Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe
- Size 2.6MB
- Sample241113-rtnepateql
- SHA256 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac
- MD5 1126405e817bccee40e524794bfb87f2
- SHA1 3f5bd9ad93c169ba6b428da65e6e04d22c4ea791
- SHA512 d9120c23546f49457b775ee62008cf8619f8aedd763e20ccbe2553addbb66fb652b7f2ce56011e7b3a941838e6c3d8ff64813d3fff3efa7e0a5f98952b4d7288
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSS:sxX7QnxrloE5dpUpfbd
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe - Executes dropped EXE 2 IoCs
pid Process 2596 locadob.exe 1624 abodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotSG\\abodsys.exe" 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZC2\\optiaec.exe" 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodsys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe 2596 locadob.exe 2596 locadob.exe 1624 abodsys.exe 1624 abodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 604 wrote to memory of 2596 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 90 PID 604 wrote to memory of 2596 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 90 PID 604 wrote to memory of 2596 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 90 PID 604 wrote to memory of 1624 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 93 PID 604 wrote to memory of 1624 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 93 PID 604 wrote to memory of 1624 604 8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe"C:\Users\Admin\AppData\Local\Temp\8f986c813cabfd3f828548b42676a95d8a321fc00d70e1de2728ee79b9528cac.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
-
C:\UserDotSG\abodsys.exeC:\UserDotSG\abodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZC2\optiaec.exe
- Size 2.6MB
- SHA256 01675a32ca91bc381b63cddb509064c2431fcec8b5051fe4cfbd0f3ce498aa99
- MD5 07e8e6588596303269ddcdceb3ad34aa
- SHA1 8ea56bcd819a51119b696419a81a6f1e53b9463c
- SHA512 78ed38bb7ce12b3590ad96893978e6bf16a177721977855f2d5d09395f25faec22e10b5aae5fb6ef25ef2b3b30c3c0b10bd544cae0285d473ac5524eb4d1e5ad
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBkB/bS:sxX7QnxrloE5dpUprb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZC2\optiaec.exe
- Size 1.4MB
- SHA256 285690fe8971b3dfa66fa7b3f0e18fc7ff22bf204fba99c6230e2eb79aea2b9f
- MD5 3fb018f6611b60eef8d679ece9fb2d5c
- SHA1 f3d626167874a726fdaa959e2289fc08b22d64e8
- SHA512 158ba3b67c90ef89945a1fae1e2056dd18f8fd1d7d4fdce22290c6bbd2f801d47f07e3fb9282150dc1e39f7959787d50480d1186e01dc22fe0db390b9ea0094e
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDu:sxX7665YxRVplZzSKntlGIiT+Hv/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotSG\abodsys.exe
- Size 512KB
- SHA256 4de7fd9441fc0fc69c2c0ca7343dceee376b87da9418b0e05dd2f30d87d685bf
- MD5 768c4b74117aa0c9a9912a4ea90ce6aa
- SHA1 b2b652ae0aa5a744980ffb1320fd8388bdf4e5f3
- SHA512 5a782509953044cfaec6f23854e73dd80a031e62f613f66024e14012114d7c8599df0ca8f3f2315a997001ae7814cad44b1db7a27e944b0d83d95e3092a5639b
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpw:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotSG\abodsys.exe
- Size 2.6MB
- SHA256 83efdecd9203bb1e20d6a5286323e4096e2be9c42fa23d64be6a0b1c129084e7
- MD5 f4afb4002ab216974919bb8c8c0ec1dd
- SHA1 c53e6976d3ecabac94a681bd429e95303fdcfc63
- SHA512 292cba7c985ea82fea9cce713f151a668fe315f9bece57fcacf306eeaece2f51222967200962749297c20b68f9554bdcc8a02251a87d68d1e72d8e797c3fe6a5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpPb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 a2734e9095fad0d35508b6d2d64650b82b39cb7cd717b3d46169d38955f38d00
- MD5 e57a8870fd34c88bbe1b4a719f0ea629
- SHA1 28669d945e79b214f36fa28da0478aaa5ac532f3
- SHA512 f1ad73bdd366d787263a294ecb6b02f70f332bd93870c51245cff1e0c0230df9ad54ca56f641d77323663eaa9a15cc52698f47878977131ea8035059f1fbfeec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 be45c91efeb6f1f49856f41de6e225dd49df54b5a7eda14f9d5bedcb6fa531d4
- MD5 b5f6b8f3a73dd4c9f23b0f820caa83ca
- SHA1 f8f31d15ae10eebc1704f72be4c1598ba0161b3b
- SHA512 e45b6d75e0602c7a01caeb55845c23504225276eae82fce331b016b20f4dec5b17ad01bf94aca90c5658de51e089971b7e08f75fcf96628f26f731daad2f84e3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe
- Size 2.6MB
- SHA256 2875e105a79e06b9820d4571cacde4463e62f709639e23967261a7e2e4e031c4
- MD5 ad901fb4693d42f920d04dc0ff86cd07
- SHA1 af0cf52013344b2edebfb892b5f9912a61c6e13b
- SHA512 b314a555199fde63cafa702b11f145f123f838934a4994afc24691c50451b21b3672f3dc7fb853877dd6a33df45b630aace342ad9b59a41ee3e48839e7c1578d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpbb
- MD5 SHA1 SHA512 SSDEEP