Analysis
- max time kernel
119s - max time network
118s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
13/11/2024, 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe
- Size 2.6MB
- Sample241113-rwsgestdmc
- SHA256 026415047a7e2f7298c30621b252189851361948be4b32dc1680eab563976b92
- MD5 86b811a732d64f1d7a9bbb655a6a4b84
- SHA1 8d5a00a09e1bdbf10fa00df353cc591b3310b6a3
- SHA512 06b388c984f836bbfd8106c17bbe5d66305ebabbcfc22b781eface0a93674a195d0c68ac9ac3e8feea3ae9884720937b227fde9dfdddb1955bf55382b2ed2ed5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSP:sxX7QnxrloE5dpUpvbg
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe - Executes dropped EXE 2 IoCs
pid Process 2652 sysdevdob.exe 2504 xdobsys.exe - Loads dropped DLL 2 IoCs
pid Process 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocRJ\\xdobsys.exe" 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxQ0\\bodaec.exe" 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe 2652 sysdevdob.exe 2504 xdobsys.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2652 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 31 PID 2360 wrote to memory of 2652 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 31 PID 2360 wrote to memory of 2652 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 31 PID 2360 wrote to memory of 2652 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 31 PID 2360 wrote to memory of 2504 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 32 PID 2360 wrote to memory of 2504 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 32 PID 2360 wrote to memory of 2504 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 32 PID 2360 wrote to memory of 2504 2360 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe"C:\Users\Admin\AppData\Local\Temp\57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\IntelprocRJ\xdobsys.exeC:\IntelprocRJ\xdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxQ0\bodaec.exe
- Size 2.6MB
- SHA256 9c8f049f21e2991031fb74a59d33337ffd86c0e79819a506320d7c8681f03268
- MD5 c828d35e0ba6ac58e41eb6e743a774e7
- SHA1 30af081f8370a05a121a7753c352b4c262bcb47f
- SHA512 5fc8f74e15f5da8e259e2a9acf54b38382f59042fa62a0152a22fddb972f428b9ed652433dcbe2131f45595ca6f8a9340dab88492f6f51b702149e11f06bcc70
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bS:sxX7QnxrloE5dpUpZb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxQ0\bodaec.exe
- Size 2.6MB
- SHA256 82b05f0c90264b228c8a74e1ed883bd9cff86ef793e217704a0b608560c17caf
- MD5 1b863ef4832b3b673c3e8309fe7a056d
- SHA1 c81447c199cdf32ba7b4e15c888c8c1a2245b63e
- SHA512 8ee54bfe5199cb3b1c4043860dda8d942903a8338342123788bb9a6e7c04a8f9f94f94490cac6370c6fc38ec4aa4d0a8a523fb38b4f136beae33f1b03f27f407
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBpB/bS:sxX7QnxrloE5dpUpub
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocRJ\xdobsys.exe
- Size 2.6MB
- SHA256 3de54fd35d82c6a91b4cbcdaa94ff0782ec0cfe5b7b4fe75736a0b6a2722966c
- MD5 277bc1d81034205fcfa8b4981e734cac
- SHA1 2ef949523a99ecb9942f6a445b162a8d6fc39405
- SHA512 fa84c48afcbfb29378b7e1048889055e57f8d8908b65245de69caa590c51be1ff3de29df6d4de6191477ae3775d4f86f3112885e4d843d68368d99424ecee010
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bS:sxX7QnxrloE5dpUpVb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 174B
- SHA256 2ce94587b2182dfdccc09edd1f926bdc13bf97973a8057338448681536f93859
- MD5 f8e5ed85d78cd8d866db65db67390fe6
- SHA1 a7cc2954b449223af26fb4186fd0c5cbc6fc175d
- SHA512 b2be38f58a7a3fdb65804eb26aa9be96faba3942e2f6f9c730fa3b9e53a6997f0c6d4d559344e67afd7ea5b9168852b0b45c375c8923a3d6b2824679de76668b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 206B
- SHA256 172dec725757a43d35661cd726cfaf8c18ca6c05c461a94bf59362d2d228556b
- MD5 99c3150bf2c763ff229c4649e2f2d11e
- SHA1 6370f93c0b6c2f080fad8bcccd4977c19066f23a
- SHA512 7e11b7748395c37f54c969501ff3dbba6668fcbedeff0e6ec670c16f5fe4c7155b0fdd774b1f3fb394b3677ddc062b44fc7d6f9d6f74a4b0257231c2bd4ebfcb
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 2.6MB
- SHA256 dd2bf19c52e240f7b32e79d15dcbbcccdb00c3eb8e2ee5be3b532f329b392ba4
- MD5 7a1ade2670c6f76e20d2c62468985c8a
- SHA1 4864412fdc1a6fb2d63b499a7c8efbd3c713ba92
- SHA512 a3cfe540d288a8e2d909b99ab58d94f6d1a3acb913a77178353c0f3eedd7d9f6dffefb09754e0581f893ed0a3c0b8f953d10a959bad8f1040a9afbd809650e9d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUpnb
- MD5 SHA1 SHA512 SSDEEP