Analysis
- max time kernel
120s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2024, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe
- Size 2.6MB
- Sample241108-ntmxda1gqe
- SHA256 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9
- MD5 db8c947fcc84a9470eec077c7c29e2a0
- SHA1 97ef308aad8c26c959a7eba2af09094567b4c174
- SHA512 7d2dde88e71c9aa6a4919ef7a4cc63658bfd60b5960965c462ce24d6e014d8138b368e259615e298a63cdd68936d52d437a9f975be3e0850b62fb706438de600
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSq:sxX7QnxrloE5dpUpUbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe - Executes dropped EXE 2 IoCs
pid Process 2104 ecabod.exe 4540 xdobloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotJJ\\xdobloc.exe" 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidMM\\bodxloc.exe" 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe 2104 ecabod.exe 2104 ecabod.exe 4540 xdobloc.exe 4540 xdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4432 wrote to memory of 2104 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 88 PID 4432 wrote to memory of 2104 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 88 PID 4432 wrote to memory of 2104 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 88 PID 4432 wrote to memory of 4540 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 91 PID 4432 wrote to memory of 4540 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 91 PID 4432 wrote to memory of 4540 4432 8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe"C:\Users\Admin\AppData\Local\Temp\8777b432950f81551adce3be72e18d1bb359d0fd62df15374e315075adcf52a9N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2104
-
-
C:\UserDotJJ\xdobloc.exeC:\UserDotJJ\xdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDotJJ\xdobloc.exe
- Size 31KB
- SHA256 fb9f9c9a72e0e98d461054f92faed7837baed42691d98807657f573b5375a6cf
- MD5 6767e44b8f8de6e616ff4b3523b078e9
- SHA1 c871cc62c3911e5350a063da1333dbe1aede5281
- SHA512 5660382a8368b7e9ffc099dc84a891904199c2feaa7bc7a16b39b7231f5102c04d6703a2b85492b3db7f9c101333e9b3270fe6657fd524d50c26b9d07958c2bc
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+s:ABalOBo1TKFO3n0KkZHs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotJJ\xdobloc.exe
- Size 2.6MB
- SHA256 5866ef803d5788c66182501d9c8480e7ed55837c27590f080bf02098cfa06783
- MD5 3065401fded494b636caeba951e22d5a
- SHA1 8130ed5f158fa6681e915db1ae2d2be19dac4b8a
- SHA512 9d9f7b688a4c90c6b74463dc4246bbd78408010f318a22ebab7c35f7cc560f40c64e2241c336a75f50a8b937686ccf9a53680f50bbb7fcd3619d31cb2b15021a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bSq:sxX7QnxrloE5dpUpJbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 200B
- SHA256 9f486fea657960df3cace8d887cabc0ce0ac9f361571a489aaf07492f0595cb2
- MD5 4971f76302984d4e5d734389c88882fe
- SHA1 c4bbb4a573ac422315d619eed58c3ca58db669f5
- SHA512 a3e4220244b5d3bd04ae1b39bbdfba7a81b7ccb9b1e1589d3a386a828818db40fd60cd34f597e9ff56d94bda543e3428301c8f3ec55228bc6f9ee736a28198f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 168B
- SHA256 9fce1fccb1844cda9539ee8c20b643fbb9c924e28fdb672c76b5530bda08fa18
- MD5 f1fd0bdedad926a605461e8f7e094d96
- SHA1 15763eb724e1faa1ca3ab0dfbc4ea2af8cc94259
- SHA512 7ccc4f61d712d6715736bdbb965a974901a252824d00b4ca6cfa80ae98e349b71afb2a7412ecea75cd2c6f880963b343034807b8465c59318195c64f1e51b4bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.6MB
- SHA256 6abad15e25e5caabc516efa450d3044723086f8f3460360dfd8b24eba7d8edc4
- MD5 a95dc10a5bc704bd36bd2e4085cd2ab6
- SHA1 3336a58aec51a650a925d9ef3711a52495243a10
- SHA512 3d93193846b27b35c9326cff4b2c39e987abc461ee9f98390bdcfc0ac6f1fc6a19442a43eb1c29df5ed302d8a82149de0ae95f50824abff59ce2efb50765a7a3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bSq:sxX7QnxrloE5dpUptbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidMM\bodxloc.exe
- Size 218KB
- SHA256 e65648587225e9ad7ed119240cc7b4908a4cdbf2bdd9b759cd133a54dfdb3c73
- MD5 d3dd1c89dfe47fe93e630e17a372d3b9
- SHA1 bf852fcfe3c7a5a27e841f7b31da8cdaac3448e9
- SHA512 b9ce77c97fdecc61db9f53c00f14e5bce2b82994bed10b5749025e688cda1451503f8da4e48556162ed5fe6cf300e0d4341963de55e4463fe08298ef7a040bce
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB/:6ne3n0DmAm67YEjAyu6qJ/E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidMM\bodxloc.exe
- Size 2.6MB
- SHA256 0713eb4f0d4a8ea767719a38e04a40af4af56522b352b03fb25aaa69a215df8f
- MD5 21b7cac37a67530cb7de6db2655fc9d8
- SHA1 cd404234c6fe9c00b5120e0fd2a86ccccd817175
- SHA512 855b75851d7c1170fc7edaa9037939b44b19b5a7b09353262934923b68ba00c319af82848364a590c2377dea9ca4da379bbfedcca36e92610e15f990d0e2a58b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bSq:sxX7QnxrloE5dpUpTbV
- MD5 SHA1 SHA512 SSDEEP