Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:40
Static task
static1
Behavioral task
behavioral1
Sample
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe
Resource
win10v2004-20241007-en
General
-
Target
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe
-
Size
2.6MB
-
MD5
0bb6856eb3a00807c6d2b7b08fea245f
-
SHA1
873b6af8a3c21721956b73e407c39128fdf9172a
-
SHA256
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149
-
SHA512
45eeb5e6e597299d6f1fe449529cde217ad194131db13fbfd139a89901908bb1382af46c3b48a015fb74377e37b91fd773e8beeccd56352ba412ebc92720a7c9
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bS:sxX7QnxrloE5dpUpwb
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe -
Executes dropped EXE 2 IoCs
Processes:
sysdevbod.exedevoptiec.exepid process 2772 sysdevbod.exe 2708 devoptiec.exe -
Loads dropped DLL 2 IoCs
Processes:
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exepid process 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe0W\\devoptiec.exe" adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBUF\\dobdevec.exe" adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exesysdevbod.exedevoptiec.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devoptiec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exesysdevbod.exedevoptiec.exepid process 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe 2772 sysdevbod.exe 2708 devoptiec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exedescription pid process target process PID 2640 wrote to memory of 2772 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe sysdevbod.exe PID 2640 wrote to memory of 2772 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe sysdevbod.exe PID 2640 wrote to memory of 2772 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe sysdevbod.exe PID 2640 wrote to memory of 2772 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe sysdevbod.exe PID 2640 wrote to memory of 2708 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe devoptiec.exe PID 2640 wrote to memory of 2708 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe devoptiec.exe PID 2640 wrote to memory of 2708 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe devoptiec.exe PID 2640 wrote to memory of 2708 2640 adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe devoptiec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe"C:\Users\Admin\AppData\Local\Temp\adc4eb9f9521b5fcaa2e76a41c76e3b439b897aefe344b6e5460876ab973b149.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2772 -
C:\Adobe0W\devoptiec.exeC:\Adobe0W\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5952a69b0cf05ea7769a22fe20e9c0273
SHA1aa134d4f925692548329f2634c86285fd6ed4fc6
SHA2563c998585056ea30251cb20005cd8e5a4c6087545857bd07ece7aabaa8ffebf31
SHA512162177be5064d30cac9185aa43a1c5490a99a258456f2ef4883a8b36ca6565eb28abf6be2da2ed74a71b8e54c0c6319730e73fb251d29496ea41011fd489a9f9
-
Filesize
2.6MB
MD5dd579b5c4e5faf4f020b6bffc07f20ff
SHA185c2a2424c729c1528cd69bda7590e7fb45a0f06
SHA2564b28a1d2644754b460a8d71600c924f1e9801c43c9220f4bd08dbab52385ad5d
SHA512f27e0c45250435dfa03617b76383a55ca55bb292e6e3b4aea75907ccd1b8d8dec6e0c65f93a5c435571096c5240a1eb6077fe63d52d402d1c680b6becb026372
-
Filesize
2.6MB
MD5ac65d1e7f770f82f011453f3b30548ab
SHA18886bfaa320f088e548f85de79672593257e6ab4
SHA2560b0637aba764434390e131d2fe464ed39db034730fa7e7f2c118b9d40e01e027
SHA512e9e6fe1e99dd94cb7b8e44f8524f917e84a1e3a7f2d617b3d5281139e1db2a642c0aec3b883874eb4cf85c05120769523b65ca1d0421f878adcca8f05541340d
-
Filesize
173B
MD503da581fdcb555a312b7f65d9892de16
SHA1ed0507ecb47243ef1d97bcc3b970b87a08051510
SHA25657126409dd78902b2c84b4069b47c577fc02407ba498322ec13d899ba77c3554
SHA5122bf173b37ab2efdf4dd53356ba06489e549d81fba25faf78e538a185cbc58bee99f61210e997cbac56712bf1ff17509865c5083eade825f1e17b0df5e6ff39c1
-
Filesize
205B
MD558ca626b602baf24a71e993638ec0f15
SHA1fcf517798541bc6025beff048e1ac596e603bb74
SHA2563cd1df1975da49134c19659e168fc4f3681861739cac0f603dfe6857c3695725
SHA512df363d68de7a2159da4ee77e79c020c2cffe5acad373d27dc0ae442941e3f71881dc00c076a165b2b533f14b8384a517fa8f538bff2b4d058c4071a614822075
-
Filesize
2.6MB
MD5e462be43d49d3df2b11c155d75a5fcf0
SHA1951a8105fa8f9a009be41e4eb8837a15d700f438
SHA2569a81c195d2f67fa87858bed62bdc26d9e3cab1951c11db11b506452953f67fb4
SHA51245523cbb045eabeba0d363465db94116398b2c856eee7ec4ada1e4461621fbc85a3d82461ad4a9bfa51e0d6df2a012c911b5bcc361cf87c0c3213960d1905806