Analysis
- max time kernel
119s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
22/10/2024, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe
- Size 2.6MB
- Sample241022-e82jmszdrm
- SHA256 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26
- MD5 f47e72d61dd090322178f3660adae130
- SHA1 515fc1a5b13a5cee2dde451992bbd85d882bce2d
- SHA512 5884df039d12e6511f09fe9a54b63eb779d8c18a46d791237af9eb7044d6e318b032d7b7fc22d50d33e4149dbbfc90d16d02f1b1af69d38be48066941bba3712
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bSq:sxX7QnxrloE5dpUprbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe - Executes dropped EXE 2 IoCs
pid Process 2000 sysdevopti.exe 436 adobloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files9M\\adobloc.exe" 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintGD\\bodasys.exe" 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adobloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe 2000 sysdevopti.exe 2000 sysdevopti.exe 436 adobloc.exe 436 adobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3940 wrote to memory of 2000 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 88 PID 3940 wrote to memory of 2000 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 88 PID 3940 wrote to memory of 2000 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 88 PID 3940 wrote to memory of 436 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 91 PID 3940 wrote to memory of 436 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 91 PID 3940 wrote to memory of 436 3940 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe"C:\Users\Admin\AppData\Local\Temp\1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2000
-
-
C:\Files9M\adobloc.exeC:\Files9M\adobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Files9M\adobloc.exe
- Size 2.6MB
- SHA256 36baff13f5a78214ad2f452ee34fe80ced983d1f3f5dd5a0a373d442ad709d8f
- MD5 92cb8fd263d83b877df556992e700fad
- SHA1 932ebab3b315b3f271c9f21d3c1792482b4f71ad
- SHA512 c0d6a22ccc3ed9d3ae06497dfb06a7d4e0cc82d82af7cb63e4b5727e6366577196a86b8308e6bd4aa8e7b83ff336916995b81d57c5941050463342ae107e584d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bSq:sxX7QnxrloE5dpUpKbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintGD\bodasys.exe
- Size 670KB
- SHA256 b5cbd821b4aa397b94c4e7de6e7f2fe8a1ce68d8967ba7ff2d971cc4da2f432b
- MD5 1406f16434002a4237254b696829cf1a
- SHA1 a6d6b2aa509addb642e20b14b143f0b0272d934e
- SHA512 cac2c4b00628d51c7b1873dc17c82aadec310a894da368d9e820050b5503c0c787a593b2ab179944f68c2fa0f21ddc5a7e2573a035661289165fa08d052ffd8e
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCchP:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintGD\bodasys.exe
- Size 47KB
- SHA256 6eb1a87af8ac5230a217aacd34de88c59e06268b719fc264c44e62dfa12e7709
- MD5 703298e1938b94b8a048722589106182
- SHA1 76cf69965dbd2c3eac9313fdd3019ef346fbd507
- SHA512 3516ce6ea8807a3fb6c010e95d8450210cb156137ce1b2c7eabc8864fd53cdf8eb31a79323092e9a8ee41dc76c1f14b645b91fb0be2ee13197dbbd875e68fc09
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkf8:ABalOBo1TKFO3n0KkZHqX7+g2lW+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 89680c99b1c3de936b5aa03bf1afc2cfebbc795644f03f11dee64e7a6ec943af
- MD5 d44362fe379f3f635404cb8887cbde71
- SHA1 411dffa57b1f9f85a6283c8a55b4508499dc53bf
- SHA512 6524dd4c853b09eac7d83b4471cd50937ba03c9da886b8dd541e3ba00e819e3b2ffbb523bf520f2247ce7f6b7e4672fffbdc82400e76838f064b04e95eca9f54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 865e244b3665ead5657c2e9d9c27ef4916de7590fe968386a0384f1dd97aa6d5
- MD5 4b901f056344704ee8e7a3590ebc8ebd
- SHA1 828272ab43014917c56241cfe560b1f042af4813
- SHA512 245fea705bc8ed2a6567d779fbccceb8ca2bfef5c5f32bcf97feaa0c8ebd5e57ea17d6c58d4c35dea0a7c95148e73dcc07ddc9905d6d7fd918f2fa954ed964c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe
- Size 2.6MB
- SHA256 6da88f072d24038ea3f844c9fe0f6eeb7433143815bf1a724479d71df754cfb5
- MD5 43a7647b56cc092f4add72d864b1b59e
- SHA1 14b928304d63aeeef42651260fb1134445fb3a37
- SHA512 ec2c111c347f25c7ca0b3ba0d662e5af73c4b7c3c3bdbd23a5a3fea8d14bc334b0dd2fa9dc7c5f7c6a1295d26d316299fd742e949ad85a82d27d9e3d289f47a8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bSq:sxX7QnxrloE5dpUpEbV
- MD5 SHA1 SHA512 SSDEEP