Analysis
- max time kernel
120s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 06:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe
- Size 2.6MB
- Sample241110-hkhcms1hpj
- SHA256 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0
- MD5 4b7e0c85e053393bb09e160c7cf5ced0
- SHA1 1d55ec6b4298c27b5dac21212b4148f60de221c5
- SHA512 9f3b16ccb2c21b702170aff7b2f203da342d810ad0e39096ab5cad6ce2d5ace10f1cfadaed98bb16ca7b6f08478ccdaafb8210d99871c0d65a643524fe0f0c61
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSq:sxX7QnxrloE5dpUpPbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe - Executes dropped EXE 2 IoCs
pid Process 4260 ecxopti.exe 4920 devbodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc89\\devbodsys.exe" caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintGI\\boddevloc.exe" caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe 4260 ecxopti.exe 4260 ecxopti.exe 4920 devbodsys.exe 4920 devbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4260 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 87 PID 2408 wrote to memory of 4260 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 87 PID 2408 wrote to memory of 4260 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 87 PID 2408 wrote to memory of 4920 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 90 PID 2408 wrote to memory of 4920 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 90 PID 2408 wrote to memory of 4920 2408 caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe"C:\Users\Admin\AppData\Local\Temp\caf163ab3449a3c5f08c77791b33d5145b55d2c9798ee85349aae809e42422b0N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4260
-
-
C:\Intelproc89\devbodsys.exeC:\Intelproc89\devbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Intelproc89\devbodsys.exe
- Size 2.6MB
- SHA256 46444d281d4a23acbb47875c79652e869a31b451299ae3eb9645342914f77ee4
- MD5 6daa5e34ee3b885efdcae6fd2a2ace8e
- SHA1 d58897a85b529d8e7529422c741140da1b01f929
- SHA512 d8ea5d2e6bc4ab73a603619d1c3d5405a3290bb3f87a508656086d8526624f180b14c5468f27eaccb7d831ab063de89779513bcb0bce4096b6eed6b8b22786ab
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bSq:sxX7QnxrloE5dpUpEbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintGI\boddevloc.exe
- Size 2.6MB
- SHA256 3bc8a8862284767d0ea884c6424b518847c96c2676496108433313d2344a4b63
- MD5 cd641412efc50c15095308ad41e186e3
- SHA1 0eddef537110bcee49a70d16ef4c4cb5b9102c20
- SHA512 3adfa013badca33501369e82cd0379c0014c51502f2f99e51167c50f84fa0f9d81d3a23b87b7724baac5eb2d2bb1f6e09a290a4c5a3963706b9bbfa0dc16fdcd
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBWB/bSq:sxX7QnxrloE5dpUp9bV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintGI\boddevloc.exe
- Size 2.6MB
- SHA256 9862fdb87446ff450a53c0fc57d106b4530816375d9d9ba918dd6e9989e05f48
- MD5 356ad67e4acf1b32eddbc5220573bfcd
- SHA1 13b5aac97cbeb62af901f6afe875b03119bf67a0
- SHA512 14d364a9229855e7e4ed69bdcb00be1450c93408332fc65920593228dbea4b0988eda4aa6dee19fb91d21344f41f8dd51088e25bebe50b11d08900d645ad58fb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bSq:sxX7QnxrloE5dpUpfbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 208B
- SHA256 d6ed1095f850a4cb78421d8186a522ae28efc205345d814115bc1b97d7d659b5
- MD5 0445afa071e89def1acc9f726fd63a37
- SHA1 b08977c27ce096363e76a5bf12d1c4497919768f
- SHA512 79186bc44dc2745d8a2a80e4480c1a6e03a9cb454d3ffd3f9f93165ba05da2872e88d1c54875cbf16deeaa21f3dee9911214b4efb55ad0ca6bc4d601bc3b2042
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 176B
- SHA256 6dd58819ee2b89baa21aba5cfa3bd114ae71bb861237953d025c1df68f467a63
- MD5 500bb08a4523c916df8d4e1631f11d9f
- SHA1 8124bd9aae36a79926176708c2d1a9f7f48673d2
- SHA512 7fc73b25a955e8c355c00b2abe29234a6c9770d4fefeb3fa163090a25c7129b0a9f88ffd3ede57f1f337415a91935ea7427f661e455ea49176ca99d0cd66ad7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe
- Size 2.6MB
- SHA256 7ac63f97feaf7a0e56012c7f426d1e0c56a7d9f588d36874e86fdb0fe7d095f8
- MD5 b13780242af017dd542b01875d3c1df6
- SHA1 21e646a79193fcc5fd0895d7200581201e7b7878
- SHA512 ec0cb22105b0b43a9d6b90239bba464fd8f45dd1c68dbf05686995e6c75f9343667ab769f3e514a6debf7b5e1cae98926f257220a774fda28868f70a8a8afded
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bSq:sxX7QnxrloE5dpUp4bV
- MD5 SHA1 SHA512 SSDEEP