Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe
- Size 2.6MB
- Sample241109-3xccdavelh
- SHA256 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61
- MD5 6630bb3fe6e2a131b5618bf528422f80
- SHA1 c1f952e3b47c5f8cb69c2fe90954553281e23523
- SHA512 98fa03c3999583c0ae49dccc5d7ebd4cb2892c4b87f8350c874f4bc46967a4f24c205b85878ea13f0d6c49345cc4d01b4f2db085519cd5e1545d9645498eefdb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bS:sxX7QnxrloE5dpUpCb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe - Executes dropped EXE 2 IoCs
pid Process 4672 locdevdob.exe 680 devdobloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotMC\\devdobloc.exe" 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZG5\\dobxloc.exe" 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe 4672 locdevdob.exe 4672 locdevdob.exe 680 devdobloc.exe 680 devdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1176 wrote to memory of 4672 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 86 PID 1176 wrote to memory of 4672 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 86 PID 1176 wrote to memory of 4672 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 86 PID 1176 wrote to memory of 680 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 87 PID 1176 wrote to memory of 680 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 87 PID 1176 wrote to memory of 680 1176 7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe"C:\Users\Admin\AppData\Local\Temp\7ea65f6e280ec323637e0d770cfce756063c4d1fe1602202656edc44221ffc61.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\UserDotMC\devdobloc.exeC:\UserDotMC\devdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZG5\dobxloc.exe
- Size 1.6MB
- SHA256 35416fdcfcc0e7e7ab942c1c6e66785d5597f6db24296c602840395b0e7f407b
- MD5 f4c9953475a57f69852518f4202293a9
- SHA1 e2bc0cea0f534515b3bd373f4241ccc294191f0d
- SHA512 26329a853276f10575d8f8b86bc67de1f2cce819406b986a14b1351b195ac8037bfa62bc15c60cbcbcf2cb7cb6e132eb4b21242009f9212f06fddb92171a7299
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDZ:sxX7665YxRVplZzSKntlGIiT+HvRdpcD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZG5\dobxloc.exe
- Size 2.6MB
- SHA256 b7e6279b9eb08a8f28eaa23b01c94657402a2ebdef829f0e8699ef2231b8562b
- MD5 8143417c23722f25f8606886ff58c159
- SHA1 0e548a9c03cd7ddbac2b4530d20fa1c5168d54de
- SHA512 7657fd9a94919553e9032989d6865dc948f458ee97ae458da954df38341dc645b7078571a590204f7d4bfc36a9469e5e779f57c0733de97ffd4733789fa73c6d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bS:sxX7QnxrloE5dpUp8b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotMC\devdobloc.exe
- Size 2.6MB
- SHA256 9e0483b2569be4c7f96aae7486149aa2a29ef36a8675950606dedc897fda3b89
- MD5 72616db050a1714c884fe1b6954998ba
- SHA1 6467412e198acec66ae695e769d6e72217f30f76
- SHA512 3eba3267c717a6da5c20417fa965e817b8678791e21bfcfd9934cc685eca511b39396abab479e47725c02f8e3646be6049eca9f84db9cd86a904f48eba605124
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUp8b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 fda351f1812515d59aeaef74a2c0f1f6bf1f3bc246f4b5a301aa6aa5aae44df4
- MD5 a3ea100a13cbc201a1103478b0eb0f0b
- SHA1 b48679f64d4e6f243cf724dc5a427e034b5908c0
- SHA512 13bb5cd325a4b40aeebfc6426a6717d78f6351f71cccb35e36f3de992f9d3603ccb70cc63ad147c52873ee2fa2bcb8fb9e4ab375bb10399328c0fb66563bbc40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 174B
- SHA256 86b3d5a61a4d865f4494a7e55595644cb96ed83f2854cc578b961a52fbf8ff1a
- MD5 0a70ba75a803446a0dd9b69a9d5b8b1b
- SHA1 3bf821b50d0faddbd23199fd84f23da34c3a7cf2
- SHA512 5623a64e3e57f6792010092aa9058d88a836eb019f019ef491b220e722aa2e68aa83022b63d3cfc618c4e5f6304f77435cab0882d73c0b0e14ff8f44a50f3fb6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe
- Size 2.6MB
- SHA256 67458d246375d63e49974a62fc67344182f0a435c1dc88af909e4b4741bff801
- MD5 3984a7d3140c19765c88ec12ba943e57
- SHA1 6d4542cc0742255be254cc92806866f8503c2c02
- SHA512 b84e4de9d0215a741a28abc94affa22841d4f51999a86278134e874934e970666e56bfece2259ab4e91c199e7d020b9cc4b0f76df46a158a5f9209563027041d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBYB/bS:sxX7QnxrloE5dpUpzb
- MD5 SHA1 SHA512 SSDEEP