Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 08:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe
- Size 2.6MB
- Sample241109-kldf7azqht
- SHA256 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4
- MD5 8bdb0249b63699b4627e918cf41a8a60
- SHA1 1319759a20b778d9b3d6ef55d68f08accd39d963
- SHA512 bccceac6172261d3752865051413ae82623731e10694933df417c7a32feded990a2f293a32e72ad7db6f57d2ecd9f3cf6776b3ed841ecc9e231515bd1479e5ee
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bS:sxX7QnxrloE5dpUp9b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe - Executes dropped EXE 2 IoCs
pid Process 5088 locdevbod.exe 4152 adobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv34\\adobsys.exe" 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZMF\\bodxloc.exe" 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adobsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe 5088 locdevbod.exe 5088 locdevbod.exe 4152 adobsys.exe 4152 adobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5000 wrote to memory of 5088 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 89 PID 5000 wrote to memory of 5088 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 89 PID 5000 wrote to memory of 5088 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 89 PID 5000 wrote to memory of 4152 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 90 PID 5000 wrote to memory of 4152 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 90 PID 5000 wrote to memory of 4152 5000 4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe"C:\Users\Admin\AppData\Local\Temp\4ef50de2344539448cbb905cb53ea0b9b73bc0cac25c2512446f9c0d0ad74ca4N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
-
C:\SysDrv34\adobsys.exeC:\SysDrv34\adobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZMF\bodxloc.exe
- Size 2.6MB
- SHA256 5726d2cde3ca87b7a5b7501b81dcf2e6fc8ec22f9e44efc6c115142548de37d6
- MD5 8595c0bfac35f81d1e5c7be0dd0084bc
- SHA1 f3cb5e54b71c919f31520e2145a15a4b408f05ce
- SHA512 32747b99aaf9d0f22ff85355fc90238d447d3c4bab2a1f55e3a7c2d9592da061ffef8fc60390c9966cf8ae9d29ebeffa2a83ae1405da1424e6ce35694be78a94
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bS:sxX7QnxrloE5dpUpJb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZMF\bodxloc.exe
- Size 2.6MB
- SHA256 6731b40cfd3cdbaee647314a413ed51736159b36497edd960a919c43930443d9
- MD5 53a3484eb749b7d56d55e1abe1454b52
- SHA1 10003c8af852b3b7d4e9da56c0f793cb3f08a6d5
- SHA512 b7f3cb82d7871413742edd157d714e3b309b69595dce488f35901a2478308df24a33a62c0bc3e15bf91479afe1ef126ab0dc9a9360b342c9fa3e4d5659e70fe2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bS:sxX7QnxrloE5dpUplb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv34\adobsys.exe
- Size 2.6MB
- SHA256 817b4da8d9656a1505b56519318e8a90b80a8bfd5a26a1cb83a39adc0241fb7d
- MD5 82e3cbffeb69c5e70bd0ce66b43d5fee
- SHA1 8d81cc62f5b8cf4d74b5d6760bc7cc044f77f062
- SHA512 75ee2a8655f7ebb1f6bb2a71016ca30ebe23456a59b406a653c4133aa8d7004b2e3ea33fab86ef86a0f6b4140800981d69ba29f1aeae30b13212ecdcc603b061
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBzB/bS:sxX7QnxrloE5dpUpob
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 c3c3fe9b923f4dca9b4ec156bafe397073dd5dd373294323df083ee84dd7af78
- MD5 646ef0fdb93d93f3072cb5ad49d02959
- SHA1 b3d24ac6249d596a38892e38e02c1a11cfe6670c
- SHA512 3e3b411472b1bba9654d48f84442a57789a9148e5496690dc307b6f6cb497ad61bdc08632d97ce7b8663689c8abbe971b10cbe72c76d91e354380244f117d916
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 3f91824e8f44f006879a585689e1f886977f0492fcb3ea59f5a240c02a2f6c19
- MD5 f138ecf497bd8f02402295c2560b36ee
- SHA1 cdd2d416a50436f43dccc070a88cc3e124bb2f63
- SHA512 c5755b5a12ef660e33af10a109d5e28b08ec7ebbc393b5cb1b8b63b1e799727a2250d87b8523130653e97d43d7d7fb72268ed613dbbf8ab304855317ad252bc3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe
- Size 2.6MB
- SHA256 fcea255d56e0d56304405a0a649df7d490f80e1d6684c639bbb94eeb47536564
- MD5 3ebfcbc6f1d762a1325ad0637c7b95db
- SHA1 373f064a8315716a6eed1aeee91a238630442487
- SHA512 c99158c7c619884ed1c4fd503dad18b30f0124e851cb4d9a8c2fc155fd33b857c4a01e9a6fd3018d1652d89e5787b6f0826d456ede197039c4a16bf8cc66801b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBpB/bS:sxX7QnxrloE5dpUpKb
- MD5 SHA1 SHA512 SSDEEP