Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe
- Size 2.6MB
- Sample241109-3as2lsvaqa
- SHA256 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08ed
- MD5 6f42d1f685824c8c68967020f84781d0
- SHA1 90fbf2de8bf8231a300766cbbb928f65044ecbc0
- SHA512 5011261665bfcb5dd1f83e92003a5b3d0e810a0090a463c340027164f61df9cc0496ea8bf3e66d8d60e0433147e4f6c282a7d896d22b0eedbfb7b134eec92386
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bS:sxX7QnxrloE5dpUpWb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe - Executes dropped EXE 2 IoCs
pid Process 3544 ecabod.exe 1988 abodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocOH\\abodsys.exe" b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxF1\\optiasys.exe" b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe 3544 ecabod.exe 3544 ecabod.exe 1988 abodsys.exe 1988 abodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1412 wrote to memory of 3544 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 91 PID 1412 wrote to memory of 3544 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 91 PID 1412 wrote to memory of 3544 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 91 PID 1412 wrote to memory of 1988 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 92 PID 1412 wrote to memory of 1988 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 92 PID 1412 wrote to memory of 1988 1412 b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe"C:\Users\Admin\AppData\Local\Temp\b8a3601b2a5de5ee3088a8024ba1a8efb5d0149677646e5a4c2486a3a0bf08edN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\IntelprocOH\abodsys.exeC:\IntelprocOH\abodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxF1\optiasys.exe
- Size 2.6MB
- SHA256 c7fc762fb0c997e85b4564ecb4a4cf05cb37dd190a354919374d09224caa799a
- MD5 38fc72907cfc600276836749bf80b23f
- SHA1 65c303304ece5c05f3df5db47eb5750c9497794b
- SHA512 1569687d18a61fc6f85905cb0a2ea55a6fcd5a9a502e693db654593e2c8292c88d9ba6afcafaf0349ebfc0626d97fae154744bd5637728db37e66d726d7c1417
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bS:sxX7QnxrloE5dpUpub
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxF1\optiasys.exe
- Size 10KB
- SHA256 8f668b87e4832b3682e49e6eea02d09a2d52047043f9b41e1307714539fe88e5
- MD5 a86336805b3d53c18600c251ef3cfa32
- SHA1 69594cfc6347aa438b9319dfca41704cf4607aa6
- SHA512 2289aa68a1720b6b54b1913d01bb230aec97ab071f17ff538689c6b271251aa3ed7892701d4e16f229faf7c3ae3b844cdb8bcd576a87134fff3c03d46ec4bc93
- SSDEEP 96:3k1Ycg+n1FZlXnzDnznTT3jkHnHO1n9dn9FhXYitdWYeFn8PM/EKRd9pPR:0fgezXzDzjUHK9d9/XYxFn8E/ES7L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocOH\abodsys.exe
- Size 2.6MB
- SHA256 e965c3c24e0dfa9b89b50d7c2e007a557312103c8a7e0acdd99ae6dd5c4310ef
- MD5 f9df0d601a147af3df7da3bf0c026680
- SHA1 064f9b5464bb372d9adb13f97c74a2fb7f7f412d
- SHA512 bd37944742dd00bf2770600f5c3efc4f8fe282fbf4ad44757843219002e14f4be66953fa0d7ee30d73bbd762bb8fd8f986d3183ee1eac356162fa24998787826
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bS:sxX7QnxrloE5dpUpeb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 198c5ca49eaefa7d308122d4f49adcae535b3d73ca0b0d75c4d21835e89a6c28
- MD5 902f479d074e2eeab149febd3171ad46
- SHA1 0adbe8823e35a6594064cf3649aff1b8e6507350
- SHA512 2795061c8a0038bff58b584960f89343322701ea9aad35880cba7c7912ed4d91584c8f8949507fe5ac2d830e0014a35300a7445d07bb273a2b0dd7a5b8ea8c6f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 91f2a1478b8b92607ebe20de25b9a2c70e845f3ca3cb2f0889e7dc52cedcdf80
- MD5 7c611d99450c541451a9f90a09ccb13e
- SHA1 c035a9155b3db35d0330d0112427ced868a20d06
- SHA512 75169645d0e3ee2b50d8ff0b2529d8bf0fa14edafd85838e0aa8b52736cbe4722cb46884057b95f9eb69149337625407d7df4a2424d8840458d1a3f4ee9eb87c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.6MB
- SHA256 b7fa5ee15eac3af5981449af538ada53b49048cacd20019d172aa525512bab82
- MD5 725590bccfbab247de630e847a10dc8f
- SHA1 d7f1380e00940e802ed6337f80e86f19adf3cac6
- SHA512 38067346e6e7048429800efee7b90455781db4d60699ff90523c296bf019a3714cb68f02d84ca430022f000b44c2c71d13d28d9d75452c8a758cafd6445beecc
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bS:sxX7QnxrloE5dpUp9b
- MD5 SHA1 SHA512 SSDEEP