Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 08:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe
- Size 2.6MB
- Sample241109-kqpp1strcl
- SHA256 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185
- MD5 330f812cf7b14b0808e3fa5f4c155540
- SHA1 dcc7a8a06c81179e20e9b81362a118e41593593a
- SHA512 7e65fe925e66eaace7ed9ffe343b594cd1faa65ea07ea77a84c3df834fdf022b034241e9580e2ca0473b4abef547917a10b9fda81c53bd6ef9c0d1b1670cb00a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bS:sxX7QnxrloE5dpUpCb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe - Executes dropped EXE 2 IoCs
pid Process 3024 locdevbod.exe 3700 xbodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvIX\\xbodsys.exe" 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidL5\\optixsys.exe" 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe 3024 locdevbod.exe 3024 locdevbod.exe 3700 xbodsys.exe 3700 xbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3024 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 88 PID 4324 wrote to memory of 3024 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 88 PID 4324 wrote to memory of 3024 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 88 PID 4324 wrote to memory of 3700 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 90 PID 4324 wrote to memory of 3700 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 90 PID 4324 wrote to memory of 3700 4324 2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe"C:\Users\Admin\AppData\Local\Temp\2c8be6743a89a4e49cefd26c9edd6904663be1d64175f0b55c52d139aade0185N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3024
-
-
C:\SysDrvIX\xbodsys.exeC:\SysDrvIX\xbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvIX\xbodsys.exe
- Size 2.6MB
- SHA256 d66a6fc53e7d6f0a685a2962fcf26e81bbd55c219399e86b952168ead9652f44
- MD5 e6d3a97aa074a1edd974c5cdd76f97f2
- SHA1 383805b8ae075160e4478746458d1bf402f6c849
- SHA512 05734bc9320640e13f8395bef4e626cd7f1d43e1f5798c549e6954610bf9f27c333c03810a64ad32e4c308441402a1a1fc0360938c378a0a37dd68aa80217697
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bS:sxX7QnxrloE5dpUp6b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 671c45c5b2b5921418cd62f21d75dd5ee5bca9bc94348b117ef1ca8c537ea05f
- MD5 26814c88bd82ccac6fd834356d4006f0
- SHA1 dfef3cfb49665e9936c6527cef9cffdcd9469b70
- SHA512 00cf8a89295f3d6a2c06549ebc10b58a9c74994544f9cac739be476117e4b847c1cd04721a9ea1a0c06eeeb8b83312237d71419786a4ecacfc3c062f57b383be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 ddf64296b7542ce7b444fb2431e10bda2d7bba2d2ec0fb958f111bdcc2649408
- MD5 70bae9ad0a50150fce06a5bbf062d979
- SHA1 7b3c42ff6ed01a0a7d71fd9586da1c0b3cabf852
- SHA512 d1f01f9173922ec3aa370fdeb171e087e41cfb37e2552f903851caee0378fd59f0e064144b8e32f9a80ec8a2dd43ec90161318ac9ac42678207d9bda76bffb9c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe
- Size 2.6MB
- SHA256 7bcd798ddf1ec8af7237b113b4e4c72bfd4361e3d0a5fa6f910de798f675c78a
- MD5 e4ba48bccefb218a53fadf2d42c0af56
- SHA1 c1f77a6845607018790f0ce9c45ec1189c4dc1bf
- SHA512 611166123dcf1018fd20f15b47d1522bf10e093036e40723f66d1247998105a92159de52ab169743c43b1cfda05291e5d9febfdb1847d02604dc0717857a5e1a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBZB/bS:sxX7QnxrloE5dpUp2b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidL5\optixsys.exe
- Size 2.6MB
- SHA256 638f3a151c03d609690b1f3d4877ddad53217fed49033953ff93121606742df3
- MD5 a6750895052166f25d2dba584cf285f0
- SHA1 79f99b6c3319cf2ad5756d8b80f0045260a491d0
- SHA512 a57046e4515112cfb8feb7fe1dd69138632820bec89487880fae2e2a0205e640c58c9cf7c503df7218edd0314614abb3ea9fb57b239a75dcf807a3bdd37475ca
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bS:sxX7QnxrloE5dpUpNb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidL5\optixsys.exe
- Size 1.8MB
- SHA256 4cb0a667c6de31dfb51511ceb82f4ce946ead904f0d8cbeca05a1e776fdb0612
- MD5 dc38759208d7591ededbb37b1aaf5552
- SHA1 48fa81dfe6a8b0d437b286bfffb113a7c24a5ed2
- SHA512 8ad1ced0248b4bbf49aa049dc1ff56444976eca0f1e2f67c04eb3d0570b464585d9002e8708babc1058ec8566d4969c80d32588daac9b4d13cbf0c83f4020a86
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3/:sxX7QnxrloE5dpUpM
- MD5 SHA1 SHA512 SSDEEP