Analysis
- max time kernel
119s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe
- Size 2.6MB
- Sample241109-2ytsdatgql
- SHA256 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49
- MD5 4b7eabf5ec5e530e68a32a7a34e0d9e0
- SHA1 4fc4dcfa02bad5813441da5050db54fd410447a1
- SHA512 86f22d56d028f7b5139544d840ed85476a0ee6d283411e15455e7ad90f7d6459ba1054c78871f4e618c51be3d6b417bedb66afb35297e60e4dddf35fafc9a704
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSq:sxX7QnxrloE5dpUpPbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe - Executes dropped EXE 2 IoCs
pid Process 3808 locdevdob.exe 3704 adobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocY2\\adobsys.exe" f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidZ4\\bodxsys.exe" f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adobsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe 3808 locdevdob.exe 3808 locdevdob.exe 3704 adobsys.exe 3704 adobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2632 wrote to memory of 3808 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 86 PID 2632 wrote to memory of 3808 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 86 PID 2632 wrote to memory of 3808 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 86 PID 2632 wrote to memory of 3704 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 89 PID 2632 wrote to memory of 3704 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 89 PID 2632 wrote to memory of 3704 2632 f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe"C:\Users\Admin\AppData\Local\Temp\f5616e54a4c0b246668aa74f9b234fcaa08c763a8a1e24f4328340a9984dec49N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3808
-
-
C:\IntelprocY2\adobsys.exeC:\IntelprocY2\adobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocY2\adobsys.exe
- Size 2.6MB
- SHA256 b6bc904315817b13c559bf489cc46b5386506ddea0ea7f56559b9c89bbb3f3e7
- MD5 afad08bbfba551c8062f2ab185275936
- SHA1 4d85e70feb2e66c212eb1000a21a21d6a98c4fc9
- SHA512 750c025546123ae4d4dbd9c46c65b022a591bebdfc572bfde98dd9d0a879c95865af5bc0ed7668d478f0bf39df6ef9e15a19eb4536f2f844cb3a7c55e92ed7d0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bSq:sxX7QnxrloE5dpUpibV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 570b957adbaa34fa5ef69974dd6f50976adc0454e62a4bb6027fbf5cf6b3ddca
- MD5 3879fed8cee679de96163565207cb50e
- SHA1 ed50cb0e6130f8b1796ede19dfaa38f5dc0afaa0
- SHA512 d7e75e73396385beb7a48ba78a9a6cb1c559ffd63eb4c674ebed0f4f76e02164c539ba7b28e87baee02e95b155aa1fa46581967fdc195bb78fd341be4e9fe1dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 fbc9eff0c4e2f3b62fb6d632a010339dd51db9d2a4e063ec70a20b25484732e0
- MD5 f436fe30c6edbe61321163fa677dc414
- SHA1 32c5a625f9a7fc71109e9cf4cbb665443acdb4f0
- SHA512 c3e3528cf1d450bda2d5ce497ab26654ba9acba45fefaf180ef6fb4acbff9d206f1f785ac015b44ca7e7f8ddd97921d57b235ab53e4b237ed80c8eee0ea2a5eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe
- Size 2.6MB
- SHA256 c54fe40868f0d6e0950acec53af1a66d4864e7997f4cb3d2de3765cf8138a292
- MD5 2b480f2f5aedfabc569c936cd676e1a1
- SHA1 b4d737360f2eede0dc0a1993771417664d9e8150
- SHA512 b9cf8fead965c3a65a688a1bcb85feaf85969523dd3d73adb0ca33a4dfd8cea0aac7a2ecfc7221e2e3817b7a3774daf8048052befc10bc256b133b41ddba79b4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bSq:sxX7QnxrloE5dpUpobV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidZ4\bodxsys.exe
- Size 2.6MB
- SHA256 e28a388da0b84a12e0180c4b88bfd609ba4f67201350b4851cde316678fdc088
- MD5 ff9b52e5f3503f4863234ef6b1131e84
- SHA1 1fefba0594e71cbf7729f73920a9770618ed93a4
- SHA512 20e1ce0ca2d92d23306c9c3b2b02d1918d0688ec9e86527f0a0a517525d4da9264255015260e7f4eb98328821be05e6a0cec4c1b22d7b9523a6bb0911c697675
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBFB/bSq:sxX7QnxrloE5dpUpObV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidZ4\bodxsys.exe
- Size 831KB
- SHA256 7875a092a8cec9561b89199746a416d4b5249796116f2c53752c0d7c5ad7302e
- MD5 43426d85f5483c0ab1e12849ac73d600
- SHA1 cd4d165cb167fc7f7a8cbc57056df9b790502c59
- SHA512 f35b50540dbe5c71928efe70fa4d2c085ac3452bf0e71e150d1b9859b55fd266add605349b678d40dbe61f3f0b77cfb365624d376cef16d15ffde6447f8507bb
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhF:sxX7665YxRVplZzF
- MD5 SHA1 SHA512 SSDEEP