Analysis
- max time kernel
120s - max time network
16s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
13/11/2024, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe
- Size 2.6MB
- Sample241113-sd3ecathrq
- SHA256 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8fe
- MD5 1e269386b1f13dfd23f693efa7ffc900
- SHA1 2474193d75a5919ccc9484181253079804ad78b0
- SHA512 c560c7c59d0139724b237e06a5bd84ec1ab82e74d3667423d506a719f29349390d72fe21eb81785f2531d5afc5ef53383b2a58468ab9225a0e6e2c3204c5150c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bS:sxX7QnxrloE5dpUpyb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe - Executes dropped EXE 2 IoCs
pid Process 2704 locdevopti.exe 2284 devoptiec.exe - Loads dropped DLL 2 IoCs
pid Process 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot6S\\devoptiec.exe" d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB1E\\bodaloc.exe" d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devoptiec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe 2704 locdevopti.exe 2284 devoptiec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2704 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 30 PID 1204 wrote to memory of 2704 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 30 PID 1204 wrote to memory of 2704 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 30 PID 1204 wrote to memory of 2704 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 30 PID 1204 wrote to memory of 2284 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 31 PID 1204 wrote to memory of 2284 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 31 PID 1204 wrote to memory of 2284 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 31 PID 1204 wrote to memory of 2284 1204 d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe"C:\Users\Admin\AppData\Local\Temp\d857930fe114370e37e0ee63121bf67d862ff9dc02d260d29fd608e6bc22a8feN.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
C:\UserDot6S\devoptiec.exeC:\UserDot6S\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVB1E\bodaloc.exe
- Size 2.6MB
- SHA256 2baba9a5e735f3828870421de6eeccab4010266eabf97c7ee066948ec4c280ba
- MD5 c32dd4801e92b109e2aec4f33c88db0e
- SHA1 b4773bc78c14e725927262e51402c7c0d0d9b6c8
- SHA512 b795b81d2270ca5ecfb5c3beb03449176f15b7b2ad197e31b60669a0012586bdc645f35839a3c62975174e4464c81a42f04e50cf35cccd6727723ea055a0b21b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bS:sxX7QnxrloE5dpUpEb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB1E\bodaloc.exe
- Size 2.6MB
- SHA256 ed834ebc19bb8f5771268977bbcd43d7ba1cafd2be2b24862f824009f04c5c22
- MD5 7a3d73b1605ef501100b4cefde13e9e3
- SHA1 b149f3d6d01e80b83a0ad6cf9f57e781ad917a2c
- SHA512 399d734b37e4e397f45e93f91c4950f5b8d98a33b0bf7d5749752c1f7d54696904119c9558e45a4911cf55cfaa47e74c5fb7bdac3c94513f9df274c9b4091ffd
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBbB/bS:sxX7QnxrloE5dpUpob
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot6S\devoptiec.exe
- Size 2.6MB
- SHA256 d3572e6d2382c7bf4299bfb99156221d45f0d54218da56f49c3ceb0d78c98281
- MD5 93e43611307b07ee4729db2248950822
- SHA1 6b75f001e63c374c7a69065375539c35b79654dd
- SHA512 6467f22c9322d8aeed2fb4862bc6780bd197300ca8865d5bc62330e3f0ef8b854facee8db1bdc64305d1705a03eb95578f690e2490b78901b4f2a332caff7433
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBpB/bS:sxX7QnxrloE5dpUpib
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 175B
- SHA256 d0ebeec96da949cb1326e4b141678b0714c321fbdcb736e642fe17aa2603a9da
- MD5 7426802abeec6a3019fcf0338cac79b7
- SHA1 a3508f60e0fe846443363ed482cc56da1b837398
- SHA512 54bdafe7f868f086ff33b923b4c42a3a17f6c69e0c79e970f90868430c5226697531eba95cc601a90c693ea764d34545e4ccdf7fe46745a7949b91d1b1acb3be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 207B
- SHA256 53c4b71ff6baf077efffa4cc81d34e987b372478f932e4ad804dafadaf7360f2
- MD5 3025aeb8f56c7e6dc097785cbde5f010
- SHA1 dc739b469fa1479e7aab110046012ce19e98ef28
- SHA512 12b9c5ad4018cc15ab6e3ff642da483d3e8423446618f34023c5c2fccad2588bec1aaeb3d7e0057a96f88f60f86a09cb81a9e05c6efa2649b607e61f1395527f
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe
- Size 2.6MB
- SHA256 536f9fd5efff0e16158b38265380189007c8e80fe9d10fe52899fe77d09ccee8
- MD5 4cadb9de158f4faadd044e440ea4f16e
- SHA1 c3f38bf9d5fab4e7f291caf10f9e63128faa7ed3
- SHA512 b76bbf52ca1c39c9ae2260d6a5a7d2b97dba0af398bc110f7bf033f91e211f091979af1b5408551e6189c1965a0e1b11f6a80741e12209d3189841ad9044623f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBzB/bS:sxX7QnxrloE5dpUpAb
- MD5 SHA1 SHA512 SSDEEP