Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
09/06/2024, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe
- Size 3.1MB
- Sample240609-jbt6hsff2t
- SHA256 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7
- MD5 5da0f1da2a60a0eb4d59962fb8a71f25
- SHA1 d1ea6745f8fbb0dd66aa25532a46158706564fb1
- SHA512 ddcbaebf0c7b750ee4f4f74c5021e4a812181b7c1f1a4a6679f6ff0df8f919da8cd64a95bb75107d401f6e32e94bf84c94ee145c71be78c46678bd0cce0398c5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpsbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe - Executes dropped EXE 2 IoCs
pid Process 2968 sysaopti.exe 2336 devbodec.exe - Loads dropped DLL 2 IoCs
pid Process 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesVT\\devbodec.exe" b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBQG\\dobxec.exe" b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe 2968 sysaopti.exe 2336 devbodec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2968 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 28 PID 3028 wrote to memory of 2968 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 28 PID 3028 wrote to memory of 2968 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 28 PID 3028 wrote to memory of 2968 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 28 PID 3028 wrote to memory of 2336 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 29 PID 3028 wrote to memory of 2336 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 29 PID 3028 wrote to memory of 2336 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 29 PID 3028 wrote to memory of 2336 3028 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe"C:\Users\Admin\AppData\Local\Temp\b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2968
-
-
C:\FilesVT\devbodec.exeC:\FilesVT\devbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesVT\devbodec.exe
- Size 3.1MB
- SHA256 01ca83c8cd073fca6c7981fa049a6067f24550da989e2966c760bcf59f6fd9a6
- MD5 5640e14eac8803ffa915e323a8e7dac5
- SHA1 599771aa3b2993a68763bcf2f9abf2a6065bd9c1
- SHA512 8a35095e59fd055fc0a93195a949b4ef17ff15bc261a83b17aa32852f1a1002d488b7622a6c86774211a681a3c29e322dca61cfe27701840210baf701402e4cb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpjbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBQG\dobxec.exe
- Size 3.1MB
- SHA256 b6b5157e7cc136adcc458b3d1b1a23091b559394891d43ee172b8a1df7408924
- MD5 9c52cae9678130abdbb1b8a65ea68382
- SHA1 7a3f8ab702549263fec3213481e9adbdc4152cf8
- SHA512 0ba78968203dd9a0ffe2fbf8f53ee6627a786a017f2702c065144c997fab266d6223c23c6258c0c62a90e49d084bb1655cea48dbc97ee7899c1039697b8808f2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpcbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBQG\dobxec.exe
- Size 3.1MB
- SHA256 b5f6e61e33edc5d75cbbbc89aa2d14a9308948507f028633bc35113c49100e14
- MD5 48bb0f8012162814054d05f735b71b8e
- SHA1 32d15f2739e022dc5b1c1645c457bfec87f5fa2d
- SHA512 76d21913d3e0b6dc71b228b6ea6ebc943f5bf6608c3cb90f8f0571966401ea99acf67ad842e4a8ca2179b80c51ae99e15d4a9e299bf7f07325486316bbd09d00
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpSbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 169B
- SHA256 dcda7f65756fff6352f26beecf59b6fb4359e43ffdb210c46ae979fe704d9648
- MD5 dfa1f38334b89f05248a60ce09d946d7
- SHA1 09916a35a480d9e87c4ffd2724ce04d8f1c29597
- SHA512 183b9480b5d80c070494c1c0fa5a407279d89c84fa0f2731a0faace81942042f1351ccbe0b26d62993bf485b6f05717b17412e779b1fb8572b3b5e9ae6d40f98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 201B
- SHA256 8a19b3e546241fe2cc9794f56b14922ae13f07fed096c28c19e4a58b23f99aae
- MD5 e49c70bc76e41d6c0f819fdc06426fa6
- SHA1 020f281ce23945b83a96212d433de8d565c9929a
- SHA512 edf2055332e3c265d49034819813027ffca725c67e587bcb91db3bfb287928a20ec31caa64bf267ec553a8a16f86fd44bc6cb609ffe99d4c8c2a16618e05bb57
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe
- Size 3.1MB
- SHA256 cc3a54e4a95d1f80f8e83b20ba12a6e2a4f42d7fed3844ebdc4c2af8153f370e
- MD5 a812b74aeda3196fe1086055b2160381
- SHA1 45a1bee7c3b22edc6c8b3338e5540612be3d3b0b
- SHA512 9e7127fe573fda80adae00c7d303688ba100ae4f579cec38d57886761c3702d4c92433846978d3b5ad0a39e633282ce62e52eb0f81a9970f8fa08778af47f181
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpkbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP