Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe
- Size 2.6MB
- Sample241109-aptx8stbkl
- SHA256 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355ab
- MD5 2399a4a90a4f50e1d00f461263eae1e0
- SHA1 c3ff0487fd4ac8139d69e2875a22ffbfaa8b442e
- SHA512 c4cd835db83208c5b513b08a640f769e3bddd6b7a4a5f05da5da2b7c604ebbacadb9d0f7bb34ddd21ee3aee55740c03fe39904f4da0c1242e801fe5d4eaa70d2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBhB/bS:sxX7QnxrloE5dpUp2b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe - Executes dropped EXE 2 IoCs
pid Process 2200 ecdevdob.exe 3560 devdobloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvJA\\devdobloc.exe" 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidH8\\bodaec.exe" 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe 2200 ecdevdob.exe 2200 ecdevdob.exe 3560 devdobloc.exe 3560 devdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3108 wrote to memory of 2200 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 86 PID 3108 wrote to memory of 2200 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 86 PID 3108 wrote to memory of 2200 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 86 PID 3108 wrote to memory of 3560 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 89 PID 3108 wrote to memory of 3560 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 89 PID 3108 wrote to memory of 3560 3108 267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe"C:\Users\Admin\AppData\Local\Temp\267d49cd7876c6633880fa6cee11e98e836a968a0eb9a15b60823e01a3b355abN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
C:\SysDrvJA\devdobloc.exeC:\SysDrvJA\devdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvJA\devdobloc.exe
- Size 2.0MB
- SHA256 ee34505aa690c779ebc1aff703b255103802dc2daff2cd63c22fdf20d69fdd2b
- MD5 76af722fb5f2630726c1059bcf445220
- SHA1 129b5a9b39a702a60fc9d67ca6db6fc22bcd1a7c
- SHA512 619640ef4e2e19186a9b9f3899fd7bb1bcd0097d3409d4fbe005bddb5a6726fc287e9317827fc35fc4831a261f2ea93627351cd0a7c0dbd2ebeea0864a90a205
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3K:sxX7QnxrloE5dpUpB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvJA\devdobloc.exe
- Size 2.6MB
- SHA256 fcd6d248690fb0eff24b25f2736782dec1236613afcb0b767efc30c19a5a9fe7
- MD5 78036c7e709f89ab9426430eab0e39f0
- SHA1 184e1b5bfbaec91fece5d523460cb3515606d17a
- SHA512 5c8349cd326cf5058eba29e5435495ac5e9f5dee64b40b7040113af0560ff7a5521e642aab9eba1e9d18c8f4bba0bd2318009309fce7a0a054383968b1ccbab5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bS:sxX7QnxrloE5dpUpob
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 9a49db96b5c3b7017bc1c073a56c4eceb60c112063d79a4e857d61fec4f40542
- MD5 a37f0019dfb2c378f52dc0cf47783760
- SHA1 09d2253a0fe1fde352354e49bdc36644c01742ab
- SHA512 4bf1011ff918061eb6a4fd26d27d4d458a9ca0e9daa4f45f717eb5490ef3a1ebaf7823ca3f2f00c310168590ea38d17838c9f04274c4c5541b77fe6de2490ed5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 1d69f27cbf0d90516a5b060653333d887eb930e8ad6329fa63c2e7cfe6b41498
- MD5 4a322222814e1da1f9c8afd54ec53e49
- SHA1 77d1f44651e1513c60987d9297812e22b37f0319
- SHA512 cb8851b63b497387ca574643d774cf86b3108543aa3f873ff14022d39259dd40e38b550169a7aa846972ea209338f3c6a12e2c46f3b1675982de2e17fe0839a8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe
- Size 2.6MB
- SHA256 b9bb46cacb04e01b4b39b7458afe1e44abe4e1a3e7f6aca068a001646f1b95d5
- MD5 814838173045c717bea06340515e6f7e
- SHA1 82ebebad2e9961e0287d77146cb267d8b7a0ddc0
- SHA512 20b0fd9177e72a017c4e31746edf5824a2ca265a78daeb2e80fc95ea546102d17b70428800d41caab6bc48476515f22eef42610560a461470e29011b92e7abcd
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBuB/bS:sxX7QnxrloE5dpUpRb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidH8\bodaec.exe
- Size 996KB
- SHA256 864d6aa86fc114592802683cbdf9e6935d5216625b6215360454926e4812dd83
- MD5 c41a9ba35815d82685bbc9bec1eb799f
- SHA1 7710c5995fc2bcac5b4a9b0a6cf13691e9e0199c
- SHA512 b25d7d35d1abf6ee2b1b96ffae13edbcc663bea4e2db9446743f6d6e0170999c18ca08a8e2efde2c9c7230e2523983e7701dfbb84ffd337bc91204883b94936e
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtoh:sxX7665YxRVplZzSKntlh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidH8\bodaec.exe
- Size 15KB
- SHA256 d451bfb56a9629b7c961f22f94e615ae1d66d53c909dab9ab26f8c2232159dd7
- MD5 baebd565738a73b1785d23f85b9b1880
- SHA1 3e776227196d9cbee3a9edf120876f20e6af105e
- SHA512 3bc0de8b170643c38e93f2b6c116204a135a96435b5202c60c580af12b14787eda2041a92b0dfede92dceb5ad1f7dd232671d472556ccdd7bae26dd1918902a0
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVK2:04ezXTIk/IxT/ES70S7TqOODV5
- MD5 SHA1 SHA512 SSDEEP