ\abodec.exeC:\AdobeLZ\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeLZ\abodec.exe
- Size 3.4MB
- SHA256 95225ad3aa921ae2abe4927d95a6670f18a235dcf8d1b7dfb396d3a8b8d80883
- MD5 5d3a940266b86d30eb0195a0dec38180
- SHA1 b79f8843208d56e24053ac1c9383162e2baa8edc
- SHA512 2e90e934dcc52cbcb5480dd886795ba636b3b8e380fd2b63ac5d45712b6373d0b5d8dd82f621594d8840c203cf3457f5b3e7f7504558279edd2589d4e4d529da
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bSqz8:sxX7QnxrloE5dpUpKbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\AdobeLZ\abodec.exe
- Size 3.9MB
- SHA256 0306d121ea1334c59a55600e37dd20ddfac084e0a8fb139a5ddb47fe2ac79fc7
- MD5 c88741dcde5741578d225ba6e0828680
- SHA1 a0a96ac29d2d010184585c7dc571d64528d759b7
- SHA512 45d561b9258ccabd5679abcaaaca846b6922415b57878fc96ca7ed2fa09bdbad2621092c31962360434d417a02146bf625480796ca16ac76e6420ac9f3f5f1c4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bSqz8:sxX7QnxrloE5dpUpKbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBFR\dobxloc.exe
- Size 3.9MB
- SHA256 8a9dc05324f3d21e1aacfa7498924f23715ade94da785f8102b241f7a1811019
- MD5 5ffc81ea2d2310869ad10a62fd00adee
- SHA1 06989725a50ab612896cf960e2b6dd6b59cf5ca4
- SHA512 f99cd1c862e2efe5d5adeef1e7290d429704dc7f233bbb16ca3ebd93820722525de6ba793db59002f4f689f434f83c63a495bf497355de7c25fde29e738a0671
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBFB/bSqz8:sxX7QnxrloE5dpUpubVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBFR\dobxloc.exe
- Size 3.9MB
- SHA256 f89ca6197dd70535fffc3bb345c694d6740e252c66e6c8bbd7e5610036a71108
- MD5 2c585009160588c4d5d482ed0fe4697c
- SHA1 f9affb082fa283a21e75806190134e8a814ad4bd
- SHA512 a6bdace98bef76e526a9cb2ad6811effbfd31c5867fea0d3d77e2d2b089483450944c5a7c821fbf9a8f87732c117a5b14018dd7d3760618e0517cbc9e0563403
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bSqz8:sxX7QnxrloE5dpUpNbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 e9d3b25476b3bd927456f009bb931b0ac5a6a38c439a397c37cb02c5f087badd
- MD5 f77d5811efc3e3c6b1dab8160fb61221
- SHA1 6cb1d74179d6455a79515b2b0a04088542aab045
- SHA512 b9be9202e36b3d6732153b5552aa3ef52b626cd5292696f7fcfd975450309f458f1df4707b78eeea656b820edca543662b60c5bf8eaeea936d12c142828457c7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 7cacbe84a25e121b02435bf5e976533583d5fed8e2ca2ea9988bf6c8c3f3a143
- MD5 f0b279d03432cf45e21fe8473097b117
- SHA1 a8527d3ac331c6dafa00a2e3120a39d7e8555e4d
- SHA512 89be33b40e6e36e48637af73bfcb2a47909b692f8a7cc558d2d3012b5c1a6fff5d615874957c3f2007386772fae8e9ffa3ed6b6e5880152ee9e5f63ecabfb969
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe
- Size 3.9MB
- SHA256 0127c0500780b3cdd9581a7bc93fa5b3682ce63ad3165a5e74c93df72316c8b2
- MD5 9d2a4dffe6b73559f25e30d70263cc8f
- SHA1 62cae7ca16389cd841b5e91981c372ef7c688956
- SHA512 3120949040916c0415d9a15372255c382d03872099a8a021ba8c7af007f7076d4729fa334dcb2b17d33f622ab23e77aca183c6e18add15ec777a12a033e713af
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bSqz8:sxX7QnxrloE5dpUpJbVz8
- MD5 SHA1 SHA512 SSDEEP