Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe
- Size 2.6MB
- Sample241113-qm7djssemd
- SHA256 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05f
- MD5 aae815e229700464910217dc5add0a60
- SHA1 e17b32962dba0ce9935272162e27d9c44c851970
- SHA512 9557b70df271785cd10c3c2ae19f73266c3a23596e2277e04a437c5177ff35b27366d502314ed0e72dbf7d22b50fc9cda404c8a1f5a88d118a52c37dea13d81d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bS:sxX7QnxrloE5dpUp5b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe - Executes dropped EXE 2 IoCs
pid Process 4928 sysabod.exe 1016 devdobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocXI\\devdobsys.exe" 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBY0\\optidevec.exe" 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobsys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysabod.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe 4928 sysabod.exe 4928 sysabod.exe 1016 devdobsys.exe 1016 devdobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 524 wrote to memory of 4928 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 87 PID 524 wrote to memory of 4928 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 87 PID 524 wrote to memory of 4928 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 87 PID 524 wrote to memory of 1016 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 90 PID 524 wrote to memory of 1016 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 90 PID 524 wrote to memory of 1016 524 2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe"C:\Users\Admin\AppData\Local\Temp\2cf8d95138dbc1f34e5f0d2b34e9f651c509d550f63232354dfbe3781c0dc05fN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\IntelprocXI\devdobsys.exeC:\IntelprocXI\devdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocXI\devdobsys.exe
- Size 2.6MB
- SHA256 6c7879da1740e615224b712124d21a7be3be4d99f17dd87d1d5f434de39a6555
- MD5 7636e69ab4cb2626cf289d1919af1ffe
- SHA1 e07d39930b75fe3a67eda57e59b82d22f2101660
- SHA512 0689f4d28c55c31deb9607e9e6263c3a626c37223806594aba8ecdd4f7b3bb56e7be1e3062b6f48fcfb993df9cac95e0b8910b603027f3f6b757cebabd35b486
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bS:sxX7QnxrloE5dpUpVb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBY0\optidevec.exe
- Size 2.6MB
- SHA256 10c658feb625c0f78453258836d9ead379546230dc703e019a54397d105afec7
- MD5 c180a7f71a0c45de42f75113beeac47e
- SHA1 4796d62c92a435f22965872cb9a048b4a8c7b173
- SHA512 ff4578caec62a2769e3bb53bb10d4e16bd5e23caf5726b123d08ca3d2ef394565b1bb32c5ab04d956e6ba5fa6f3f259b8de647a253e9fa48ba9031789aff99c7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bS:sxX7QnxrloE5dpUp9b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBY0\optidevec.exe
- Size 2.6MB
- SHA256 6c06667db6a8ea0af1c8d619cf7a52b3161cd74bbf6d24f9d6b0346b0f30f2e8
- MD5 5ba64b54c0396dcb2fa5f8d6d0b94815
- SHA1 1929851dc91eb4bf0571ea68f293d3c311b5988b
- SHA512 7ad55b2ac1cba8774a6d749b1b103c25368c3ef8787b172d0aa8bf7fb3d36c12f5708b94d34514036acac6bff19f77265fb022339f6d44035145dc19777aa31c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bS:sxX7QnxrloE5dpUpkb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 208B
- SHA256 57b52d596d947654e65bc3071c80034471712bc1fb83315f6dbe5ecfaf8a72da
- MD5 96eef99fb2475dd8c65133fb8b2f2bb0
- SHA1 bdee1cff23b9623714f1d34298fc5e3d4b755a45
- SHA512 324723157284beb615271d6dd2773d75d3c6f3f1472ff6cee3dda1c0053ed83dd8f6dfee76754b58f5a452f4d09653e0272816df87b099abba4b8cfcb53ec19c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 176B
- SHA256 bf742e2c6e0b2d30f186485594c748b0941086621d8f117997c45d66d53deaff
- MD5 e60e82353e5cee6cd3a5622f72dccd22
- SHA1 2b074a11aa93ba298604600f2058bc4194cb6507
- SHA512 2fda6167b10213054b813d53479c522c1d050062c0fc6ca10b039a059dad1b936386f335e8cab4cff9f9911c813b35c94836971d7a59d1ef92b086a7b0fa3339
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe
- Size 2.6MB
- SHA256 6d5d472489130e2aa36925dbfca657d61276a93a79a4287411e6fe314d01c71c
- MD5 82d3e6f03d972c2ae4b30b34ecb54dac
- SHA1 28e694a5bb95b1e928b199159dbb01edcc00904f
- SHA512 e7423a1e007196487b419ad6399d82dc7c5345961ee79744eb843d68a7695c776f9359b2e0707e854170a83ff73fc06d94f30984be85de82b2e1344cd565b679
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bS:sxX7QnxrloE5dpUp0b
- MD5 SHA1 SHA512 SSDEEP