Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe
- Size 2.6MB
- Sample241112-qltfastdjr
- SHA256 14b6cc4912643b1fab3864f8e0907a7565ef43db977300e1387506af1e5f66ac
- MD5 801ffd3e3e31a922c1c1ea83b15a53f5
- SHA1 fdfee5af471739c61db3aaeda4b05340e252a945
- SHA512 c7f473c426c0be68b833bf9889d2cf6b88ed600f37114f2b80ea47a68a37dba7fbed6e286bdc518ccc8a8233f2e1e1812e4dcb75635d6b184ac721225a40c866
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSN:sxX7QnxrloE5dpUptbI
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe - Executes dropped EXE 2 IoCs
pid Process 4348 ecaopti.exe 2972 abodec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidHN\\dobxloc.exe" 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocI7\\abodec.exe" 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecaopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe 4348 ecaopti.exe 4348 ecaopti.exe 2972 abodec.exe 2972 abodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4752 wrote to memory of 4348 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 87 PID 4752 wrote to memory of 4348 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 87 PID 4752 wrote to memory of 4348 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 87 PID 4752 wrote to memory of 2972 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 88 PID 4752 wrote to memory of 2972 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 88 PID 4752 wrote to memory of 2972 4752 0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe"C:\Users\Admin\AppData\Local\Temp\0b4c5572aa92c560cc639813aaf6a1bbb04de77423572425feaf5a7f86211066N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\IntelprocI7\abodec.exeC:\IntelprocI7\abodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocI7\abodec.exe
- Size 2.6MB
- SHA256 e5740cd5bd79b4dcadf51dc96d2255190994a2cbf08d6f69a2d69131d977f41a
- MD5 cb73d18ec2ac332fac9ac00ac13883e4
- SHA1 8c0740d69767bceee74a124384eb0b5d20de7f15
- SHA512 3e4dd9ee05602ae3bc7d02f032c6a51e85c707806042d48fb6732977cb4b120c8a7b5124a49b04601becbd4fe2cee6b705f64de951884620ba1ede302c6a5377
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bS:sxX7QnxrloE5dpUpvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 51e1a66b88d13bd4baf21202ab0374f6e78e3525b6f3881702ef1befab48436c
- MD5 8e8fc21ddb1c13a6a9fc8ba4bbe7f6fa
- SHA1 86a4d4b3e4a2c2efc070dbdd914d974b0934fb7c
- SHA512 3e2f03b90b72a89240e8fd37557d01c0973a3c7d6d97edbf9cf1fbf9c7ce7ad80b63b61aa76a53ef323ceeb824befc31618fb8375f2460d8a9f50f18a3082a08
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 b8767071b26f487a16a2e94fad06e6a43b9f3b1a5caab701f73d6b781760b240
- MD5 430e6e0f2cd4ca87c59f269555b08ffe
- SHA1 e7711fbd3fb3bf5b4add6357759afd3fb16bfcc9
- SHA512 ba7b40c1fda36fbd0978c44e38be025137f27a086a8cee9c0cd4b4f412ddb74206a2819fa9ab66e06dc048aaab2a108ac6c61d8ced908545540c5674e530e1de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe
- Size 2.6MB
- SHA256 347110f8c2dd7a7656fdc334616ded02b14bf45a1cc778e43410a635b7057fa8
- MD5 161cd079bc557579402f94133e783e9f
- SHA1 9d2c13194426ba347fe4e05a7e2d9dc570d42312
- SHA512 6ca90dc7e8a35f6f4f6891596dd1af7f744583f6427a2f9c0831381bf93c0c8d71df81a50f1d7a96eb4d40632e5a1a6650c5a75f27a85072cc7116065133f5c6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bS:sxX7QnxrloE5dpUpYb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidHN\dobxloc.exe
- Size 2.6MB
- SHA256 729c900ec3801017a565ef0cbcbc5cc6cebde87011d81ca06397f4df6697fd47
- MD5 322e3c87dd1153d1ff114ec51155d2fa
- SHA1 55c291f41451de27acd0916893604096bd4bd9f9
- SHA512 b6803685243962d65ffbf92cc9b9b8dd574ad2c0e2d9ea3e9921a2c58a782ec0aea2fcb6d3c84beb039eae7463d62c754a56a17caee3bb9a8952b877c8e7279d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bS:sxX7QnxrloE5dpUpMb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidHN\dobxloc.exe
- Size 2.6MB
- SHA256 9190741bc27f08b10c8d0c465dda7a80250fdf1c00e5967b749a52b14053b81e
- MD5 d4f7530483682b8e88d49e541cc47e93
- SHA1 7fa273fb320a4a9aaf81873e5a6028af02fb8bd1
- SHA512 93e46c1c7bc0357b3c3a71888838accbe611dce424ec2c6431ad702a176dc29fd70261d17f580c7d623ac24f5d1bf9731f3aa737c48ce24788ed2924beb79850
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bS:sxX7QnxrloE5dpUpxb
- MD5 SHA1 SHA512 SSDEEP