Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe
- Size 2.6MB
- Sample241109-2wntcatgnl
- SHA256 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb
- MD5 e27f81c62b8f4c4bf6daae1331d2ea36
- SHA1 8a982029dfde8612822543656f4d28ed56470046
- SHA512 af89bb8b0df6ceb0ebd5b160c6f54aaebb6a5b0f52a4e43669beebb988f7752afdc3bc736337610c4351fb98a7c0cab6d8e7fb1e55ca561286d090950d2e3ac7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUpLb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe - Executes dropped EXE 2 IoCs
pid Process 1928 locadob.exe 724 xbodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxWC\\dobaloc.exe" 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesK7\\xbodsys.exe" 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe 1928 locadob.exe 1928 locadob.exe 724 xbodsys.exe 724 xbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3940 wrote to memory of 1928 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 86 PID 3940 wrote to memory of 1928 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 86 PID 3940 wrote to memory of 1928 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 86 PID 3940 wrote to memory of 724 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 87 PID 3940 wrote to memory of 724 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 87 PID 3940 wrote to memory of 724 3940 651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe"C:\Users\Admin\AppData\Local\Temp\651a17fbf7f0b3d3cc5b4e41e51b737841814802fa07541db08816f0ce4459fb.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\FilesK7\xbodsys.exeC:\FilesK7\xbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesK7\xbodsys.exe
- Size 2.6MB
- SHA256 7ef17d9f06f3d277a5f033d27e8b3f5992a059aa52f8e1caa48cbbd9e7d6734c
- MD5 7cec1645b96bf703a2ae0ac4863dfb20
- SHA1 a234511ffde0d90571c403d7b69641cb9a2ebb21
- SHA512 ffda8eadd4e65d4eff4511e50433a5353668f989dfcd5b145a87895755643aff91ce8694c029a01cacec7cafffff7a24b1cd155f954a26195adcb36bd09d0275
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bS:sxX7QnxrloE5dpUpDb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxWC\dobaloc.exe
- Size 2.6MB
- SHA256 f03e8eac7c8604294322f044b78f17a2c3ac07bbb001dffa359f3d4dc5526f91
- MD5 37a6f50bac4295ed3e22168f7de58660
- SHA1 27aba0da7b7e430242723f557495e24c262299f8
- SHA512 0b61b548f9b5da1b35ce1968483724f4c6806ab5a8dc4b99e74b33bf820e044607220707bdb117c83ca70d9615da4f9a3132ee3983516946d2349fbe164f5327
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBZB/bS:sxX7QnxrloE5dpUpyb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxWC\dobaloc.exe
- Size 2.6MB
- SHA256 a3ddb455231fe76dec66fa33b28e141310b1dd510536a5211e12757d729093ce
- MD5 355b23c5cc39086ab404d7fcff08be21
- SHA1 f01e416d2ea8850a7f7766a0793411ed7f95d854
- SHA512 0553c5ac41d114ba83dd8872bb0a4b8a9af9ecc583300239d01af3f2a65f28bbb87886193a95bebb90495f1b0ec8c5eaf2845cdc7a531123fc51ab285a9c3c94
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bS:sxX7QnxrloE5dpUpFb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 7d7b678da1336a887fcf47f6ab74947b92f5d8d6d10da527deb4cbb492e815b1
- MD5 898866b84405dab42e85d9c4ea594369
- SHA1 168b87f11a9386fd97e3524f194d47576f666801
- SHA512 5ab86e7c0e65bb165580168acc7695fd8122e3492ff96dca3fa46eef007607ea29efc5dfa1678cec3f90015056ec582f0cb688d97ab093cefdefacf12b2b1c98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 472211e6fe8c02541c428b3ce6243862be86b994bdb67da1fe5ab8c44ba072cf
- MD5 a386e497fbbc1517d15109351e5f4c3c
- SHA1 b31952a6da76e24c81f94177703ea085fb1f7f39
- SHA512 6eccaba927e8a140bfc5f50c6aa0a5f59b2fbc7e9019321dc71c2353fff15c20d009a7b294df271cb9676663e00421595db5538b6fc6ce706fe8b54e18e28945
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe
- Size 2.6MB
- SHA256 5728b65d21529e7ba3ff8fe653720f7b5d512e5ff41c9a233584350c8db05b27
- MD5 5e65609b98d6e5fdd87397ff003d056d
- SHA1 11dce9e7b12dc94d4ca911864b01d3c00a5966c2
- SHA512 e5eeca4ebdc2b8e43b0131cb184b96f2c680e9343f075a7b37e98a28b4eb1b3919d9d44fd0e0e984171937282f951780dc4d57541d249de8dbb1fe987681f080
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bS:sxX7QnxrloE5dpUpUb
- MD5 SHA1 SHA512 SSDEEP