Analysis
- max time kernel
120s - max time network
16s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
09/11/2024, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe
- Size 2.6MB
- Sample241109-bdxqesterg
- SHA256 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782e
- MD5 2cfb75b6fc92bdf2accb4e1f27e82da0
- SHA1 d8d7e2b38af0afbfca9992c803f924d5605eaf29
- SHA512 b81525fc491ed82755b2423036c395f75981a4dc8bc0ca1251dbf65f5ba6686838214fd7e6ab913882fb7c305390320a93718fbd591920dbff9a5512564093a1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUpPb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe - Executes dropped EXE 2 IoCs
pid Process 1720 ecabod.exe 2316 devoptisys.exe - Loads dropped DLL 2 IoCs
pid Process 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocU5\\devoptisys.exe" 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintCF\\dobaloc.exe" 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe 1720 ecabod.exe 2316 devoptisys.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 576 wrote to memory of 1720 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 31 PID 576 wrote to memory of 1720 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 31 PID 576 wrote to memory of 1720 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 31 PID 576 wrote to memory of 1720 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 31 PID 576 wrote to memory of 2316 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 32 PID 576 wrote to memory of 2316 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 32 PID 576 wrote to memory of 2316 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 32 PID 576 wrote to memory of 2316 576 1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe"C:\Users\Admin\AppData\Local\Temp\1a4fe0e61ace8b4099882963e2ab1540a9e135854a987885586f4e2f2de8782eN.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
C:\IntelprocU5\devoptisys.exeC:\IntelprocU5\devoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocU5\devoptisys.exe
- Size 83KB
- SHA256 bda98b555af31d8936a6e51f0606cd36b4f0d582ce0bd86edb05a535da995770
- MD5 fb98e9eebaad1be4e7101e2ea8240a74
- SHA1 ce46d18926a325356ae59e0ce5a5b17b212d3d77
- SHA512 8b4a0e5a2f66a544d4b975da9299c3226d841c410d4b14f4ddaca6b3c447843bdcf7d356a40380bef2fced1e549f82cc2ec8ccc0f918c48bad5a3d819843812e
- SSDEEP 1536:ABalOBo1TKFO3n0KkZHqX7+g2lWXQmMc0pgUXwiyx7:6uOByTKI3n0dZHm7+zsMcSgUXwr7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocU5\devoptisys.exe
- Size 2.6MB
- SHA256 95a74292b5016b745c2ee574282e0e61c0ce3bd4ac20c162137d1c05556be6b8
- MD5 244f20aa9235230d89b1560f36be0ea6
- SHA1 5980a87cad92aa7561d299fe26b87067ab570a4e
- SHA512 3fd6afacb3fb5da1859af7ecc9cef8b926820206df01068441571917c8f36bfa9b38ce79edb7dfc83faf7b3a91e923421b3ca754f0cd46e25e6c00b007751b26
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bS:sxX7QnxrloE5dpUpHb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintCF\dobaloc.exe
- Size 166KB
- SHA256 071994a933a7d9a7866baa5952606cf60d0aba191050770ae08503697523b7fd
- MD5 06d22b7e583d154d21ddd9ade5463e53
- SHA1 fe5e4bdc0d78dddaf8e0dc3b272659a4b73caf39
- SHA512 2e2851f1f8703e8d7481ac1df507da3a64b0c8291f84b4d1022777afcc17852a478eee084c3b36cac7d05a435134589b20493305150a22b0a92156be5671df72
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vfGm+7s+ndOPtiTO:6nyJ3n0Dm7+zm6wr6YEjAumIO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintCF\dobaloc.exe
- Size 2.6MB
- SHA256 d5aac268350e36878020200c76f210cd0eac611270dcd9a4eb7fffc4c0baef4c
- MD5 15e16b1afeda81c2038360797059a002
- SHA1 7ba7de3cf7c641482ef244f9cd79157cf081a5e6
- SHA512 53e4ec0dcbc8fd64438f14ed23da7456aed086e8fc4d327a9a4c1d699f342b23c9bb14c016cfa34541924f0278df7678e94087b7bc570d0c5227e8d03c5b82ec
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bS:sxX7QnxrloE5dpUpCb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 174B
- SHA256 528802817123bc0d61106f43134140c9c4bb376f2c66a2867d1c383cb21ad50f
- MD5 379708a922b6501aae1661250c226e35
- SHA1 55f769357701aee966ae5c228f32c152441431c8
- SHA512 bdc2ee4e46f992ec1c279eb74f55c50bcb4c6343d6a1da5aa4999f5c033237eb7475d1ecf167f95f7cc3718df9e8cf73bc36b50b88ca40c5cb07c3ad3a5b3186
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 206B
- SHA256 0f21d668e6960d744a270774cd623374d8aea8f931f678fed0cb6b61807bb5a0
- MD5 75b550bac1cc4124d7b78246aae24971
- SHA1 d48903668cb30d0e8f31c3b81eeae07e0d8062a0
- SHA512 6c0c9d0bde3824af1c850ec25709633dfceebe7882c2cd81f287eb5324eb61b5533ebb0bbb110ded02018b191fd63463320435bf0eb24fedde168a2f4451f60d
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.6MB
- SHA256 afe1a40311437837fbfbf90d0a86d3ca02f3d0b257114fcc80a0255afdd24134
- MD5 cfa9574a59f09979d9dcb0d07abf6632
- SHA1 a19e64ba19df6decd798d35b8be6e21d6ee6c840
- SHA512 a6d82e2f7cd3719e2bed065fe145de49220243dd288e0e34dc8037058535c20548eef5607ac5b8d94302853c950d175674e8418db88a1060063142aeadb33537
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bS:sxX7QnxrloE5dpUpcb
- MD5 SHA1 SHA512 SSDEEP