Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 21:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe
- Size 2.6MB
- Sample241109-1ptwcawkck
- SHA256 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02
- MD5 4158024e8c8e448d1142280fa77af99a
- SHA1 331767a05bb0ca139549bb4d69fb63d1e0519f18
- SHA512 78c1c5f68075332c52909cc8f00bc1cc13652157937a7d1efb5a715b48e3130e709f3f7e7e44e1ab37c91c065869d46a03902f68046abd383bcc0faca60d5fd1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bS:sxX7QnxrloE5dpUp6b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe - Executes dropped EXE 2 IoCs
pid Process 4536 ecadob.exe 512 xbodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotT9\\xbodloc.exe" 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBCB\\bodxloc.exe" 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe 4536 ecadob.exe 4536 ecadob.exe 512 xbodloc.exe 512 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4716 wrote to memory of 4536 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 86 PID 4716 wrote to memory of 4536 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 86 PID 4716 wrote to memory of 4536 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 86 PID 4716 wrote to memory of 512 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 87 PID 4716 wrote to memory of 512 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 87 PID 4716 wrote to memory of 512 4716 46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe"C:\Users\Admin\AppData\Local\Temp\46b12b97cec2101b036a2f65ebc90b3b53e7c307cddc0efdec6301bfbb345f02.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\UserDotT9\xbodloc.exeC:\UserDotT9\xbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBCB\bodxloc.exe
- Size 4KB
- SHA256 6e27085c9b049479ed4b5d515c82d49091d1d0d6a70cc1af4fe1e085816236d4
- MD5 ede40b36034d11420daf9b761d447622
- SHA1 83e69cb72e12fd8ccd507bfa21133e1fca0fd5d7
- SHA512 0fc2330cfab1d7a2fa7e55f9cc177aa246de7f672540212721ca9232920652a2306906719e60af2bd37ca2fc9074d2244a5514fdc7f344e7c4006b4c69a75120
- MD5 SHA1 SHA512
- Path C:\KaVBCB\bodxloc.exe
- Size 2.6MB
- SHA256 2b489acb3592452e335fbb200cc44b7c6f029b10e48afaf81d1022f6a1cef1fb
- MD5 bc5a27a037a9e2fc5548569554924a29
- SHA1 007252a0086b20e7f78247cc236aa7b3b8985f7b
- SHA512 706c6da8b310d8e3b09ce33e010fbeb84d06182c167b7f9a311a6b3d0189c1492b295382fdf1dd6e850f571ef744eb78309043d292354744b72a7eb84d783bd4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bS:sxX7QnxrloE5dpUpAb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotT9\xbodloc.exe
- Size 540KB
- SHA256 b1d9f76ae5fa520a5f1581f6c4008b450777ea0a8773cb6798a3c2201279a302
- MD5 a6de293817ec775c9207733eed6d1838
- SHA1 24fbc009a2d8812f98b8510330c9c0f25135d40a
- SHA512 bbb50134b01e29441363a6a59d1f75833316ec6173f6cc01aa730dcc0b2986dc4e32396ccd2776abd0fb0525799775ee79bcbee7f0b3355ee9781ef6f3680b2b
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQE:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XR/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotT9\xbodloc.exe
- Size 2.6MB
- SHA256 f318bcae9f543620c045abf2c994c232307597c440748d8161aa3dabf8535bfe
- MD5 60acb0bfa70013799e97c02224b18f2a
- SHA1 9003253ecbb29622b4299e3c08996b81e31d9133
- SHA512 bea1221fb555d4ff3843a9fb2d96cbbd62a2e3363310d220affba261beba8d72af1814b51ceab71f00ed09b5b978abd6a474a25b4b10a1f6829455fdc0809d19
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bS:sxX7QnxrloE5dpUpAb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 b3d88870ce1ce53100a1b5a94697b2ec8c85fed268ce341321729b28814c0e94
- MD5 17ffdb9427f30c7d109fd7b83291e749
- SHA1 3684fcfba4ec06f7caf71ad609f8220348d4dedb
- SHA512 0da9962b9493b37cfbd37d051919a98223c7325a57fcbe891b0ffb16e670ae7a2278eac75bba7bb28667cae9022e7651b0dfa914c5a590315f23485b9432c293
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 009b0818b04a40c48214ddfc7cedfe6ddee8c939bae262fc5a46113161e4ed5a
- MD5 16e0b0ff87242930a6da6c3ecd52a17a
- SHA1 9306c4aa8966ed93f30f7be7dca8f07e982525e7
- SHA512 d50d3375e85de7a0a3bc2b82eb82f9a4e62e7b8e687312a6d5044e71ff253eac5f00ef366c96c0c78275cbd07a9f199e36a3ec19569333b5ab281d7e156d814f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 2.6MB
- SHA256 2cf10467a02a7e0fe3132ab6ec5de1cf929729c9a6c067f361d0ab32e57cd013
- MD5 b13dd8a818ed639bffd2610c6b31e9fc
- SHA1 fc81c3f6df3cd897e6e0c68cb4c5e048e3105806
- SHA512 20d9dfb56c35bf96e8b949dd8f4217100d0a8494b63dc89a3734332c5549135198363e924c6ffa388590c177dff23efef9a858e73084bb809417e52eb7f4e0c1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBGB/bS:sxX7QnxrloE5dpUpZb
- MD5 SHA1 SHA512 SSDEEP