Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe
- Size 4.1MB
- Sample241112-ynapzazerr
- SHA256 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339
- MD5 00ea4f40f42f3d86b732a58b99665370
- SHA1 3e86a90fec1433fbed5fd200687582f7a4142f1e
- SHA512 448842883fd7318588db78383d09a4e719f521c78a63855d43975947533b9485cc8c673a90cdf4df74f17a5c1db4804c2ca1ad165a16ae1238f4f1d4f4d4db6d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpJbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe - Executes dropped EXE 2 IoCs
pid Process 1832 ecdevbod.exe 2968 devbodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesB0\\devbodloc.exe" 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB5E\\dobdevec.exe" 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodloc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecdevbod.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe 1832 ecdevbod.exe 1832 ecdevbod.exe 2968 devbodloc.exe 2968 devbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1020 wrote to memory of 1832 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 87 PID 1020 wrote to memory of 1832 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 87 PID 1020 wrote to memory of 1832 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 87 PID 1020 wrote to memory of 2968 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 88 PID 1020 wrote to memory of 2968 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 88 PID 1020 wrote to memory of 2968 1020 7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe"C:\Users\Admin\AppData\Local\Temp\7c953fa08a830e1c84c1b10066fe69eee59ed27f43b54538285120f19ad00339N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1832
-
-
C:\FilesB0\devbodloc.exeC:\FilesB0\devbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesB0\devbodloc.exe
- Size 609KB
- SHA256 1ed69ef1c7b184a83c2b28d9d65b3842a89fe651230da1a76138aadae2c4bf28
- MD5 ff9d7cc2b4bbef208faa4b13318bde63
- SHA1 a1c4fab86656a8aa78fc48577e0020787d3a9fcd
- SHA512 54efed9cec252cdf6c7b9a6385ffc95f911ab209a4e9ae249d42dd4378a748424d9812111d62060c640664b1f52858fdffe0223d2e3af69e76855546de071b95
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcg:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\FilesB0\devbodloc.exe
- Size 4.1MB
- SHA256 9fa2186541300a424bcc45c0f3bfda0cc6e706edcaf04ff42c867da3c4089af9
- MD5 ffe5588d2c136fb41d6f3b02392831ff
- SHA1 cb97522ec88da0e09b1073b256152c90bd05593d
- SHA512 99ef7f317778cfa0349a3ea59cabd3ff6052b2ab7574dd3c4d183869a64916c5eef3ab75215139f0d3af2cf6175770730c8a17a9dcbc9fd00ae3da3c0b3936a4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp0bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB5E\dobdevec.exe
- Size 1.9MB
- SHA256 0e889202ad9a9d117cb5c1ac1ce26108f02e940b3a730c7d24c7841350cd0ccd
- MD5 8b3bad7d4b6cdbd513643571314bbf01
- SHA1 e24f472db280ce380b97dbcd0b0607c85f0eddda
- SHA512 bb14b4670c7d7fae053becd1b9a56668e2f72989a9a60dc50c754576b7459870b5e4c116a82584b58ff685eeeb775646540c3fb39733173d8da6948601c9f7b5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3i:sxX7QnxrloE5dpUpV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB5E\dobdevec.exe
- Size 21KB
- SHA256 ce0138ac377dbb09e66daa1ced993ce73476b2844db3b4f52d1b81908d9773d9
- MD5 c5aa66ac2e75e64f62da6470e6b2d037
- SHA1 bf33b7fb0a1a2c3d5d89dd7fa4121e12bb6222b2
- SHA512 a6e2a0cb1a7f88d3718a06cd1680ed600183618db91eada861876e9612d378ef382e6f811ce96dff3327c055c46e07ed81482b04647bdc0ee2e80d001c7f655e
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/7m:xezkk/DUj7TlODVED17i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 39cc95af443689ece947b01d5913039fff5d1a3d21128f98ac438520c30ae1ea
- MD5 105430f1d687644f5bac9f8d9dd82b68
- SHA1 fb58baa674e93d2957eb68d81a27934876ecf5f7
- SHA512 93f910e6f0976f7aaadcafcf9d59735784d2a41b0d1bcf99ca197b6924528c04682926bab5a1a6a33f2fc5a8dc1501c0a332f4b4d84dfb4182efa9b352adae51
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 48d9fc5c844b0d78a7ba162f42ea10b2aaad12af4d75d95815a380b94a6fcb1d
- MD5 94bb1323b29943bda77479eff04a5b62
- SHA1 497fcb7bade5cc1e46f38f18ac8610f528e98288
- SHA512 e6389869575b5752b57198048a5d84e19dff1d16e8e2a9b37ca18600960b9202a335b40b916c047acf58fd323599c8b4326c2b44a147246dbfdccf9da70aa763
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe
- Size 4.1MB
- SHA256 448609a4ec37ef429225b6124eca36a6cfcbd5558cb63309535267ca85f31bdc
- MD5 da7f9860ce68dc43717c8a5d946ec7e6
- SHA1 ce395754a48086484f5dcda05fd37ed4a246c17a
- SHA512 8486e54d82958af471cd3c6edff3cee761d98778ecdaec07fa987914b032a4cd715c3de13889b4d4f6004d28919ad8baa51da9d7c6961d81291e6c06e03d9f72
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpsbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP