Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe
- Size 2.6MB
- Sample241109-2cc8haspfx
- SHA256 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffb
- MD5 240b817bf355d8b3ceccc1c72d34fe60
- SHA1 4f943a26e4d6907a1997ae51609dec667964d57a
- SHA512 d8b6ddc0fd2ca0ad1c7aa6e8bf40e18c9acbdf4a7463204b53e54531f8075dfda63b0d4469ed22b8a282294abaa5f6e76cf14bf4b5479d1cbe6ee8361a4b7ffe
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bS:sxX7QnxrloE5dpUpYb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe - Executes dropped EXE 2 IoCs
pid Process 4992 sysadob.exe 804 devbodec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotKY\\devbodec.exe" a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZXL\\bodxsys.exe" a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe 4992 sysadob.exe 4992 sysadob.exe 804 devbodec.exe 804 devbodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4992 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 89 PID 4636 wrote to memory of 4992 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 89 PID 4636 wrote to memory of 4992 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 89 PID 4636 wrote to memory of 804 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 90 PID 4636 wrote to memory of 804 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 90 PID 4636 wrote to memory of 804 4636 a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe"C:\Users\Admin\AppData\Local\Temp\a0297986fb5bde80ac5da55eb988235bac0770c9dd62e7d76474e511115d6ffbN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\UserDotKY\devbodec.exeC:\UserDotKY\devbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZXL\bodxsys.exe
- Size 2.6MB
- SHA256 f42b2d285e92c0d5e5fabaed601223331b8f5f8a663481e62a9cf81f6aa0cb0b
- MD5 11350e9390bad12cf9e9b683224776a8
- SHA1 2024d456e520c7c54678abe371a753f8013b4ece
- SHA512 461590d741d6b672bcbdb48a444f54fd765361525b4ecdea8355aa3a8f426b4b583e3d093132e3aaae65464f06384f872f7c30135fe427b62ad7a80317864bf5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUpkb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZXL\bodxsys.exe
- Size 2.6MB
- SHA256 6e02ea2aae74d65c4c899cc34686745031bcbd78319297f1b71b7ac68ace95bc
- MD5 cb4821163d0afc6b8a4619d0a924f410
- SHA1 c5adf96fd83cf8c7e12746fedac8b6eb6c28717b
- SHA512 3f90ebcaee4fa757cb80902a5281e426aea04eb8edf25e9883ed237260af7b10eac50269ebb34e63df54a718be1ea466463d9f1cfe974b2689e757c27a97dbad
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bS:sxX7QnxrloE5dpUplb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotKY\devbodec.exe
- Size 2.6MB
- SHA256 f5d4ab9f731da9b7ec4d4420cc38f746e0cc52c4bcf604e6b47b3b072f531e23
- MD5 9ad1403bef214842c3dcd2d0f1a19978
- SHA1 61227341a282624856abe3ce21bc25be1a1e4b42
- SHA512 5d18c101b59164ea12c03d5a230bc95578f1e754007b47656db2311b2a6eca7cb1894cad98d604e970e8b200e0b652bb6c3592702f12b841a9b302339500641d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bS:sxX7QnxrloE5dpUp4b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 295b9457fae5c3c5d67754121be96f2cc51a8ece655bd6aa154c9ef1d8e59700
- MD5 53aa99e8a7f3b76d605f75eca4dd0f87
- SHA1 bae3ae04de71c548e7800dbd5c64c79e3801423b
- SHA512 78752c52af68fd20639bb267cc572f252789fe2acc9d2dbb3877d11249fc09d15e3a5cbe639263b4fb3ca26a0b36727552707fbbe548b825f2a66663ae22bd7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 e81e514f31cf47b0e3d1be89d12262e1ef1fce3f50c46d651ab56212d4a155cb
- MD5 a3f49e354fb9ba49d2827a731aebe900
- SHA1 1b6677e7b905e4a15c65eea17f40d8d4e84ec762
- SHA512 8eeee947ea34c236b60f30e9cc035e472ffd87940183e0db15fc71eb2c7e55ed324736484f93211978b87b833a1267683844a657b9593d3b2aee286b8917a141
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe
- Size 2.6MB
- SHA256 5169ecb1edfc98e0da7246e7f478317fdb75ad408ac986c2a2583d3717308418
- MD5 fa5f629a0d0d69ee11dbc52d98a882f6
- SHA1 e95eac2567c31bccdcdeb96bd9bde91ac68ee5c9
- SHA512 5ecd8499183bd80650cb192fdea0bffb986f07f3482f8c9a7ec83a340b596d34d767f38a6d3d19bc35c80099199f5b90f13b67b82d68cf8f8859c826142d14bf
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bS:sxX7QnxrloE5dpUpgb
- MD5 SHA1 SHA512 SSDEEP