Analysis
- max time kernel
119s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 16:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe
- Size 2.6MB
- Sample241113-t3btcsvgpc
- SHA256 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c
- MD5 77b7df5b6d1ce19fcad186f3d42a83be
- SHA1 9e9a181dd0a4fe6421364d88be506b3a42df9cc7
- SHA512 9d178dd1d07b32c98af8f87cf2130a5772dbaf4c84cc9ae54beae54e6ff919d13d4bf42e8ac6b7f2453ebd723fa001a420d92759eda5c033dae6943ad4cda2be
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bSW:sxX7QnxrloE5dpUpebP
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe - Executes dropped EXE 2 IoCs
pid Process 2476 ecabod.exe 1400 xbodec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot0X\\xbodec.exe" 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidOF\\optidevloc.exe" 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe 2476 ecabod.exe 2476 ecabod.exe 1400 xbodec.exe 1400 xbodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4288 wrote to memory of 2476 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 87 PID 4288 wrote to memory of 2476 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 87 PID 4288 wrote to memory of 2476 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 87 PID 4288 wrote to memory of 1400 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 88 PID 4288 wrote to memory of 1400 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 88 PID 4288 wrote to memory of 1400 4288 2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe"C:\Users\Admin\AppData\Local\Temp\2d4487c1660765860162958d9a6987d697af510536e3c82c8a4239856defd95c.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2476
-
-
C:\UserDot0X\xbodec.exeC:\UserDot0X\xbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDot0X\xbodec.exe
- Size 16KB
- SHA256 f49a5b25906bde4ad4744acd2ddf6b578eb40dcaee1e76a6cce91e836ac9e050
- MD5 7194af4ca8b5784e038c373119d798e5
- SHA1 9c114add88126c1358d7020ca7697c5b0528ea2d
- SHA512 dea51aa435f72ea947472a3d1ccdf8ab4c514fe964d86c9fdfb0484772ee56ab728d2b0ca997da1d392b38e9abbc4526ec702dbc83c527a01e04264766012992
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKYLJSl8:04ezXTIk/IxT/ES70S7TqOODVtLi8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot0X\xbodec.exe
- Size 2.6MB
- SHA256 d675a45c7ba4fefb99214f6f803719590dcc021a4ae6740ac4b935f65d213b6a
- MD5 275175192d364bed07e67aaffc49d474
- SHA1 a55df96b0063917adaf063367969e30db99ab32c
- SHA512 91c7ebe1d73edee9aa79bae19aea20e2d04561c5e3bf3f70188b559636298bbf1534f54899786dcb2424be322c821f49c22d476a6efd9d736f330f5935e3b18d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bS:sxX7QnxrloE5dpUpGb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 6e786efdcb0877831f9733229d5d3d2901628fce297e1854c4cbc02a595e98ed
- MD5 6f33b1c0a788078ea261150d429e118b
- SHA1 274bf6104fc0b7ab0fbdc5f3f7e35102bc7cf7a8
- SHA512 457dc7b53f688e893d1655565c4f713754f0cac96debe0c356f5c224def248ae8165e030400700065980970f610067a814333d41e2bbafe104d28e277d92e58b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 b053f07474cf6bfa0a7b3f7609c08bbe088d6a5307e633b9a1c89cd4ab7c2b70
- MD5 047603451b42f2b5467fe47be4f7bd92
- SHA1 ec1b1287cafb75ff5ac13306281bbcbec63a3ea5
- SHA512 bdd971b447e8af1865bf6c4a42bfc3f2aeb83177babf19eb192025e26e0f297308ced08605dca53b51f8097273bf145d0ee421caed1985e851a210b993c72674
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.6MB
- SHA256 c4a8f028df973900d421cde96ba0e308cb6ca9a9585ecd996dce50721af168e7
- MD5 3dcd9758025f7a31cd64e90aee12e7a9
- SHA1 3bf26792b4421fd2a6b465a83e0f54afc5e82912
- SHA512 209065810f93f52d99761a0daf64c8f99ce43c267214c7dadbfa2e779c755a76327c8df5eaeee85340596a607ed1cbebe033de0fa73a080efe751d9526f9f1a4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUp7b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidOF\optidevloc.exe
- Size 27KB
- SHA256 a5b3d0ecb59659d95bcbf7941532264910860696495ea6c36addae8fbd1fa0ef
- MD5 b10d948f159c450f25cf3a02a147091a
- SHA1 21ea1851cced69392552f81d72c00ddb24c0b33a
- SHA512 7500ea96fbfda39d11a3bf82d1587f7de69e5e092a6616adf4ed0d6d111588e41d82f1da23ae72fbecdf89f9005e46f2c3a592d3c64133247304469915fb6df6
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/7TJRKahcO8oRZjqOs7eL:xezkk/DUj7TlODVED17nKFO3nq/KL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidOF\optidevloc.exe
- Size 108KB
- SHA256 a7e0eb0bf40f8b394a022fba000de45c3a661e6e96f815201be42c7225cbb24c
- MD5 5ed6bef8a0080240eeba7b14e886debf
- SHA1 1b9e9846a3ef0b9e84ffc6d80602c229be84c4cd
- SHA512 81c26c67fe0a09a00433287e46bcfd2b115988732595318ccead05b079ead86e6f8d6bf7cad64fa9d451b90bb77ed56b613f1ed2e712a59a493bdf1e180fbfd7
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vE:6nyJ3n0Dm7+zm6wr6YEjAE
- MD5 SHA1 SHA512 SSDEEP