Analysis
- max time kernel
119s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 13:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe
- Size 2.6MB
- Sample241112-qnrdqasmds
- SHA256 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8
- MD5 348fb07ed9c88dcd31bb637ff722de50
- SHA1 914446b1044b3bd0782bd45ccbc666cc029b4e25
- SHA512 45af82922a13b61a8a26e902b3a53bed68f84ec596fceb79b1ae24a60c9cb51e45aa5c757099c380d6a650fdbc321f762c053225d1256d0b656165cd72e6ac8d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bS:sxX7QnxrloE5dpUpvb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe - Executes dropped EXE 2 IoCs
pid Process 2104 ecadob.exe 2028 xbodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvU0\\xbodloc.exe" b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxKY\\boddevsys.exe" b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodloc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe 2104 ecadob.exe 2104 ecadob.exe 2028 xbodloc.exe 2028 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4892 wrote to memory of 2104 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 87 PID 4892 wrote to memory of 2104 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 87 PID 4892 wrote to memory of 2104 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 87 PID 4892 wrote to memory of 2028 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 90 PID 4892 wrote to memory of 2028 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 90 PID 4892 wrote to memory of 2028 4892 b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe"C:\Users\Admin\AppData\Local\Temp\b7e07adf5dbffc3551ac4bc60d083dfdcf9f687fec955e9ea7694a4bffbceca8N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2104
-
-
C:\SysDrvU0\xbodloc.exeC:\SysDrvU0\xbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxKY\boddevsys.exe
- Size 2.6MB
- SHA256 04d0a9711586d2ab47e4e21d8a2e4ac3782a5b4f43d9afefb5acffc66b8852ac
- MD5 6f1cc6c815526048f1120f0a22516e5f
- SHA1 198ffed73401a5eec3e6a9d534f8c4846ba81969
- SHA512 3af64817bba91fc1d27d1ce757f05320c39bf6bfe9b12bfd7801b7374792be8c37621e6ad326a00a0ecff8b6ed838dd0fa3ce67f522052f8b3b6e60d3d8197aa
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUp8b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxKY\boddevsys.exe
- Size 2.6MB
- SHA256 cb7f13151664a77496f27e6733ecb8e01938b363b8df87b4b7499bffbbc0fdaf
- MD5 e7948f36d5ceddc20ad46c54eb98e422
- SHA1 d28b2404d92282c8b7b069d46ab82f109b0e4090
- SHA512 9e47ef6e0afb808852961fa84df064b02654060c8a104be65497a46cdc0a57c9d58c2e4567da5e5a00c79b52b8b2dfca087e7f40a23106366e41b4663fb6fed9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBbB/bS:sxX7QnxrloE5dpUpMb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvU0\xbodloc.exe
- Size 2.6MB
- SHA256 e849067aefec46ce013b475b3612eeb9156466fdf908194c9a7d702a8eb676a9
- MD5 da9e2f87cda506665d54c1acd9f6d0d2
- SHA1 4c4a6e52bbecd4b30fdc17ffec22be4417c8ce2d
- SHA512 b62c153b174f87a6765c9c11181af20cb7ff0068682f91c4441381447f850ad9e01c350e4c7b2a609912eb406b9147aa4da56d052ed3dce2c20738a02fc442e5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bS:sxX7QnxrloE5dpUp6b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 033bf5337ad188a252953e60f41acd1fd1aaa77dfa9314bf8378f3395ed25999
- MD5 c5b6dbe39137867529d410b08e17d42c
- SHA1 0f37ffe13c3ceb8257b2954d039884eb83011058
- SHA512 8842759ead21c193cdce014d330aae069c9896f2ec107adb6012fc92be69dd3667d407e8d9cdebf83b1ceedb8f7462f552e510f5ab25c42aca7c4669da668582
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 1d8767dc6d9fb64235fdca93f2a5ca0baaf800792b946afe4808dc15586002c0
- MD5 8e8a9d4b573f3f05ed699b1868c450ca
- SHA1 f1609df128864454fb00c471f0bc6aa4217c0f5b
- SHA512 b5198829a40de4a55a71c18b299ac5c0698d409fd1021ae47ec36624f01518a5234e0877d249bc03c214b60a9d0b87f25a622d25d57b726a52c37bf219bf3971
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 2.6MB
- SHA256 bf6c84411d16fe26ec8ebc487209c508a486ac58bb5ae1fcfc3d0a570528cc92
- MD5 2fe0c9b9f108e0d3566678c0b82bbdac
- SHA1 94c5731905149d4adb51fe579c4087411b3b0cc6
- SHA512 7ad10ec84b695c0f0bba411c2c1bc87efc2e8af030b4ce589bf5c587bb885e7afc74815c14e7c86b7d9b05356f7f17120f18f360631fbb847608949ec126efc1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBa5B/bS:sxX7QnxrloE5dpUp7Pb
- MD5 SHA1 SHA512 SSDEEP