Analysis
- max time kernel
120s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 12:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe
- Size 2.6MB
- Sample241113-pfymds1hmf
- SHA256 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40
- MD5 6b3b915025ec339a1aecc9dc4aa5e884
- SHA1 fe4b2458e90a6e172e9b470dff51dd3f79c593f0
- SHA512 62f6426229478700b27b02b3f809b80cc3081c53fa72db2713678f96a068e6478855412980457f325a8d44b0379a077b570539cc249a4c744e2b25914da2c08d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bSqE:sxX7QnxrloE5dpUpwbVE
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe - Executes dropped EXE 2 IoCs
pid Process 2868 sysdevbod.exe 2348 abodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot2G\\abodloc.exe" 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBJW\\bodaec.exe" 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe 2868 sysdevbod.exe 2868 sysdevbod.exe 2348 abodloc.exe 2348 abodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4888 wrote to memory of 2868 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 88 PID 4888 wrote to memory of 2868 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 88 PID 4888 wrote to memory of 2868 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 88 PID 4888 wrote to memory of 2348 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 89 PID 4888 wrote to memory of 2348 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 89 PID 4888 wrote to memory of 2348 4888 39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe"C:\Users\Admin\AppData\Local\Temp\39813ff93ada21aae5e969faca984feb5b5d55b151266eb1a5bdd725d0235d40.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
-
C:\UserDot2G\abodloc.exeC:\UserDot2G\abodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBJW\bodaec.exe
- Size 2.3MB
- SHA256 b4f23a235ab673bd352dd0676ceca5f0c47f53aa41537488bee7dcf9ad35c799
- MD5 34bd8f485cf18ba11f67cd1e8d36ac52
- SHA1 1b7b4f9b370cf74d48908d7218131f36aa941b15
- SHA512 5b97dc05780f933e5a53f2bc07bccfd129e2c4edaaaa104e988ba2b7a1e239ca898b5c95b5ca5bcd0be72f5d22d73939865f8fa8b5fd6ae3d35c972d4baec687
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJU:sxX7QnxrloE5dpUpP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBJW\bodaec.exe
- Size 2.6MB
- SHA256 9f807caeba976a9f2e526b4f2c1d5d00256e0201ca60fdd41e5a94260c0f28d9
- MD5 ab8d06923b27b1ca0e433c12ff87525d
- SHA1 90bb579a6bcba55ff0032935151bfd0388c23594
- SHA512 a941e4bcf46ed17b5e737ff6fdaa42b303d3ec0600be5bbb84816f77ec3da64734eed90567913a3d17ff33620cffe17e12b39eccea917b000989a18c82c87289
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSq:sxX7QnxrloE5dpUpMbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot2G\abodloc.exe
- Size 2.6MB
- SHA256 b79824f120d5440beff51e3fdede21bd1dcd6ed0cdcb8c78426001b8326f9cb8
- MD5 c408ed4a66b95913833cab0d943a1057
- SHA1 633083d5348de8b11169a9d37bcbe8c362456896
- SHA512 9eee17bef16ce9ef40a79ca6327b75995c6bc7f6e1df8d48978cbf3cbd233b0278f6a752c612d2bfd75cb6cbced31a3d47455bc61882a0d5f19b543a83b2866d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bSq:sxX7QnxrloE5dpUpAbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 d065210b729f901426b5d2e7492970370b57daa308921b81ef2d32f63cb4b807
- MD5 17f261d98c99606e874ecdf57440e47b
- SHA1 2601e2d5bbc698289b5f3bf0141b8877b8131015
- SHA512 9732ab972280d2ed1ac3607082e085c64c86e23f73edbae6e3378cfb1dd556ee9947e91d17f4fffaea01145e87dfc367ba2f0dc84eef7146331eed90b3a780f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 7ae70e6b8994ab78b7c58b96fe7c3833f341f1a4750898541171b9f9dafe8463
- MD5 6653dbc85dd06233936e9892ae0be4be
- SHA1 1965d3b53eabfb72f59bada9ba39542386ffcf5e
- SHA512 2706e6a0ecbd5edb75d3487b92121e5beac02e0f2ccd8c75b0b84166e1b6c88ecb30c344c93f8e8c37e106575dfdb41efcd864c5f78f75a03b67b6bceb416637
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe
- Size 2.6MB
- SHA256 569ac8af125cbdd91f7b626f1b33f52d07c5a996b4e09344adfae047cfaa2e6b
- MD5 2639e2c59ef3dca32f47229c7841e3b7
- SHA1 a7fee6375f0d5a2a7bd663010803ef1c7526979b
- SHA512 3dcf7c3cfa585e710f761e77d8a88395b4f8a7e40936b859eeb866020f607e0efd4df4c379a6233b782d4c294bbe9ae5e8d0230022a5263d45dd9ce54602edb3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bSq:sxX7QnxrloE5dpUp0bV
- MD5 SHA1 SHA512 SSDEEP