Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2024, 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe
- Size 2.6MB
- Sample241108-svkkvsvdln
- SHA256 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89
- MD5 828dd0d52b9020e660fa9279887a2d30
- SHA1 b598dcc87b5ffe9064488f7a1fefd09ae5172f44
- SHA512 2772724926c5f853f84aeb5d73755c5bc72ca9c97a5196582fc42c23f4f19b1c079db2578b17785e6ddcac8ddc09cd31c7693f56d8f9a2e7cacd861d8774e1f4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bS:sxX7QnxrloE5dpUpJb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe - Executes dropped EXE 2 IoCs
pid Process 5008 locdevbod.exe 3076 devbodec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe76\\devbodec.exe" 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint6P\\dobaloc.exe" 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe 5008 locdevbod.exe 5008 locdevbod.exe 3076 devbodec.exe 3076 devbodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1052 wrote to memory of 5008 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 88 PID 1052 wrote to memory of 5008 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 88 PID 1052 wrote to memory of 5008 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 88 PID 1052 wrote to memory of 3076 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 91 PID 1052 wrote to memory of 3076 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 91 PID 1052 wrote to memory of 3076 1052 64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe"C:\Users\Admin\AppData\Local\Temp\64b4c41912a17d50cb995b16a0b576d2891a4e5ad5cccc002b21add5f2e57f89N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
-
C:\Adobe76\devbodec.exeC:\Adobe76\devbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Adobe76\devbodec.exe
- Size 2.6MB
- SHA256 2e1b7643207b51f255ce9b14c10eda621028b25cd1d16fbae0fbf381fbc14465
- MD5 67dc0d760b84d38450f5a2ca62ba6678
- SHA1 c70d28440adb4474086fae9a09aca67bc2b6f3a1
- SHA512 82fe7f486ec21b46032eb2fb694463b80fe3d38e156f95bbb9f38e5f2f2380b49158b20d397978c46b841c92cc0eafecbe34773803c6233c719b626ebaba475a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bS:sxX7QnxrloE5dpUp6b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint6P\dobaloc.exe
- Size 2.6MB
- SHA256 cb4aeb15fe0c26d340e2cab4260f876c966e870aab9ab9830fb65b2ce1965a98
- MD5 6c724fa25852379974d7472827a257ea
- SHA1 28314cc740052a07a673544d89e018b604033218
- SHA512 80aac65953f6e773e2957f35aa5f0fc5fb23937b47f5427efa086818744628b87d2ccba4597c4ab21cfd39244d8b64f92bf1365f4942e46bab76aaa733320362
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpfb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint6P\dobaloc.exe
- Size 320KB
- SHA256 e112bf6df954a081711f1d80663c781e3faf84261559273820a1b0fea6a82df2
- MD5 0602a43f8421ce92a3f56a316f87a03e
- SHA1 e5ef3fb2d664ce7c718da31984f73462517614ab
- SHA512 73614d607e3ea70bd60b1e6e1039285fbe01abd7f078b75ac20a04127fd2f8b75d9a6738a57158abbf4c9c8cecf69849325f6400dfb8884b0b7bad8ca56577f1
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7UqpK:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 85e3e9b027863e60bad5d423375dc0f14f5b1503098e5effb1074b9e68b7e79c
- MD5 7925f699ae729518098d0c7c2908b134
- SHA1 b61a2716619c478b31319e3b8a85a27a972e5348
- SHA512 b716841d44882086d40a9303656b8743f3885e018d75c2008ca90b3dc8eeeb14653d8612eb0d1357df9b61da36e6494ab547ff6500303ebc25858fcb2173a0bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 af80af06ca966672a364148390dd7c26f4d63dee1395d56238da34a6cd720f5b
- MD5 76bbf63e5abea4545e7fe84f2aabb19e
- SHA1 b66095a001730b43e7c7269939b126ffa9fc8629
- SHA512 f2c49341014427dce871daf45976a6dc55212ae267ec87b8f16e3d673dc0b68c00832d96e08a4b50fe23f892d6882202ee7820055375e474a52abb61d3fd5e68
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe
- Size 2.6MB
- SHA256 ba869a26639830ac9024763996787848c089481796408f922a2d98aa5891e832
- MD5 16000e2c7e42efe54fb8904a7b054bb2
- SHA1 5a4b89f61c3e6a17a7e0ed0333704eb32f3fb51b
- SHA512 f23a2717d4b532c937d8879733397493d29e9188d970c9f2da7152f52003227cb97c329b8c06894f4b59c41bf1f2f95562d2f6bfe26e75110d29ce5114c3c345
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBbB/bS:sxX7QnxrloE5dpUp8b
- MD5 SHA1 SHA512 SSDEEP