Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2024, 23:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe
- Size 2.6MB
- Sample241108-2zfbdavjel
- SHA256 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192
- MD5 1abe4e3d457048b433a08a17ea48ba80
- SHA1 b73aec740e2f70ccaa284b05437482f57d475859
- SHA512 ad0ae024cebecebae87e1d68b5dff9f489d2d42222c8a9bf77ea1a3e8bf334e3f4ffb505b757073730bfcd3f4f5e0449f31d726e9d255afbade6a94fed43bc5b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUp3b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe - Executes dropped EXE 2 IoCs
pid Process 4160 locxbod.exe 4380 devdobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files1U\\devdobsys.exe" a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid61\\bodxsys.exe" a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobsys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locxbod.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe 4160 locxbod.exe 4160 locxbod.exe 4380 devdobsys.exe 4380 devdobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4160 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 89 PID 4496 wrote to memory of 4160 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 89 PID 4496 wrote to memory of 4160 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 89 PID 4496 wrote to memory of 4380 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 92 PID 4496 wrote to memory of 4380 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 92 PID 4496 wrote to memory of 4380 4496 a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe"C:\Users\Admin\AppData\Local\Temp\a0ba63c084e06a8d5ed9a3e47b92a93e6eba8c37f8735eeb446f4806da35b192N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4160
-
-
C:\Files1U\devdobsys.exeC:\Files1U\devdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Files1U\devdobsys.exe
- Size 2.6MB
- SHA256 6e87ff411aba364f1053a4ef2a7a042d315db6a2f84f59d1e40da3d3cb1e61f5
- MD5 e12702b7ba1804ce118d835bdbc07b6f
- SHA1 c7f31e8b8a46251e9491e35ebb1d18dea2cd0250
- SHA512 cda39e57c64e643a58be91341e1274a4748679e5a10368a62b8c9fffc5feb81e0e5eea99d3921206fb67383d0cf13618abce1c7e1c699ec9f8607eb872d0a91d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBaB/bS:sxX7QnxrloE5dpUpNb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 529aec05da308a7fbc1b5c944a85d986d953bab7108fc491f0c63c9cde8eb6e9
- MD5 d281745bb8438d51a26213568a68235c
- SHA1 c41fe404f98678eaa8f8e21f5b87c47e728191a9
- SHA512 fef975fa939ddb1d8b8d9f4c9fee309dba1e698981e68e3a19869e2a9f174c83c534192e3290c270096aa61a0b11df41284f3ed42730a887e708dd9cd54de43b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 59ad68d2ffc98bbe569c0ed74dd17a85ffaca1da72a1a8c9c4cc031765d2bc43
- MD5 40304db8d229c7fcd7e8b2943f8d15f0
- SHA1 b21bb2a6b06f9201143dc87970ed86b86918f80c
- SHA512 1f78379e0ab541915cf91882aa3610631ccb4c48bd26ae56d1fb0a85f278e95e432abf9db1eb4313dfb38c6b143205eec30ffd1bcc29d0cff842268b867e58e3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe
- Size 2.6MB
- SHA256 d5598d24ab1682c032e34333a24d7d93d676eda9c2669c4f0f8e6b2001e4b7cf
- MD5 c3cc15f9ba686e148764ad1a248ebaa9
- SHA1 492f0d3912b69425cbaf58ec42fb31b9d3fcdec2
- SHA512 d096353a3d4a4de7a889868b60c3840588a707fbddf55aaaeeb25f59c2e554356679471886040745d10d6d25baac26071203651a997a576cb6733637e38d539b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcB/bS:sxX7QnxrloE5dpUpLb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid61\bodxsys.exe
- Size 2.6MB
- SHA256 ce293cc2c4d25561d6a46a6e08694a2188390044e824805d52b0cbb7b57cbcfb
- MD5 7b653cc81b9e8f3256954d08e2621d2b
- SHA1 bc72833251a7da20e65298cd14aaccb3b812f9ee
- SHA512 478962c1477cab62a47a334265a55a2f0301d447b939357aef27ee0ac842fff381f3fd792c6655998353338e1fb8480f70ad0c8aa466a29641b741f8df557084
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBzB/bS:sxX7QnxrloE5dpUpcb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid61\bodxsys.exe
- Size 2.6MB
- SHA256 0507e912dd8e2e8c713edb64929c2a0b7518741c2994704ba39550647d28f107
- MD5 c7cfb7970a62e83fd655f19ec9e14171
- SHA1 78440fff6275382f9db95abfd50e651b800e9a14
- SHA512 395597681a991cb6f99939141729736a13e5a8eaf5254a57eaa27f41b1c7da5889aade0b1f9430f808d836201d55e0f6b1dc0d581fd742622ed208cd5bd7b1f4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bS:sxX7QnxrloE5dpUp0b
- MD5 SHA1 SHA512 SSDEEP