Analysis
- max time kernel
119s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 14:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe
- Size 2.6MB
- Sample241112-rhd2wasrhz
- SHA256 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce
- MD5 51b57a50a91479886ef44a558c4bafdb
- SHA1 351ec42e32fce2fa6697e4ca56ae42def845cb33
- SHA512 613e4962676435df6bb12f34945828783f4d78408b45b8c08fe1b09625fabfd4cec44b142fc89830a86ed14be805914ed22716e63990cd6597ac9571e7f70848
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bSqG:sxX7QnxrloE5dpUpwbVG
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe - Executes dropped EXE 2 IoCs
pid Process 3692 ecadob.exe 3756 devdobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesOP\\devdobsys.exe" 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintMR\\bodxec.exe" 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe 3692 ecadob.exe 3692 ecadob.exe 3756 devdobsys.exe 3756 devdobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3396 wrote to memory of 3692 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 87 PID 3396 wrote to memory of 3692 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 87 PID 3396 wrote to memory of 3692 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 87 PID 3396 wrote to memory of 3756 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 90 PID 3396 wrote to memory of 3756 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 90 PID 3396 wrote to memory of 3756 3396 355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe"C:\Users\Admin\AppData\Local\Temp\355286a6333df3348d45b11ea15a0cd5e9d691db06cbad49700ee291697ebbce.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3692
-
-
C:\FilesOP\devdobsys.exeC:\FilesOP\devdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesOP\devdobsys.exe
- Size 2.6MB
- SHA256 5faeb99e0f715d21ef488d84a71f68417be6761ce8d27452ec4fa98f5c17504d
- MD5 09c65b38a39ee392e2cf913a77588deb
- SHA1 9aa2d47d3a305d1f703f099c13c8e4a314c50c68
- SHA512 0adce727174c04c47ddfeea70ffd584658e006e28d592afe26544eccc8f3c16a45ae646c53b9124221afbc2eb0e5998358c7757a9eb72138f39f575f3e148b30
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSq:sxX7QnxrloE5dpUpTbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintMR\bodxec.exe
- Size 2.6MB
- SHA256 b94342511d22fdd4403e0d36502d1c98f1aa43e8406e4ac06d2315ec0e2006ac
- MD5 6fdcc73fc943ae72dbe28b6efca9b8cf
- SHA1 a466eaf2b9cb39329641aa540a363d6edfc7cbd5
- SHA512 1fb687654dba76f49edc0bd68a54abbfef30fc53a7914689d81274a0904420ca6bddec066166c63cb4bb149666786ea0c622b6060ee7f0a74875929bc6dbca5e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bSq:sxX7QnxrloE5dpUpObV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintMR\bodxec.exe
- Size 2.6MB
- SHA256 051af84fa576b32d2eab7c88a58606804831a9f2eb18de6a67d6f7a8d17d5c68
- MD5 4670587ebe01f5c6228fe54a154adc6a
- SHA1 ff50c3dd22a9092bad8c7d1a41e7d8a5563c7f5e
- SHA512 2760e3c5ca58a16359a078d495dc71ef9e68e3403a8e71cae0fa0c64f9900444d6091f91cd4553ea7ad20a5217667d7d8f72f83a260156c0123c605499f8079a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSq:sxX7QnxrloE5dpUpubV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 200B
- SHA256 b775dbe2a2b1e9584f099743463f22f83e35b3a0fc09886ac089f6c3d4b75487
- MD5 b9bb07f9928c63d7e7cae7c90799d3d1
- SHA1 41ffd2866d076666d5db0e7bc450cfc40072ba08
- SHA512 6a03cbb5a6c7f08f47316b82c33960e2e75f1d61f83ed014c5fb6ea9ca3e825c4bd5a92b29bd0fff95a3f4f431f5ca7abd2a049e5691f5376613e7684b74ae75
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 168B
- SHA256 c80739766545d3bf3f8f7dc30ae6d374a0de98c2def63ef3f620db671ff77cfe
- MD5 c91740359f094806ca93e94e5a61d1f3
- SHA1 92d963c136b9e0d5d5f94c7052c7c32dcf4c2983
- SHA512 b2723cab9aefef97c64562d237b4fcbc41d28d3fbfdaba96cbca0040f9ac884929bd470ea657d9ff5fbc419788c539cdede8751a4a68d96656a0410ae6e03812
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 2.6MB
- SHA256 281b67b6fac644612789df6d420ae57bab516453dc283b18b09725155629e79a
- MD5 a46ddf4c8ad79002a06bc1e3791f3e22
- SHA1 25589c1fe8fa29fe72f84a1c128566a3be1d0ecf
- SHA512 34d01e8074d82316f21bcf6e26e926660d47bcfa6db832c4213f7e2e72de4bbc03e5f8f26c12e04ae9dbd30942115c3ef5435768f05830c67f8d86111e70a151
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bSq:sxX7QnxrloE5dpUpabV
- MD5 SHA1 SHA512 SSDEEP