Analysis
- max time kernel
120s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 22:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe
- Size 2.6MB
- Sample241109-161efswndn
- SHA256 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fd
- MD5 bb1d3ef4f3310871466e10dff6128d60
- SHA1 55fd891240b6c0085626120c0d4ac4a965dd6015
- SHA512 f7276a67c7b52d3d031c30267188ad45be77b4f57110cbf8e9c80463ff845b5df1b12e66f23667badc59aacff9b2271e7cf258e76e335b2c1412f0e9f8086f81
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBbB/bS:sxX7QnxrloE5dpUpsb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe - Executes dropped EXE 2 IoCs
pid Process 924 locxopti.exe 1900 abodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxTE\\bodasys.exe" cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotW1\\abodloc.exe" cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe 924 locxopti.exe 924 locxopti.exe 1900 abodloc.exe 1900 abodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1488 wrote to memory of 924 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 89 PID 1488 wrote to memory of 924 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 89 PID 1488 wrote to memory of 924 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 89 PID 1488 wrote to memory of 1900 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 90 PID 1488 wrote to memory of 1900 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 90 PID 1488 wrote to memory of 1900 1488 cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe"C:\Users\Admin\AppData\Local\Temp\cb7347d974910c24312d3be196373cf8b6bcf8bd7dc29ca382a8f316740301fdN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:924
-
-
C:\UserDotW1\abodloc.exeC:\UserDotW1\abodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxTE\bodasys.exe
- Size 1.9MB
- SHA256 74d50b3d6051cdf098da70f509c9acbe36727269fa21e79a5f569fb4b641c7e0
- MD5 d6596ff69fb3ac2b0b251b7bf22d8aa6
- SHA1 b82074e82bdaf089d3d20f7fc9c523d10061a81f
- SHA512 3dccdb46687e38bba8e17bd9e39bd78f5a6c99f879320a1fb3e854c8405486fb686b4ab69707c3532335434ca783a1506a59c13fdf73a7735fec89d14feed4be
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3h:sxX7QnxrloE5dpUp2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxTE\bodasys.exe
- Size 2.6MB
- SHA256 13a747188840645b348dddfc7644741c4eae509b94656eef3faa52582fbc686c
- MD5 f2b477651722c6d0d63ffd320983a183
- SHA1 b9bc90137c1de0290301134ee521e3cca5e4ebce
- SHA512 778665531b914e8991d24f77bd6930f4a2e7d8579d7945e10cd5e80c4a159fcea1ebc3b2612b21ccad8f4f61c05b19cbb4c869ca2ec46fef5a48132c8106e45a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUpXb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotW1\abodloc.exe
- Size 1.6MB
- SHA256 a229bffec14980996ce1d9d71b2fd4cb6317030066ae374f700f5b74dd137dea
- MD5 c6919df89b17ec159067370c82cde0cb
- SHA1 dd2a2790ead36effa0116968dbf92f078c622b26
- SHA512 ee1c834ced14c0ae8ecf331fb49824024a3c9fe2bbc6c376ef949a54b06c8bc79f7c88a3dbf5b19bee428e7701f25ddb78a702f5b271cccd31696127846b1b2e
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDb:sxX7665YxRVplZzSKntlGIiT+HvRdpcF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotW1\abodloc.exe
- Size 2.6MB
- SHA256 8653c912c694d7ba1360d3d171aabb94947c3b24b8e2ec8bdcce9e984f593cc5
- MD5 cf63b866878c919153764a29a4d93b4b
- SHA1 2f8090d6398eff685d4f708f0c178f896310dd06
- SHA512 6589fd85e6b434c425ec45f2cf16ad4bc31ff18332a6ddad1d06149185b5d8b5f2b41118bf0ac67abe94895c813ce00c763a65a089c7dc5bd97adf97530b887f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bS:sxX7QnxrloE5dpUp3b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 2143eeca3e4ac68299282b0311aad1813e32e631390efbcc67ba83b2abe8a35c
- MD5 66f39f21bdb0e4afd9309df9bc7562bc
- SHA1 b441ea8047a2348e6acb08fd9ef0c7f70382b51d
- SHA512 049e1f1c5601c23cc275d3079c888a11839dc0f17e9feaeafc80889b89ceb26ce181a7da7914c0ad068a307279940bda5c03e6424607208258ce93bb49147d0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 21d04477ac5af73e277b5119e5b91adcaed5367f10e22e3e60fb850d91aaa119
- MD5 53583d6151b92d7cd1a303d4c262e9e1
- SHA1 077e0e1c201cd5e53de87456daf301e659e0c54e
- SHA512 fbbc586a247f5b68cf9988c528a38a51e72bdac83d92f7bd3cb6a8d93584d480770c884ef0bee27994ae7a30fa345003c9b883dad76a3c19879f543574ee6e37
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
- Size 2.6MB
- SHA256 f8b036a5587ee338fb82fd41861ea9d939acf1e37f9a4bf379363e2ebd476c1c
- MD5 cd0bcc22a31b4047284faa469d7377db
- SHA1 7b72a577549c092d73b61e5d4e1341008d1fbd6e
- SHA512 5468913c1a6fde7d141aa7bbffddf8c4a9110b67de6c012de81a3754bc97eba9c2b2322de9867bea8abe9379f4d44647fc56fcaf7661a19cc9bd1aeb599289ba
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bS:sxX7QnxrloE5dpUpFb
- MD5 SHA1 SHA512 SSDEEP