Analysis
- max time kernel
119s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
22/10/2024, 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe
- Size 2.6MB
- Sample241022-d1pz7swerr
- SHA256 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346
- MD5 c94ef47ba332ac8f5a8e5578edcc2ad0
- SHA1 c52b0edb3bf809205ac8d9ffdf06dc2d9b310ad5
- SHA512 60adeb6b40131183f009e84878aeb2af7e7156ecfe9df050898c93c712fd7beefb9b1164d044d0d0400b81a394a50cae80ad2b5ba07e09cb291206c660936fc6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSq:sxX7QnxrloE5dpUpYbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe - Executes dropped EXE 2 IoCs
pid Process 3756 locaopti.exe 1172 xdobec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBZ6\\dobdevsys.exe" 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot4R\\xdobec.exe" 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locaopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe 3756 locaopti.exe 3756 locaopti.exe 1172 xdobec.exe 1172 xdobec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3832 wrote to memory of 3756 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 90 PID 3832 wrote to memory of 3756 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 90 PID 3832 wrote to memory of 3756 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 90 PID 3832 wrote to memory of 1172 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 93 PID 3832 wrote to memory of 1172 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 93 PID 3832 wrote to memory of 1172 3832 1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe"C:\Users\Admin\AppData\Local\Temp\1a0aaab94cf74ee829231970ce0cb3d80d289abd488833b080c336cb3c9d4346N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3756
-
-
C:\UserDot4R\xdobec.exeC:\UserDot4R\xdobec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBZ6\dobdevsys.exe
- Size 7KB
- SHA256 43b6a06c6d792569dc3a4b802a1882bcef34d458cb6c626267bf303fc8dc3fa7
- MD5 20ec6effd447fb35f7db816f8c616148
- SHA1 c8c9edd9f30b93dc161fc035c69b57e7af305dce
- SHA512 6a01a317698e30eec8ab65c628488a1e6108d6eb9dd6bdef9a769d497807ace3b68a23452d40d010b95f19759903bb9bc1910e8d7e46fa618aaa3fbf6a80fecf
- SSDEEP 48:6BMk1Y8lp+j+nlXlnpVZlXHnznjLzrznzHTDzXT3jbU7LbL7LbOqWnN3:3k1Ycg+n1FZlXnzDnznTT3jkHnHO1n9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBZ6\dobdevsys.exe
- Size 2.6MB
- SHA256 a2a04f70716d2827f09c9fe71933d5c4e01cdeb6356fe1b077cfc33192bf68eb
- MD5 c07585603bd8074f115e28bbcab674df
- SHA1 a3344be6b5a9bc00390fbaaf2d540de43e042bd8
- SHA512 78f3e0bbec4c7c553ee66f53a88a5525b8775d80f7eb6cf9b43df4c691e382dd192d917b996aab846fab5c32e2067f1cda8fa6a424892bb7631c489875ff9c10
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bSq:sxX7QnxrloE5dpUpgbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot4R\xdobec.exe
- Size 2.6MB
- SHA256 fd52e32eba903bc73e290af3c37c4ea1bd35fbf426c64f50ade535290e77f902
- MD5 286869bf4e17845983f1409d22667fe8
- SHA1 0e3f76bed2b4b025bfefb0315effafb498e092e0
- SHA512 7591521fce57aa76099ffa5dac0e31cf3061893f2cb319a5b7c8cfb5fe6e5f3ee7904ae7b1138392445419a1804685d672e1e947f675dd3c6c1ced93dae026ae
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bSq:sxX7QnxrloE5dpUpSbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 7e4407bd13fd79ef4d3e65f99596d5e8789821320be1abceb68531c1781e58b5
- MD5 87b6c7d85fac714a647cf49171eb3048
- SHA1 c470c7aff7c1abfc0f4e4f05bf26f74fc91bcddc
- SHA512 87466b677461935f4443acf9fb25194827225c9e13e325b8d4433064f2ff45c6a97eaa6d4b4eb16686100f1bc3fa5426c1b54e06dced8f0d77ee29a3a6d926bf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 a7a8df2886e40f5586da712bfdc46f4e36c2d1a49bca4130da1a91dce2c23145
- MD5 27d415bed9b663ce419b0ee1c5f246b7
- SHA1 5ef28c1dbdccbd06a5f99c4884e06aa51422e6a1
- SHA512 c79e4aad0faefed7062f322301f39c94e0368fd5cd9c24a9e53c17b51b4238a8b3652b72f9ed10a7effd2b793d92e7992a841128422c010860a43a31fcb84a5e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe
- Size 2.6MB
- SHA256 fb18d4a531ccfee48f98641ac7a90a3a0bdbc0ad3b25b4ce144e79a72412ecc6
- MD5 06b460b6af78fe53336fbb33286ca824
- SHA1 f32de2fa9d7048855930953a30a868e1d6360b0b
- SHA512 7631303cc1fe68ab3ec064b8425f6bf076debccb8579299a2d57d25f8c8ea8b4fec22f8232724ce764cab79cce66923873b7b967edfba61db68c9e66a4d987d5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bSq:sxX7QnxrloE5dpUpBbV
- MD5 SHA1 SHA512 SSDEEP