Analysis
- max time kernel
120s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
22/10/2024, 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe
- Size 2.6MB
- Sample241022-ftnvnsygra
- SHA256 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430
- MD5 92991ebe720f433d319202d8a568a880
- SHA1 a3744b059bc0a9c8bb89a22624218dc69a37770f
- SHA512 b71d7ac363ba4e861b4fdce3c7b2bea87c0c855414e69cb7252a9f9e36751f31ad88680a63af92f3bb663c7bfe2493c7f791116247039520ef8b5dddb70d4565
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUpYb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe - Executes dropped EXE 2 IoCs
pid Process 2744 ecxopti.exe 4564 xbodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeH9\\xbodloc.exe" 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidVA\\bodxsys.exe" 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe 2744 ecxopti.exe 2744 ecxopti.exe 4564 xbodloc.exe 4564 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 628 wrote to memory of 2744 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 87 PID 628 wrote to memory of 2744 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 87 PID 628 wrote to memory of 2744 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 87 PID 628 wrote to memory of 4564 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 88 PID 628 wrote to memory of 4564 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 88 PID 628 wrote to memory of 4564 628 886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe"C:\Users\Admin\AppData\Local\Temp\886a57592395691e932de151bff920a1d10270d30e36e2cf762999dffa2a0430N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2744
-
-
C:\AdobeH9\xbodloc.exeC:\AdobeH9\xbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeH9\xbodloc.exe
- Size 2.6MB
- SHA256 7ea4978505ae3896e53acee421cd66c326d8aec2d7912179b19116e91f43ef9f
- MD5 cdc749f4fd5e2b976191d15d26618987
- SHA1 c1cdd2461a9b3dc134d39883920376faa653cd57
- SHA512 88d6b9b8cbcf87cae3547546a24a5a7884ab3d666662fc961b20f57b9873539e55bac0ea1bf137957aebe2d8de583184315dd12ab314a6eae359fd818a495ea9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bS:sxX7QnxrloE5dpUpOb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 199B
- SHA256 a1ba93104aac44e31bb0f2e37fdccb1bb4368a8acbc098ef37f2c5a5d9c5fc8d
- MD5 570ea6e0df70a4e03a74970150d5c938
- SHA1 a938d397afd2132b715516dbf5b8aea1977a6231
- SHA512 29d0c8a3d50ce9581a2097941a749b275c9b102571907f4b26f34e5c99ffa5479b2dee84003a459d50f3642e0ba577fca6d9411811aeba03f2f56d9fcc4e10a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 167B
- SHA256 0765e1af83f996d72cb503bc80c6d44a3f21b843a6e1cb15010ec049667de703
- MD5 dcf4ea3978a51146cbc76d295ed0a1e6
- SHA1 ded7dbf90373934d5ddbbf19a853332fa1793c79
- SHA512 631959d6436602559bb8c0cd00342b898e3adeabc06f0ad3bde1d3a5145fc8abace92ab7599acdaaeef479ef5cd7ee8f1a10f65724847a954301cd8c2385ad0c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe
- Size 2.6MB
- SHA256 ab624cf4706d3c1e2080869cbb595f5cec267827de24b901b1b44fe431993b16
- MD5 dd66c743b8a56359c7e714d49f704f44
- SHA1 1da5ed8ec01ef76eacf258791743800ea45fbc35
- SHA512 698b630befa8052201f98aeaf0539fabf94223d55c5bac76bf906478463d189773796a57c6c3ba862727171b68824d18bb84efbf42a5a5b07fbfc76d61b9d02b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bS:sxX7QnxrloE5dpUpnb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidVA\bodxsys.exe
- Size 483KB
- SHA256 6d9372e88edbc6dfd81227f2e44be31b437b0b2b21120342791fcc9f5f6c9c0f
- MD5 1223ccf21916a8b6e115278547d5cb42
- SHA1 4db77fbb5014b87dd35a52626809aea691b54311
- SHA512 1823f4569ddb6a37972246fedf2376ed332e5ca0e8fae73d5271104ff3da3ccec677f451c231b6fc4f9b236df63a79938339e2a7faace6bf6bde849d8b476e2a
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVI:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidVA\bodxsys.exe
- Size 15KB
- SHA256 e437e0733cdde421f32dedbcb49fb69873f23116dc2523e2a45b18e005fd1559
- MD5 10e6df3619bbbd1a2464d5000a56fbb5
- SHA1 9080f324c059847c04fbc434d62d8ab2e06140a9
- SHA512 9cf956066c20f94e36fc21e8c536ef7625e51e279c3c9794d5029cac42d155db5a2e79ccfe4010364e50c34b0675745a5fc121a112892a31b331ab14427ac6ff
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKYB:04ezXTIk/IxT/ES70S7TqOODVtB
- MD5 SHA1 SHA512 SSDEEP