Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe
- Size 2.6MB
- Sample241113-ppwjdsvpem
- SHA256 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039
- MD5 b85185b7b3921c81a87af8b9f1080a3b
- SHA1 2308b0de8f58b9f26325268ce1ad74057b703c57
- SHA512 95638cab7b017d62751d0743cf82b4a7180636026fc774766ef5c78aede4fb25ce6b750c87ab2461f1ec5f2187ad22c7660957a313bb18a0d1d68a1b808142b4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bSqE:sxX7QnxrloE5dpUpubVE
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locabod.exe cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe - Executes dropped EXE 2 IoCs
pid Process 2184 locabod.exe 4344 adobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotXP\\adobsys.exe" cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBN0\\dobdevec.exe" cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adobsys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe 2184 locabod.exe 2184 locabod.exe 4344 adobsys.exe 4344 adobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4044 wrote to memory of 2184 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 89 PID 4044 wrote to memory of 2184 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 89 PID 4044 wrote to memory of 2184 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 89 PID 4044 wrote to memory of 4344 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 90 PID 4044 wrote to memory of 4344 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 90 PID 4044 wrote to memory of 4344 4044 cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe"C:\Users\Admin\AppData\Local\Temp\cea49a935ced24fbc7fbc6feb02db4e0e42fc2ce85bce3d8345aceb8a200b039.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2184
-
-
C:\UserDotXP\adobsys.exeC:\UserDotXP\adobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBN0\dobdevec.exe
- Size 61KB
- SHA256 34240a0bab40a25305e7c0e159cf9c4fe60979e2752eb469b33e2e5e73639f9f
- MD5 565564402007a67f03d8488355b82ed1
- SHA1 ce801332d61e8da49e1cba4937dd224cd92bf5a2
- SHA512 535be460ab62ff66abc78bf524b763e483c74e659c01911f6f75b6db10147aebc54d2e947b82d88480c4be11b4d4b5cacd806a04d478d083dc60a7f6f2a84ecd
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkfE:ABalOBo1TKFO3n0KkZHqX7+g2lWXQV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBN0\dobdevec.exe
- Size 13KB
- SHA256 705f76c68555180f761c8c851afc45b406822827d7f5552bd4b1e0d0b4814633
- MD5 010abc54ad22b0097656874fb22a7154
- SHA1 45bdf3c1248bfa8c3561f645584b422b09487bfd
- SHA512 fa5324f35df376fc039ce4e3f804a6f788d3702b680d932e1c53d240d96195a223dda954f583c38f94a775656386606d2c16788dd30a1aaf3eae959c47311545
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJja:04ezXTIk/IxT/ES70S7TqOO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotXP\adobsys.exe
- Size 13KB
- SHA256 2d835e282b9a7e65559019000af2d36aea1151090066ff801f25da276c99e627
- MD5 8c3627c138b69a29f1f3e7743c377ac9
- SHA1 38d00db20d4ccba9fef285bc5b2c50eb73f352a7
- SHA512 0e81b2f188fef8742620e583da5a47aa6eae70cf24a798f64d916f01fad49d5ad6f3e883deed9cc6b3dbd7301c28e483ebcc324d83c8a63b41ef839432ef7a21
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjaC:04ezXTIk/IxT/ES70S7TqOOZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotXP\adobsys.exe
- Size 2.6MB
- SHA256 b619852860b1434c6972817a9701ff3a4539954b35b2fefc50abf4734ecfb639
- MD5 47183de65b0abce00441800040884916
- SHA1 5a353325d564ad152200dc42703f17f9e81362fb
- SHA512 dab1187b0eeb3067076760dac2e2c6242fa66d58b09342e8f24dba8fe57aec30b06185b1e93b8dd574458036ad8054b1f9d3bf06b55c8060c29637bef25ca815
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBzB/bSq:sxX7QnxrloE5dpUpAbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 87a86a267bab9b1bb49cd78d96f7138f9980f879f3e9d4a0ce9934bac4a099a0
- MD5 694b42ccab696259f365b24bc0eebdda
- SHA1 3de198af6d7fdd9aa8bdd2c6ce95dee80e1e9df4
- SHA512 3b7d896a4fbda50dae8e06271746a226752d18c4535fb4a3abcd1876c0e31f7355f296094f623596647df385835932938d9a6ecc3edd239f4a773f310f33f239
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 233f093e94c7c31435740aaf693fba5e327ddef1d4a0158bf09a72e804467a8b
- MD5 485823cb12cc0f406b524ac24bba124d
- SHA1 af6b4904998f5d97da5a55dff90869e5cdb86d2a
- SHA512 63465a1d30bd03a079605967af015df7f89f77ca90756a3d71fcf7349c114806d9e8e171df39707422cca5526f7a5622272a6b4ef1cfc1ae3c6edb5192f6e54d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locabod.exe
- Size 2.6MB
- SHA256 2e53087315af588ebce5142c4ce8d7147dc38031bb7fee8f83949291e0e9277d
- MD5 d297daa29bd1172a7ce062dc9e8be71b
- SHA1 d53eb51527d639789d5aa6cd3904fae730f85b73
- SHA512 4bc6af1245e79939bea6b21c33f02073aefda0bcb8acefb7ffb2dcd909acdbf0c5cd79e34eb7d6de57eb9880ac1ad8a6261dd5ffc5d16b52178284017f530357
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bSq:sxX7QnxrloE5dpUplbV
- MD5 SHA1 SHA512 SSDEEP