Analysis
- max time kernel
119s - max time network
18s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
13/11/2024, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe
- Size 2.6MB
- Sample241113-sdl3cstlds
- SHA256 fcf93e47d3926a34c62a74095dc4a98efb446d40fa6a5f29cd8157fbf747782a
- MD5 8b0519c9d46fd2802849d29c24b17b62
- SHA1 d535386d58d099d5311893f1be9d09fba685f2d4
- SHA512 86d77546f8c311fb66ff9a96aa13d9d54dc2bfca1157d08715dbbaa2a3b93c914779ab5ae124fb3f2ee8232bd1831e3464ca10f7260396f001fda11d3ad45242
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bSA:sxX7QnxrloE5dpUpzbD
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe - Executes dropped EXE 2 IoCs
pid Process 2784 sysdevopti.exe 2864 devbodec.exe - Loads dropped DLL 2 IoCs
pid Process 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvPJ\\devbodec.exe" 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxZE\\dobaec.exe" 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 2784 sysdevopti.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe 2864 devbodec.exe 2784 sysdevopti.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2784 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 30 PID 2856 wrote to memory of 2784 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 30 PID 2856 wrote to memory of 2784 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 30 PID 2856 wrote to memory of 2784 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 30 PID 2856 wrote to memory of 2864 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 31 PID 2856 wrote to memory of 2864 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 31 PID 2856 wrote to memory of 2864 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 31 PID 2856 wrote to memory of 2864 2856 8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe"C:\Users\Admin\AppData\Local\Temp\8a5cd6344d4b44ef5336c36747a2010d42e44fd3c2b165c7e790be1bc52e823fN.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
C:\SysDrvPJ\devbodec.exeC:\SysDrvPJ\devbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxZE\dobaec.exe
- Size 2.6MB
- SHA256 1aac9ab42ed25706a5dca4a2bcff791a3eb697025016520dd1ddfb50e5c00c82
- MD5 1891ed9d5d30e75d4f6be27a7aa6f14d
- SHA1 f243c99cddecd30ef886d6cb6bc45acff7b92675
- SHA512 6fff764d77326e7e40a14e660101702e0fc20f9f3bc3506946ca1d406a4a085334b54cc1ff0bb113f5ee708e7a5619808e3a762b3e0d5eb318a1e694912d195f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bS:sxX7QnxrloE5dpUplb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxZE\dobaec.exe
- Size 97KB
- SHA256 894c8f9e45ed5e7e4eb02187f36334217c82cc3d04ccb4dc287351488613d51e
- MD5 a1b11f5603077484280667fd1dfc3cda
- SHA1 abc21425bf1b4e92ec67a0926df20c8735094ec0
- SHA512 bfd5debadd2b755e260d27d92ee365d0f4fbf61df7ceb6290760892a938fc9acfc408c369a8c4413097ea453c550f944039e264a3a351f734c30267bf22f9ce9
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ejp:6nyJ3n0Dm7+zm6wr6YEjp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvPJ\devbodec.exe
- Size 2.6MB
- SHA256 caa5fa54cbe7206eeb3d41a2a153688a475308665a2bab50ff10b98b1feaa689
- MD5 a011a80addcf601867cd637f6e1f56df
- SHA1 d503ea9bd996f98055ffc8322347eedf7b72e145
- SHA512 9c2194f153a93238caa1d562577d3ef28400e336b54565e352a8dc2015ba1857fd02f0d19960b97da728b5010d6384163b17d96d4ffcd4b17f3286f098e0cb76
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB2B/bS:sxX7QnxrloE5dpUppb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 173B
- SHA256 ae942eed0fc8d927efe6379d3296f93a07bae73c7036586637cf4f9a12ff003c
- MD5 959abc6f83c114b870f5e3a3c428ec01
- SHA1 32885bd99de206d08979b0d4c81272cd019856a1
- SHA512 dc422c529c307eda6d9314788a298704a6d07ba2ca0f96ef1042a9731c663ce9fe50c0fc1bf97909e4aa71742baba78602eba963b7cdb0536a05afee75e685e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 205B
- SHA256 f94c46aa0c8497c92d31d7ff299b902cc1df13808482d31c1e919cd7194c849a
- MD5 c2fb53cdd8495ae42ba9c91b4fb1c2da
- SHA1 7baa1eb52ea38415cdefcc7c5ae3d0ef075a4816
- SHA512 30e5e674b88edee47c1a53279683eafa33ed7793a64dd62f755fcbdb80b61f1a7be2e81424d247bcd2e8e2b877aa5d58ed61d59dc25885c58f5430804296a365
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe
- Size 2.6MB
- SHA256 fe5528f5b65a73f0ae6666a8665f1fe89d5568d5ce8caf0322db125158286863
- MD5 757e98524c1a51a8bf1df5ab9316a52f
- SHA1 b328e095aab2d0bf9434a2f650ba70f067cbf248
- SHA512 0461e435e0c45a17dce306f949475e9ea67c8319e75e7c736973ef2d2abdac76347ac1edfffbe653051f44005731d8f42d1ffd6264b2470ad488378645df38a7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUpPb
- MD5 SHA1 SHA512 SSDEEP