Analysis
- max time kernel
120s - max time network
17s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
12/11/2024, 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe
- Size 2.6MB
- Sample241112-sc6qdatpay
- SHA256 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87
- MD5 87af2a702deb442f74be6aab95069360
- SHA1 0427e9cf15b81ee81c31cc424b62305987980337
- SHA512 264361fdf8918cf91797db5cfaf947784d67e4a2b52220764bd6cb7b53a5a7b6bf3b66e985e246b51486de2037281ecbb586fcc326e496e907e8019e411a3f97
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bS:sxX7QnxrloE5dpUpxb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe - Executes dropped EXE 2 IoCs
pid Process 2656 sysabod.exe 2684 xdobec.exe - Loads dropped DLL 2 IoCs
pid Process 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesCN\\xdobec.exe" 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBPO\\bodasys.exe" 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe 2656 sysabod.exe 2684 xdobec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2656 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 30 PID 1868 wrote to memory of 2656 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 30 PID 1868 wrote to memory of 2656 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 30 PID 1868 wrote to memory of 2656 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 30 PID 1868 wrote to memory of 2684 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 31 PID 1868 wrote to memory of 2684 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 31 PID 1868 wrote to memory of 2684 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 31 PID 1868 wrote to memory of 2684 1868 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe"C:\Users\Admin\AppData\Local\Temp\2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
-
C:\FilesCN\xdobec.exeC:\FilesCN\xdobec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesCN\xdobec.exe
- Size 2.6MB
- SHA256 6d042f770f949a81199116f41ec1a4d05f78d32d735aa3abba7ebcb055a80e1d
- MD5 f7857845c30539eb417161292fe87eb2
- SHA1 221f41fcbc210277e2e9d6b3ea13d25fe7d232cd
- SHA512 ea021fbff00a8036a0931a26a23370203428bb79c3489ef16ee673b44bba6ab2d8a3f6df99179edac4d61855231c41e73703f9f8f6397f61ea2e45d1eb33ad35
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bS:sxX7QnxrloE5dpUpNb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBPO\bodasys.exe
- Size 2.6MB
- SHA256 97254fc2f9482b75492d4a7b8d308e7c230204e0597e9371000f306b459d4838
- MD5 3e62eb436100a6417458898e53471845
- SHA1 ae2ade7e3987f7ed392616e3341a5f956225c72d
- SHA512 6a4516fb20c62ec5973f8efe14bba26d9b6b5f01908a5e439234ab89e6f2998abdf102fe116bc63889ccad73ec050c2d15ddd740b6869548ad41ceb1c4d54b1e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bS:sxX7QnxrloE5dpUptb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBPO\bodasys.exe
- Size 2.6MB
- SHA256 96b987442f12e41bf1e2c30532f6e32626cb8d457989c06a6dc4d9f4f90c9559
- MD5 2038c71db58bef3f7fffddb9be5df30c
- SHA1 c1ca4d386ddd163b2492804b20cecf2b8183cd66
- SHA512 39bf51e110152968c8687ef4b0ea72b894206ce709086b1422db10ea19b01bcf35f2ae8ca35e8005f85e9b9d01b63af8e9bb239fa039cfd118b424408b592ef9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBTB/bS:sxX7QnxrloE5dpUpMb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 167B
- SHA256 8c85f638a336bc2a8c564cf98aab2325e356671da1b6bb02d2422be1858958f1
- MD5 7388d77069d803afb79256d3b7071315
- SHA1 426b6253d39f1c43c031a2ac256b5655f3fc23f1
- SHA512 7a2063c6b27fc230ae57e5296e09124ce58cf0b60539f561c70a356d2c9641421e70257debaee9688bdc794b376740e48498b396127b531057c2749a7710800f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 199B
- SHA256 4407901ac103bf2454d071467c590893780f5c0985654e90ff958cc84ef30134
- MD5 f8243fda336cdf152f0af744d8f0fec7
- SHA1 cfbef6f87865bd24b0d6d6a40ce01fcaf513079b
- SHA512 69d7081ca82ab39aed696dbcc03d5446383e1447cd8e94dbafc4adcbb790e7f41b5f4a57c94815a77730091f4d7d54e7e86ee7d1f9c107b5fc79dda5d0454473
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe
- Size 2.6MB
- SHA256 a3765e19df9426edb396c9ecadbc90cc212c22839ce39e42ed4e73d831a13e65
- MD5 7af4949c3994190b36591156106242e4
- SHA1 02a8d65c023bb62ae1d56846757f1cb3d84bf988
- SHA512 8669805a858b7fce92a97f329f751a1d2af2ac00d987c30584b4d129e638aca0e75544e3fa9517b3fd2b7af371536adcfb1159a2cee592c3fdd9d2f36b756c1b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bS:sxX7QnxrloE5dpUpNb
- MD5 SHA1 SHA512 SSDEEP