Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 08:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe
- Size 2.6MB
- Sample241109-knm4ea1frl
- SHA256 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adc
- MD5 41c1a7b593e9978a41170832301a3260
- SHA1 2b22c212745bbe7938cbba6864cf2dad64b3bb0c
- SHA512 ca024e1934eeee010a2b25fcf471d240d996cd92ff840006ae36cd00353d48f873e23c587562ae6720840392a7e0afab03adbf2173fa59024d18f7c8c9a1cb49
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpLb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe - Executes dropped EXE 2 IoCs
pid Process 1988 ecabod.exe 4076 aoptiec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvCU\\aoptiec.exe" 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB0P\\bodxec.exe" 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptiec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe 1988 ecabod.exe 1988 ecabod.exe 4076 aoptiec.exe 4076 aoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 544 wrote to memory of 1988 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 86 PID 544 wrote to memory of 1988 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 86 PID 544 wrote to memory of 1988 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 86 PID 544 wrote to memory of 4076 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 89 PID 544 wrote to memory of 4076 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 89 PID 544 wrote to memory of 4076 544 852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe"C:\Users\Admin\AppData\Local\Temp\852585515ee495a60688c470f90f7e48dacf0d222dcbf47cac3dc51377e20adcN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
C:\SysDrvCU\aoptiec.exeC:\SysDrvCU\aoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVB0P\bodxec.exe
- Size 244KB
- SHA256 9ae3f88408cf3c0bbff793a751496bd924e2228197a972b42cf798838ba0b60c
- MD5 112289c147fa8b4bf7990088cc21e610
- SHA1 e8a8019cbef0d9553b73dee576d7f1e839fd807a
- SHA512 3bb11fabd3553b3e1d969ff07210dce23f5036012b60e1db7dd304693d731d917f095dc6cb9c22655a9fcc103efe09a2d83f49af70e9174094b05fada75720ff
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+0:6ne3n0DmAm67YEjAyu6qJ/+L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB0P\bodxec.exe
- Size 2.6MB
- SHA256 5090639c3a6aaaf221124cdf8c4ef652505265b8307aa794cd46dfb103f47d28
- MD5 07325b3479b0d4376073c82d6cc6ded6
- SHA1 8b4bd85562e18e6012c4f18cca76cada93f6f25d
- SHA512 6ac9301d8099b890c514e779d86d0ef9693cfe2711c99f029bef06f47af8300e111c641318477e2adad7a60b5eea9ea11d593ff4ea3daa695c9185f5e8923bd1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBaB/bS:sxX7QnxrloE5dpUpRb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvCU\aoptiec.exe
- Size 2.6MB
- SHA256 e48ab8f3d65249be52906d7362c06a92e75c6677b6660a5421e7c3211f4a5a8e
- MD5 3105b4d805f9adc34938ccc942465eb6
- SHA1 4a8b9ea3d2de183d37e84020746912ee2f118505
- SHA512 3fa72d1f8fe5465ada6da2f2ff5f3fe14369eea6038a3d484e2ba2ba9bb3034efbbed5691d651b1f8f84f731eb65d3d07b784e20c88370e621543512f9a6b0f6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQB/bS:sxX7QnxrloE5dpUpbb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 199B
- SHA256 e20c14818f146a99ec408ff0311bf39a517338e72dddae73a22ec1395166181e
- MD5 0ca3508539591fb965f4a413e6bb58c7
- SHA1 ed98eed1c0fef6c202d510e0b08611990852c245
- SHA512 1e67eb717d27eeb7f6fb2e17c551a41a72a8007715008d6c4f1aeb366f87d49dc90736b8bccdcb6b7a8b7a9bcbc6058927e111a0a83a0438025c39d55fef6293
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 167B
- SHA256 8f05df080dee9ccfad243307ede3d00c6aea02189c264f1377e3395db95ab9e8
- MD5 26d8f91ac5d3ac7f1424dc0d6615e213
- SHA1 a4837e9d37ee6ae867287a7e1e80a96efcbb1340
- SHA512 f0573f3d85fdaa6bc4d64cd4cf64d29507de79728bf2286f9708716f5c677dbc2de795ef6e6fefc457e8fd9fd4d6a3af1d75511534c34139d60b735d2585d5d8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.6MB
- SHA256 7435c74871c0ecf9d3779afbafad0ea8a9e732c5163ff04c74b54157b907331e
- MD5 b5ab804b42da5d7497486a15c8ce2854
- SHA1 3dc78da343d87fcb70beffca32bd80c67f14720c
- SHA512 c747e51f37d091aa81435804408f14c7856b49115fcc8fe80606c885a52debb9291281f546c7dd5c923f48198112ae03fb029460d3e1eb2fc792bae21f387195
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bS:sxX7QnxrloE5dpUp+b
- MD5 SHA1 SHA512 SSDEEP