Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe
- Size 2.6MB
- Sample241110-b4ebrswlay
- SHA256 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335
- MD5 d4a5cb207156f346c2cb2b2aa3bd6260
- SHA1 dc959d1342dd6048efcc3bad5a9289f9a913d695
- SHA512 766360b90bd0f15c6785f3b19a547b45d3e94028617396beb1f49da2220c78c95940630500568b57130ddef9f65c21f18632e44974eff8a958543ff2c2c09b1b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bSq:sxX7QnxrloE5dpUptbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe - Executes dropped EXE 2 IoCs
pid Process 3276 ecxopti.exe 4372 devdobloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesZT\\devdobloc.exe" adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidPS\\bodxsys.exe" adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe 3276 ecxopti.exe 3276 ecxopti.exe 4372 devdobloc.exe 4372 devdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1768 wrote to memory of 3276 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 89 PID 1768 wrote to memory of 3276 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 89 PID 1768 wrote to memory of 3276 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 89 PID 1768 wrote to memory of 4372 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 90 PID 1768 wrote to memory of 4372 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 90 PID 1768 wrote to memory of 4372 1768 adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe"C:\Users\Admin\AppData\Local\Temp\adf05c1265952207aa4e49d7117ac8dbb1e6298283564cc3132dc87fc84d5335.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
C:\FilesZT\devdobloc.exeC:\FilesZT\devdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesZT\devdobloc.exe
- Size 2.6MB
- SHA256 334fc87481958a81795c1db2656027f94a618348ff02c5e3f1e3fcaa2730ec30
- MD5 0aab4cc7a0f4b5f1e7eea38f4b0afaa9
- SHA1 c3bba314ead38fa9c2df18ec9530235eb5b34d63
- SHA512 141d11bff3f7b8d1dca219fea0897ebc32cc957a9fc1c19f3c715f39b49255e8dcd681c47cce504f5a3668a04ca6f23fa5e16e1acf41a3ac73e960f2b1c57089
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSq:sxX7QnxrloE5dpUpJbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 51d21e9ce1580a6cf3b104ba6982de60e1491ab753caab999ca5717d9db29fcd
- MD5 9651d41196231bf96964db49aaab1c09
- SHA1 c7c14f6c8c2873cc05e64806d51ab1d67c2d0583
- SHA512 9efca22809bef33fe60e55b49647cb172ca5c07e0878544e7b86ee988e1b200d9387d9c7894c56622833b4158961d0ac954fa4aeca8803ba2c60050d88ae113f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 131bed842082962b2532dc0738d11e3d3fff246080528a309072fe496809b54f
- MD5 bf2d491e5b383a49ffaba18d2f9877a2
- SHA1 fc843b4bfe9ef71e9d34cdd1fd869b37b88096ad
- SHA512 2f554dfdece11efc9be1a5e6528991e8af4b3d821188dd3d1cddad2a8970ca79377c3c8657574752d88105c9738ee72a1707d4bc0803ef65e06776851a78bdd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe
- Size 2.6MB
- SHA256 08c39f4db71c32abb28dc8240ff7505f6a5216f89218561ba2a2308b32e7d2d3
- MD5 db58bb8b79ec2ffe155c028bb74dca1a
- SHA1 2098e7f0b41a47683123fcd4ad6a5b5cfecb01ee
- SHA512 87ddd1f7ee93e4d111dff67050d545d898dc23fda816af8630c42971c34d9423d98a6db7393e681d123f59cb927e4f1f873e443f00ced9d853ecc1e145a5f142
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSq:sxX7QnxrloE5dpUp4bV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidPS\bodxsys.exe
- Size 340KB
- SHA256 fbbaadda49a958eff1dd08d9e2202c027b9d05242c8a626a7bfd88c18c552193
- MD5 2875d101598bb9601397f40462f2ccc6
- SHA1 ce1bbc2ad56c4a756bc891d7e962ab8d5961f0ae
- SHA512 4bd01f6f044c1c4f80550f56005a50d251d89e1c83efe638b58f7a344bfa40329b64763f9b40c62639863d3d24c55f8e7e80117db42c0c5504d1564fc37b8002
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7UqpcVX:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdS7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidPS\bodxsys.exe
- Size 2.6MB
- SHA256 5f6f1d46fa3519dd8b078c3f89471f06c08c6445180fe9911afa4bc32f91df3c
- MD5 323aff53b53546ecf54cd68758600a53
- SHA1 3999f46d3060eb15ca5000d7cffe5f04c067b544
- SHA512 7370bee0b605f749b12f7fe011190b02b38d91d968b94bf3d704888283483e5652e64ac0f1f30da98877ba4ea74b555fec157e4c0bb730b4f3324aa53a6ef0d2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBuB/bSq:sxX7QnxrloE5dpUpJbV
- MD5 SHA1 SHA512 SSDEEP