Analysis
- max time kernel
120s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 12:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe
- Size 2.6MB
- Sample241111-pdyvdaykbs
- SHA256 4075101538be7dec7c2e4dfdc9ccbd0fc8f8555563d111f945703958fbaf5338
- MD5 0a84f52994730763dbb244664a771964
- SHA1 f275b88e70c30bd770f87c1c4421b454293f07f0
- SHA512 1b7e397e9c7a1d420033fe121454040ebd1891fa03e178c27ded587310f9639524a9ac10895ff947280abe8226cfb2908e9c45e4f18c1e0a441506f987bc21dc
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bSg:sxX7QnxrloE5dpUpab/
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe - Executes dropped EXE 2 IoCs
pid Process 2184 ecabod.exe 3448 abodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot3Q\\abodsys.exe" 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBYG\\boddevsys.exe" 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe 2184 ecabod.exe 2184 ecabod.exe 3448 abodsys.exe 3448 abodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4728 wrote to memory of 2184 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 88 PID 4728 wrote to memory of 2184 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 88 PID 4728 wrote to memory of 2184 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 88 PID 4728 wrote to memory of 3448 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 91 PID 4728 wrote to memory of 3448 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 91 PID 4728 wrote to memory of 3448 4728 2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe"C:\Users\Admin\AppData\Local\Temp\2658c5b730bdb9f8457de257f71e8e8381817f737f15c50a2095e0cb2e7ce4eaN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2184
-
-
C:\UserDot3Q\abodsys.exeC:\UserDot3Q\abodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBYG\boddevsys.exe
- Size 2.6MB
- SHA256 ad643e6fc5b436adfbdc0192ae84c7192059fe722e6d83387e39750ab8657cc1
- MD5 0284322ddd841c826be72735c3333f58
- SHA1 06c186709b8698255e47c0e9acc99132c3708dd0
- SHA512 57a3710f911773d08b20f0d62af4b6073ace3cff91cb0a9e8afdd17b656f6792a3681d55742a24d150485a0a63ebae677bb15da1fc57969a9a8d92f2e097458b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bS:sxX7QnxrloE5dpUpmb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBYG\boddevsys.exe
- Size 2.6MB
- SHA256 edce6fdea39f4a90f52158429788f12e980f65516b47681b61ddc1836fdf7a10
- MD5 bb27de0917c592916e3d70857acd99fb
- SHA1 c5b310c18a0d5c5b51ba49068a435ff18eb7e09b
- SHA512 7c01dacd366d0460b6e2f32cac801ecb7534af9cf280ca442e9e8786732406028e4dbd5b51ead806dcd6a4221fe3f4c92b851d2db2f161f9028cd1323c802375
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bS:sxX7QnxrloE5dpUptb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot3Q\abodsys.exe
- Size 998KB
- SHA256 5087e10151efc375f20dc723e5df05095b4836686ae3a987e117b50e2dcf5b65
- MD5 5627b9608e185fd89c37150a2717713d
- SHA1 596bb7506b58d78254dd7ba1784997faf8bf993e
- SHA512 fe243c30d257e4f1cc6d7b395a7ddc4b352a30365eac4f916dedc30182856b22ab41ac6fd60edede03239eac5523ed1428aa5be8fad7c8915af39d20cc22f92f
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtoO:sxX7665YxRVplZzSKntlO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot3Q\abodsys.exe
- Size 2.6MB
- SHA256 da1c5270017775c6e6642f2e7fd94414178562cd3877f41832fd85d9f372355d
- MD5 e2bf795848f02dfebfa044893c8685ad
- SHA1 701bf2b6a627ccca2d5237f6675b74d014aef3bc
- SHA512 8cc70f6c0a75afaf4237b33956b5794485bcc2229595ba47f3f11d986a3871982e2a84f3c35a0eea83748442edd812139e77f56b3bc27249fd6dec9a05883b11
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bS:sxX7QnxrloE5dpUpHb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 485be0f5fc6f22e076f38cb2217f1af2ed80bf8edffe587d1ee34bd2d864ac31
- MD5 c307da950645da3b7071d5a3c9ec1870
- SHA1 349e05fceabb3da92ce483179dbd29f80a976706
- SHA512 497b29ed1d4b7c5ff1147d9da03b387c529cc3ceb7d47aec0e107408f1dc9cbf7ddf623ad6280067297ec6ca2353766fdb45b0f2b09ad01e4fa591f68cad4e10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 59fdc3631903773c313ddca5ab8608f47cb54a9483d3129767032cc6061624a3
- MD5 acdc3a1eb7f0c81f517c7f566b5fbcef
- SHA1 5f84a4e045fcdfce7bbc85f236b330068cb087f6
- SHA512 e6fd0fc45884fb14d27e3d8dbe2fe27283d85ca0c3c1677e100a9200cf46dbd63314bf20c831ba4ed9e170dfd4510b5aab28f6da43ad2e3c4946260545daae34
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.6MB
- SHA256 192055a61863d5b923bad8686d9f6c628ed9103c6e607ed8fa9fe23aac3fbd8e
- MD5 75a11ea959cf9e5e99416e43bef6f5f4
- SHA1 2cc55fdacdfd8b7c8101a0c3ea5cce6809188b67
- SHA512 82746cbb93d1f11519d0cd878c2aed93cd853466972874392b4e3e138446a066de5da8adcab23ee87188d8ed18fa8a9e24104801ed3cda88437329c1724be831
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUp3b
- MD5 SHA1 SHA512 SSDEEP