Analysis
- max time kernel
120s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2024, 12:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe
- Size 2.6MB
- Sample241108-pag3fsscjk
- SHA256 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7
- MD5 a2ea6b50ec22ed4e3f1f8753feb82f60
- SHA1 ea6328b94bd4bb4b69882f255be30236d28a54b4
- SHA512 71a1494798fda001f4ff7ca3de8a5c95986a3cc3be97569944a8f456e18617a64c68eecf09febdaa5f35b5a0cc256fb68ba4b28278555b33d25b04aeee58b04e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bSq:sxX7QnxrloE5dpUp7bV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe - Executes dropped EXE 2 IoCs
pid Process 4320 ecdevopti.exe 3552 devbodec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidNM\\dobxec.exe" 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvXL\\devbodec.exe" 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecdevopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe 4320 ecdevopti.exe 4320 ecdevopti.exe 3552 devbodec.exe 3552 devbodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3048 wrote to memory of 4320 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 87 PID 3048 wrote to memory of 4320 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 87 PID 3048 wrote to memory of 4320 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 87 PID 3048 wrote to memory of 3552 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 90 PID 3048 wrote to memory of 3552 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 90 PID 3048 wrote to memory of 3552 3048 220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe"C:\Users\Admin\AppData\Local\Temp\220e682341c2a933d09a664ba22b9d0e909aa738c3a2ec1a1483e3c6b52fa0e7N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4320
-
-
C:\SysDrvXL\devbodec.exeC:\SysDrvXL\devbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvXL\devbodec.exe
- Size 2.6MB
- SHA256 3e5d79871c0a748a66e94addf5c48463a419d6ce29477e20ea81b4d161e1901e
- MD5 0cd0a20deb1d90594b71e472b201e721
- SHA1 800bb5521bceefef45996c28ae2d7f774e156821
- SHA512 95326d50b822e8297c818b6867bcc96e6e75cdc3d9025cfcb573b2340bf1d66b800ef0e2e10491f85be02734558395062c317c30e5da3900fde0a4eb5c39a057
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bSq:sxX7QnxrloE5dpUpIbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 526aa4e0594f16abbebb3d2124e159f4d76bbbaf7fe669c777c067e7fb6f47eb
- MD5 c8703023b6848d5ff8272f6adc2c3af7
- SHA1 feba75d897903f2bb6752e0a99e6ddc6de870e1a
- SHA512 2980fe75a13fee70ee959162d4591e5fe1faad8b679a5d2d04a5f42da28ff4b0f4853946433be38749cf522c70695909672462ac36e99176e42509f87eb74150
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 aa8621cf35389c6d238a497602b8ac5ea3b08398a1f0f47c547b4b9b20af6642
- MD5 cefd4ce228b1d3ca54ec9235840e67aa
- SHA1 79167cf25a8599644a51d6904297bafc2a62c768
- SHA512 8edb85ace1e55edec7146f6f3ddd5b1d1b3ec487a7ef3395817e69b5f9f8927e1c591f8c5592c7e1abf6b6d126d091b5315b6d17f79f64d2fa04474961891cae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe
- Size 2.6MB
- SHA256 35ae9407d14145312ebb985c69d8d5952c4f38bad37163d99702bb2ac54705fa
- MD5 47d8ca93a1dea78229e57a1cc9cdc319
- SHA1 69cbbef18ec26f0ab934c00df9e906b04ad6412e
- SHA512 8cb3f39dff3ebaacf533adbdee0beaab81be96c7265cef6a071264abba0410a229faa7d67bba8c779b4f56baf78b0a6f7d226be90541868a2ca76f613fb5e7a6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bSq:sxX7QnxrloE5dpUpVbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidNM\dobxec.exe
- Size 2.6MB
- SHA256 26e2a967337781cb5d55add43ecfd30c823274e4b7766bd34182d427f2baa1c8
- MD5 3c30a4fef391f2afa2177c2d436990d7
- SHA1 528c46f98232ffb5ae6c05a37af186413395e40f
- SHA512 b98e74bc0734c2e9a1a33006404eab9ebaac9062b07ac75979954b3983766921f405638f86d6cd81d73b364448eab4542ac6f8642529320a17f89acd22bb2acc
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bSq:sxX7QnxrloE5dpUp+bV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidNM\dobxec.exe
- Size 2.6MB
- SHA256 9c8df03ec32401040c02e4061bfe52fac9444973bf3c3c01edc12b91e1df9d4a
- MD5 cb3fb6a59555fe72bd16907bfcf6fc8b
- SHA1 c0ca6f71981f69b62013ea14f177a8dc0b340f7a
- SHA512 cd0ba8b3d0ff3a24b3c1376238535ca7e01a117fecdf78599dd058cff8639fa7551795a58f2f51fb15e61d2bc8439a1da82aaeee8a2cb4454c2fd2eedb85f103
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSq:sxX7QnxrloE5dpUpNbV
- MD5 SHA1 SHA512 SSDEEP