Analysis
- max time kernel
120s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe
- Size 2.6MB
- Sample241112-sc6qdatpay
- SHA256 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87
- MD5 87af2a702deb442f74be6aab95069360
- SHA1 0427e9cf15b81ee81c31cc424b62305987980337
- SHA512 264361fdf8918cf91797db5cfaf947784d67e4a2b52220764bd6cb7b53a5a7b6bf3b66e985e246b51486de2037281ecbb586fcc326e496e907e8019e411a3f97
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bS:sxX7QnxrloE5dpUpxb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe - Executes dropped EXE 2 IoCs
pid Process 2044 ecxdob.exe 3820 abodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocFW\\abodloc.exe" 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZC2\\dobdevec.exe" 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecxdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe 2044 ecxdob.exe 2044 ecxdob.exe 3820 abodloc.exe 3820 abodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2044 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 90 PID 1880 wrote to memory of 2044 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 90 PID 1880 wrote to memory of 2044 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 90 PID 1880 wrote to memory of 3820 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 91 PID 1880 wrote to memory of 3820 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 91 PID 1880 wrote to memory of 3820 1880 2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe"C:\Users\Admin\AppData\Local\Temp\2ab7c6cfa9059ec7eb17b26ae5c05cd3be95d810b8492c38b0e86722cdc82d87N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
-
C:\IntelprocFW\abodloc.exeC:\IntelprocFW\abodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocFW\abodloc.exe
- Size 2.6MB
- SHA256 34fce96966063fa83f96c5af06931f4cc4196407e8556191eae69670470bc8ab
- MD5 0ce8fa07bb0877588c8c9b1e8d677a73
- SHA1 ff6c762240664145c8e8da47177f90915934e62b
- SHA512 896dc0ba4990cf62db662c92a1a1aa38318ee3a03a3f8d8df71d9bd97c1766e8b9d40083a0a844d8dc67d3e95f48cc83d0dc2f79b44581d19d0d5700c16503e2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bS:sxX7QnxrloE5dpUpwb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZC2\dobdevec.exe
- Size 648KB
- SHA256 01bb1c7f49d5c7186b9238f7953d69e8bca7b00097f9ce55a6f0d082ded38949
- MD5 b9a492279b84f4880662bd9a9fef8a77
- SHA1 2005918f20fbba66f4a7064a3643542e891ee64a
- SHA512 03a9763de0d530d2ced07dd8b2df0fc7f895dfc957cb764b8b5f4ae3d77a179ac57615e2540795f96cc6a65647f7ee17e8e03d2eadd652a1182383ab2ec7a6ec
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCB:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZC2\dobdevec.exe
- Size 21KB
- SHA256 b4130f462775ca1786a87d2bb2551bf5c3bf0341a658a98b47a682ef5199fd0d
- MD5 c9ac313e906df1f057c5759320a5feac
- SHA1 6f1bb04a2bcf2f67632823911043d6c3db80de2d
- SHA512 b782353e01cee193e32a075797ffcb25fa8a4a8ad8d857f1247560d850f7c2cb77598ea4b65d72ddbf45b7566c0efb59196b26ad8e6d13cac41f806deb708bde
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/7P:xezkk/DUj7TlODVED17z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 ecd54ce2569e77e51cdfd2d8d259a46359d5ac1df7ccb137ae0d82347b75b373
- MD5 d8138c76623bdeaac064740a9f7b53c9
- SHA1 1036e2df517356cb308f674ae26a07838f41652d
- SHA512 ebf8d9fe8498a1b218efc966460bfa83d09f162c46df0dbd186a21d0cf35c8ae4eb41fbef0224da5b5a1b6a186e485dcc39500ef582f595bb29a135353f829e1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 9a1b476af0a3155638979d0a1b4dc69ec8387425d3b9eb502020d3c76b87bdef
- MD5 c9d5ffbfae760112e1ba47fdb25b2980
- SHA1 175b4db6ec3226f480d136d1f98e4c8bd6442a68
- SHA512 bd745c1fea42364cb25b4bfe8464df2fb24b81cfc2ba475884f391a5ec33bc67c6c79f420cf906cb33343781890c0524df4fed0d24ddf289d7c4612bcc5c31ee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe
- Size 2.6MB
- SHA256 3d4698130ce21e747cb7caa06a78c75124c47e71d0c083993e1a1fbc70c9c8c9
- MD5 c689437bf3c6c42ca09abcb2c611a8be
- SHA1 fddeeb1d8f5953f729f7381bca1001d452d23b8f
- SHA512 05b1a35c7b97f95a30906a93ecd8628261e7b25ac5bb7c0f376452f4953ac9a51cb7a61f2c8a9d67676e01e4301bb3a9abaeb0ffaf4b3a822fb02f89b420d964
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB2B/bS:sxX7QnxrloE5dpUpZb
- MD5 SHA1 SHA512 SSDEEP