Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 00:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe
- Size 2.6MB
- Sample241109-a3y44stdje
- SHA256 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09e
- MD5 51bd0727a21cd70e6b4564323b4d1950
- SHA1 e71562443cb1afc0712b9951e913e623fc2e9e8f
- SHA512 c81dcbd43f4704c38fa971c7b1623e5812b6801b525085440a183b12d44cb0d0ce4e1e68f0b64587b1141547143ff1839406ca559c8b6ac267a07ca42ae050e6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bS:sxX7QnxrloE5dpUpIb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe - Executes dropped EXE 2 IoCs
pid Process 3744 ecdevdob.exe 4788 xdobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvWW\\xdobsys.exe" ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidZZ\\optiaec.exe" ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobsys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe 3744 ecdevdob.exe 3744 ecdevdob.exe 4788 xdobsys.exe 4788 xdobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3896 wrote to memory of 3744 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 89 PID 3896 wrote to memory of 3744 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 89 PID 3896 wrote to memory of 3744 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 89 PID 3896 wrote to memory of 4788 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 90 PID 3896 wrote to memory of 4788 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 90 PID 3896 wrote to memory of 4788 3896 ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe"C:\Users\Admin\AppData\Local\Temp\ae056fdbb60e6f4301b8b4c683554666433b412eae38419a2d058d1c7968d09eN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3744
-
-
C:\SysDrvWW\xdobsys.exeC:\SysDrvWW\xdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvWW\xdobsys.exe
- Size 31KB
- SHA256 fb9f9c9a72e0e98d461054f92faed7837baed42691d98807657f573b5375a6cf
- MD5 6767e44b8f8de6e616ff4b3523b078e9
- SHA1 c871cc62c3911e5350a063da1333dbe1aede5281
- SHA512 5660382a8368b7e9ffc099dc84a891904199c2feaa7bc7a16b39b7231f5102c04d6703a2b85492b3db7f9c101333e9b3270fe6657fd524d50c26b9d07958c2bc
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+s:ABalOBo1TKFO3n0KkZHs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvWW\xdobsys.exe
- Size 2.6MB
- SHA256 71b4ec7a72ef6425d54b26cea533b63e2e72153e9880e7a45311cd206ffeebb5
- MD5 6bf62b2503776e1a861b65ff8d7f09ca
- SHA1 cb1dbe1458ffb152f775dff33910516fd7e4f2e9
- SHA512 27c90697b2448e9474ff22eb91ee671f540eb847cae033989b675949b1c4432495da8ec39c755423928748d86ab87847becd03010921210fd1bb8c1da153db5b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpjb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 77971685ba8d290497202b933ca38ddcfab50b7f9c390daa22a6454c51dc300b
- MD5 3ab07a5db65c98977bed8e761b6bea31
- SHA1 f5040ecce7170b1f08db0d6aea3e4b7de419f9db
- SHA512 4fc850f1d97fb258b42dfb917526ff013245e680c43c7dd3a8923ddf6511a181eca878d8f99355d7f38de2a5c3a9444f7627888d0cffe6898efe71550039c01c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 006475ce7ebeb502cb076ed099221f488538b7485981767d175a4bd421f9ea25
- MD5 e88c09ac92072eb1a9eab4017dce9106
- SHA1 15bf55b822102bcac4d5f485fa37bbb46bd20863
- SHA512 3ce9c1c63c7ccdd49cea77d1ec553681163cb3a298783b90bcc4f11319c385cd285779b34469cdda9de5ea12af6fbbf73062e9cf10ced07fdb2b1a38e8ccba81
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe
- Size 2.6MB
- SHA256 b025172c830983d3c2eb6b3fee3fcf94eef1515c0173dbab0a9a78c32303558f
- MD5 f56367c47328218c3c0c3c4837a68e18
- SHA1 6cf0ff5b2c2ba2c5e065f426b2f7203021c6dac2
- SHA512 74389f147018cd6495bea5746afd883c7fd4feb603c2307e46dd69aeeb4afa63bd4a6de4551a6c95daa1f2de5bf41ab1eb4a0aafe9ce291c65c38715ce1c1427
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bS:sxX7QnxrloE5dpUpib
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidZZ\optiaec.exe
- Size 2.6MB
- SHA256 2f0f4d81ad53119592381a5d3637573f8aa9ef1fad04baf7cf82c90c3a532ea2
- MD5 74824746afdf9ed116c3dbe67eea497f
- SHA1 bde2ba54d4ff19e55bcea40b87d1c4ca74b1e7d6
- SHA512 e8840c01aad39e2b9ac9c27636803d49f02d4280fc5eacf5c2d0e6f5b8404a7901d8e8de0c53d9720354b6834ed401513bb4180b77f2d958a8d0d284cbf63be7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bS:sxX7QnxrloE5dpUpBb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidZZ\optiaec.exe
- Size 80KB
- SHA256 d7b7e07d89dcbba11e265aed832017bd483c07d2d763a3f8301e30a25cc9fb31
- MD5 e7900e914638246cf56cdfdc731ede41
- SHA1 207b36787e586631267d2721e4153af2c6acdf25
- SHA512 1ae46b5eed9dd91e7218beb847a39248311b3880c183693d43099ca26cb5a41b7b3c2d558d1a9634de775425aa73f26e07f838ab4aaa416b6bef700be14244fb
- SSDEEP 1536:ABalOBo1TKFO3n0KkZHqX7+g2lWXQmMc0pgUXwiyL:6uOByTKI3n0dZHm7+zsMcSgUXw9
- MD5 SHA1 SHA512 SSDEEP