Analysis
- max time kernel
119s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe
- Size 2.6MB
- Sample241113-s224gsxraq
- SHA256 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32
- MD5 3ceee883a45df13e2d5fec3ec2407921
- SHA1 eb2650dacc6564b454017bff965e1b73f876c362
- SHA512 b6d8b6b7aa1b627574b690db44a09d20272a7d31b2f2a59e445ab5668ae7f70199a077423340dce42e0e77078803131502b881045ff80e41afc5e1f3af0e66fe
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBbB/bSql:sxX7QnxrloE5dpUpwbVl
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe - Executes dropped EXE 2 IoCs
pid Process 980 ecdevbod.exe 4492 xdobec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxK3\\dobxsys.exe" bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocHN\\xdobec.exe" bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe 980 ecdevbod.exe 980 ecdevbod.exe 4492 xdobec.exe 4492 xdobec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 972 wrote to memory of 980 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 87 PID 972 wrote to memory of 980 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 87 PID 972 wrote to memory of 980 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 87 PID 972 wrote to memory of 4492 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 88 PID 972 wrote to memory of 4492 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 88 PID 972 wrote to memory of 4492 972 bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe"C:\Users\Admin\AppData\Local\Temp\bef61ba3aea7b6d81b30fdc7784d3f6f2c5581fbcc2078faec18a2035df94b32.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:980
-
-
C:\IntelprocHN\xdobec.exeC:\IntelprocHN\xdobec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxK3\dobxsys.exe
- Size 2.6MB
- SHA256 bfd525a7fec6d2cfcb6da4b9bd70d04ceb191404f709c258f563aa39fc5387a9
- MD5 340bd128c1f66c66b096c2d04e8c026d
- SHA1 65326d53ac59cea11d8da4ac860bdbb31a920943
- SHA512 77af25db323282b5ff6574762b4722ba65cf21d695709c0e21427a761202f72d9cec70d1f008d19fec5e00e6a9dfff82f6a78f14abe263d4027a422a6dbfb8fe
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bSq:sxX7QnxrloE5dpUpvbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxK3\dobxsys.exe
- Size 2.6MB
- SHA256 dce814c36203af6e9dfd97d5656fab33ccb6009d61040e2b5cf5e09b7a2abe2e
- MD5 7b23feea2332ad8a1a2fba775ba4fe90
- SHA1 e4b325e65548497dfba40880fb9006966996de95
- SHA512 4217099cc8a829f0c689582968a461c1a942265961af45d31d17fc5346c47e63c3269781de8233cd082352bbc56b9d3f9ced5419b02a3eaccad20429e8517c5d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSq:sxX7QnxrloE5dpUpMbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocHN\xdobec.exe
- Size 2.6MB
- SHA256 fa7832a81f23bc88d31881e9e727b50eff10d4183a0caf07b727ad5a41f907cb
- MD5 45501990e809d785c4b9da54b6377ac3
- SHA1 46c57b75beaf39b75c48c1d195a096381c826b02
- SHA512 601a33f2981af7f363b06759bfd04e9d837e3badd8e10707df1f59487b2dad964211fc237b2a66743d649fb01ec4868c925501750d5316a501e76a917811fdf6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bSq:sxX7QnxrloE5dpUpmbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 148a33f4bbfd3ed32178467f9a8a4c8f7232ecbdd3e4382d09ab588c3fa9d902
- MD5 e20027e5aee93049f46a7b8f097e0ea7
- SHA1 51183607a65a72b179ee9cc9e4fd5d38dd0fb654
- SHA512 bdf1edea930be67f459a8611f388f6c92777204298bced8c07e9c990840a2d44c9277963ba208f66e41a35891088fb5f54bcd9d5a8c8cef83bb00bc45a61980a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 766482c6265912319bb329511c229d3225dc0381543449b1827922d8a5cdccf1
- MD5 2fd9c169c8a365360bc249e2b0de760d
- SHA1 c010f27eecdb55e3654077ca1d5af0e9e9d64923
- SHA512 4d0c09493bcecb2b2d5b3c71d102c305fd376e9c3cf7abd9acd86db8dc37f30ccefca94973403bda5e533f560e122ecbabec3c3026d2772a9739a2120935f2d0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe
- Size 2.6MB
- SHA256 3c705df6b8497ae0d07846ecc3b2c896f3cb1c17819279f8bea78a918e2abcf9
- MD5 ca6b1ea2071df9427e847ce0c53466a0
- SHA1 ae63ed68a8726102454c2ed3c9dd71a99e69b76d
- SHA512 0925ee2729a7b441017d8d00204bfb4a6e7f6d4d2b86690bfb1bdb7049edf61e0c4d5024a66d9d032835c32298b4a1dbaf221703dcedc736fc01ee010dec7434
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bSq:sxX7QnxrloE5dpUp3bV
- MD5 SHA1 SHA512 SSDEEP