Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/10/2024, 17:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe
- Size 2.6MB
- Sample241013-v148katanj
- SHA256 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399
- MD5 1947dc6cd78caefe711bcb1dd19211a0
- SHA1 4073bf4d595b81faf79a99d8204dc717dc24d82e
- SHA512 1ca27fc60008e1af1db88c35b9f6e02f0501c2449b02bed465902bf60ffade3e91c6a5889970ef5ceeb7aa20642c25c1a0be7849ac18551da8296352e3554818
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bS:sxX7QnxrloE5dpUpVb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe - Executes dropped EXE 2 IoCs
pid Process 1456 sysadob.exe 1700 xbodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocH3\\xbodsys.exe" 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidIQ\\boddevloc.exe" 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe 1456 sysadob.exe 1456 sysadob.exe 1700 xbodsys.exe 1700 xbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4144 wrote to memory of 1456 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 86 PID 4144 wrote to memory of 1456 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 86 PID 4144 wrote to memory of 1456 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 86 PID 4144 wrote to memory of 1700 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 87 PID 4144 wrote to memory of 1700 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 87 PID 4144 wrote to memory of 1700 4144 7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe"C:\Users\Admin\AppData\Local\Temp\7156f9b6e5bfaef579edbbe421950719bf38f665126a5120656b1be74bc3e399N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1456
-
-
C:\IntelprocH3\xbodsys.exeC:\IntelprocH3\xbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocH3\xbodsys.exe
- Size 2.6MB
- SHA256 2a54e87fc2698a2b88d0e9f2c3b86c300a07ad8eef69247c3fd5271449035eab
- MD5 8611118d1885be5506a32a57d6d615c6
- SHA1 6d6c1aa3e446b3e4884be0a91c4371128e0f9dd7
- SHA512 d84f2891724a20923508780f391f68ce3d0a19e41816a1a50d4a9f5dcd23e86be2211ebe9f758967718d76e620e2c70717f35420a8fdfa3b6be8c3d809337bdb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bS:sxX7QnxrloE5dpUp4b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 fd7225f11293ef9f31743a3ba5ee63b22264f9c1cd3ccdf1b09782a34376f15f
- MD5 088840c2738a36b47d102fa488ef339c
- SHA1 51b6318be7541d2f4c2ff06b6a2a38130af1e62d
- SHA512 8286772977392f46795fb976e812470004451a0d2f1c05a35ae1401435881983278790d2a25e9ac082524fcb4ecdef65aaea7d15e2d09f5310a1337d269cffbf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 c8a754b6d5d2f88076968d33679a90b6990cf18bb9f176dbfd96a93a3c82889f
- MD5 7814d69e84f169baa624a2f737be9a7c
- SHA1 565919559a698b28ce8b80f9bbf985f369de8d61
- SHA512 cdb909ffb34d187aaa2b63c679990368a9403778c643e8cf61e8c3e26a6f8c0b42b667733ea365dc69b68cf10596ebd6be1c5d4f88fac9253b51927c0652e1ef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe
- Size 2.6MB
- SHA256 64f41146de488342192ae5f6a19dfb9e632a8cc0aba01737212b7d9540a5d8ac
- MD5 2dea7b07d72b0620861149c9e4292545
- SHA1 ead16c6a67a4046d22ba02101d33a208207693ea
- SHA512 37439eb70914d9488aacc729d0009040fb4f7a492ab4fdd3dfcf391efa0718d81d043478bdba13a1802721a6a15e27c81073f2e11c07ae7aec309e403ce3148e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bS:sxX7QnxrloE5dpUpEb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidIQ\boddevloc.exe
- Size 1.7MB
- SHA256 7926d143d9564895e61950aba1ba322245a02aed0cb357be009bf95f1a067e8f
- MD5 d8dda6f94c335c6dc5d2e10165d40236
- SHA1 cbbeff3949bdd76ccfcdf1ebd1f09b46953fd15b
- SHA512 5bd10360a5381787bb2d52bb89ddb38e88d96eecede74869e9899f6af5e5e4732dff6089eb85849cb6eec7a0fa95e9deb5db5d47e2514378b52a30451f2ba893
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDD4:sxX7665YxRVplZzSKntlGIiT+HvRdpcW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidIQ\boddevloc.exe
- Size 2.6MB
- SHA256 2216455835b511726eb366f07681f316da4927fc867bec16b537016a6467e26b
- MD5 9e8615fa89ee59e461ba511de841c9aa
- SHA1 0d904f0830413d6e785116bf75cebda1cf89e440
- SHA512 1e3228c8ca5c95cf96ef7dac12360c6f3ccb7e17390509b8434b66064b9b40b68ecad4704d6be888b4e675af86261e9279a0d9663f8479b0ce4030c99f9c4a25
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bS:sxX7QnxrloE5dpUp4b
- MD5 SHA1 SHA512 SSDEEP