Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe
- Size 2.6MB
- Sample241113-rwsgestdmc
- SHA256 026415047a7e2f7298c30621b252189851361948be4b32dc1680eab563976b92
- MD5 86b811a732d64f1d7a9bbb655a6a4b84
- SHA1 8d5a00a09e1bdbf10fa00df353cc591b3310b6a3
- SHA512 06b388c984f836bbfd8106c17bbe5d66305ebabbcfc22b781eface0a93674a195d0c68ac9ac3e8feea3ae9884720937b227fde9dfdddb1955bf55382b2ed2ed5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSP:sxX7QnxrloE5dpUpvbg
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe - Executes dropped EXE 2 IoCs
pid Process 4864 locxdob.exe 3868 abodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeNN\\abodsys.exe" 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintE2\\optixsys.exe" 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locxdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe 4864 locxdob.exe 4864 locxdob.exe 3868 abodsys.exe 3868 abodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1892 wrote to memory of 4864 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 86 PID 1892 wrote to memory of 4864 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 86 PID 1892 wrote to memory of 4864 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 86 PID 1892 wrote to memory of 3868 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 87 PID 1892 wrote to memory of 3868 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 87 PID 1892 wrote to memory of 3868 1892 57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe"C:\Users\Admin\AppData\Local\Temp\57e389f40cf57f59eadaf9e0225d29e437d67109820c21f4e4a4de3f54fd3fc8N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\AdobeNN\abodsys.exeC:\AdobeNN\abodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeNN\abodsys.exe
- Size 2.6MB
- SHA256 55da8ab2bae66f1627d70b9194e3f2981e1fe6c2fd1e8a221e3131fad2161fd1
- MD5 3eae10f76a8a4435a3e23e932f1cf3d0
- SHA1 0126aae13449d912e444a76f5031e29e3a732bad
- SHA512 3e6efa53c21485e0d01e7432f84ff1930a7f96df83ee15f1edb3ae105a40624084eed591c3626ed0fc76fb286d81e510cb87b78e3f2c3b1a921ecebcac9f2f56
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bS:sxX7QnxrloE5dpUpUb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintE2\optixsys.exe
- Size 2.6MB
- SHA256 5321872281032d17cc3d1ec1909ce23d0f04b9c9476a45f19c41501c5b2569a9
- MD5 ca7a01e38b94d6667ed7478a141626d7
- SHA1 ac444159fbd8ca3f719fd2745d3a23fddc9c598e
- SHA512 cd75c0a0d4abeeee79187999fdf8994b1b52818737f26031846ae7ae3307418b1a464fde80d29492ba500d6b742791408a04f6e34819a141bd3602e5ffb89b5c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBWB/bS:sxX7QnxrloE5dpUpxb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintE2\optixsys.exe
- Size 2.6MB
- SHA256 d175e3831e3fc7345c40ec5479de339614620fdb686bff7b7abf087eea975b11
- MD5 f0ddb5105cbc59bc000a6904e0116790
- SHA1 5a6f6595194c0aa35f10eb66b0f6d2e648c85a45
- SHA512 4a3544798558ff543c06386cde69ccdb2aac71978ae3215fd4ffa13636c9102e353da621f599c499cef265e7c6dac67a9f587c2d6f1502ad0b37c83fcfb0b6b8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bS:sxX7QnxrloE5dpUpeb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 fb19b29cdf57c6a5c7e5c69ea493fb141b697785703754dea68d0d034084fdb5
- MD5 6bf600e114410e8b20acae0350a779f4
- SHA1 224b9cba6296aa6bd81cd1e5f9a0c17b39994dad
- SHA512 653d05302444a3119d35156cc0ecd858d076ea50ee53cbfd682bbb98e4024cc6b3929085aa62b07f2a18ed3ca7c7517d5f7500b626345d570271bcdf5f8cf14a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 5c8e21f8199738efe2a127024871336903699bf774dd5cf64dc305d810f05446
- MD5 c642aad4c7d63a675f31efb62bf0c9f1
- SHA1 331a335cfebd61b4931c8d3839b56e7d24676501
- SHA512 50722a0aa974627de57dfbb95c201cd79a5493df3213f03ac73ae6be99cb289812536c47ea2df019292f14c48a025fce9ded8ff3aa82b13343349e9a5feb7088
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe
- Size 2.6MB
- SHA256 0267d30b2ad2cb4a0c0e815e8cd3b22468c0ed2edf94a36ca074348dd128a0c2
- MD5 99777c99fe0234cbb543b92657b22c13
- SHA1 b98afdb041dee5b84d0b8a672216eebbbdc7ff31
- SHA512 0a685ca8fb362ff11814e61208312331712c41b4b92de25f4fb0a8165247c39211d87c59d5f2486d8cbeefdb6b49fe55d3129055ea5e3d238c7215b58bf1fec0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBzB/bSn:sxX7QnxrloE5dpUp4bg
- MD5 SHA1 SHA512 SSDEEP