Analysis
- max time kernel
119s - max time network
119s - platform
windows7_x64 - resource
win7-20241023-en - resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system - submitted
13/11/2024, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe
- Size 2.6MB
- Sample241113-rtnepateql
- SHA256 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac
- MD5 1126405e817bccee40e524794bfb87f2
- SHA1 3f5bd9ad93c169ba6b428da65e6e04d22c4ea791
- SHA512 d9120c23546f49457b775ee62008cf8619f8aedd763e20ccbe2553addbb66fb652b7f2ce56011e7b3a941838e6c3d8ff64813d3fff3efa7e0a5f98952b4d7288
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSS:sxX7QnxrloE5dpUpfbd
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe - Executes dropped EXE 2 IoCs
pid Process 2388 locdevbod.exe 1996 abodec.exe - Loads dropped DLL 2 IoCs
pid Process 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobePE\\abodec.exe" 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintP7\\bodxsys.exe" 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe 2388 locdevbod.exe 1996 abodec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2388 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 30 PID 2232 wrote to memory of 2388 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 30 PID 2232 wrote to memory of 2388 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 30 PID 2232 wrote to memory of 2388 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 30 PID 2232 wrote to memory of 1996 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 31 PID 2232 wrote to memory of 1996 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 31 PID 2232 wrote to memory of 1996 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 31 PID 2232 wrote to memory of 1996 2232 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe"C:\Users\Admin\AppData\Local\Temp\8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-
C:\AdobePE\abodec.exeC:\AdobePE\abodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobePE\abodec.exe
- Size 2.6MB
- SHA256 e667a9125f8b6713c8c1ae463b6435a08103d48daba6772db2cb7e43b4609904
- MD5 5719e09b82ed25b0ade536caca2cb717
- SHA1 3cb01ee135130413f4c2561b9ad8c31a4767ee07
- SHA512 8d94437ef855668f0264872d6038b389bb27a05e3ba522f1127d245b76aad645e36da60c9b19e30e204d4a1c2bdd4b7561ee736bcfcaba45bf42006898f13fc8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bS:sxX7QnxrloE5dpUpub
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintP7\bodxsys.exe
- Size 2.6MB
- SHA256 214d997e687a718d2c5b735d54d8fff16c786f613dcf21e6972b6e6a46e60531
- MD5 01f0fc6032703d7f459fa3170528b955
- SHA1 951ee7e238e620842501f80cff5f3037482a73bd
- SHA512 e1cd8197f03bce3cc585494adb12f078189acaf4a83daf4bb6aa251d4791e21eb01ce3e1b697282233066fe4b1988c7a92299572070fec8d1ed6ab5d6c2905c1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bS:sxX7QnxrloE5dpUpKb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintP7\bodxsys.exe
- Size 2.6MB
- SHA256 41d04dff6b8cf2c06f91e47fa4f41bb7e4dfca62c2860baa8e49131d4cae2d47
- MD5 cc800ea3d96ee875dad6d2595b57b1a0
- SHA1 3777f14ee6a637f91a78078f1f3dbc25a3b1397d
- SHA512 c4ac37c470cab1f09e902c39a11fabb3d574b4ae53214f5600efa0c098f3edf35d9c2993ce065a436902b69e75e2fd6533f099aca118ed8f4ed25d8315b9693e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bS:sxX7QnxrloE5dpUphb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 169B
- SHA256 aa98593121332bba01772abc258832b83dd06988b28d147935ab9951b0ac9fec
- MD5 4c903d255c80a955bcfd09767da75318
- SHA1 48bcc10d56aaae2af16483d8e34bf5bb0ce813cc
- SHA512 cf6f425ca957bf53151dfca2bb3b0c469e0806e7716f46a63c6c19e2db7f9948d82b8172d52c261645175cea1189b90287507a7314dfa3476d46eced34b0fa7e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 201B
- SHA256 43a56088484ccf4b1e810a0c71db22b447925fa634fd4b2d8bdc8210d8099cd1
- MD5 a60363e2819832539c98a6b384ce52ca
- SHA1 e91dc1abc3dbff47635d91ee90be0fd63ca4f9fa
- SHA512 2c345eca41866dc4972f959b8a96f35cb7f96d78b5a14b9679079e4da99c99e0e6a87381cdc2e7ad6de818fca50506ac6a2a21af301569dfba400b27ba1b77e8
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe
- Size 2.6MB
- SHA256 e5811ad1afbbf8ae3facf53d81b5ab30799f06af50a757e9ba26429bd5375b7b
- MD5 92249eb55aadda35bb17426b1b200138
- SHA1 c250826d3c16085665800337a20e265c1ed39c1e
- SHA512 5479cdc79f03651f22386e0ecfa505bfb5fac1cf5ffc3be23eebc58be1d2d4cb94ecd4f48fdd41fe4cd3f332e27011291ee2de2b3fe09e1220d8e04bc18c1999
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bS:sxX7QnxrloE5dpUpub
- MD5 SHA1 SHA512 SSDEEP