Analysis
- max time kernel
120s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe
- Size 2.6MB
- Sample241113-tekflavfmr
- SHA256 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5e
- MD5 877873f6d195c9497335998fd2360070
- SHA1 b7cd203e5f10c874be6889cc764322e6e6d2dd09
- SHA512 65eb73343d0b577a713fea1464e3dca4995bedb5252486295b68c1e14b5b235ea8a59a899f77d198fb62483eff5daf40a7369f2739a8b12695460c151ddcab41
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bSq:sxX7QnxrloE5dpUp4bV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe - Executes dropped EXE 2 IoCs
pid Process 4272 locdevopti.exe 3124 devdobec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe9Y\\devdobec.exe" e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint3D\\dobxec.exe" e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe 4272 locdevopti.exe 4272 locdevopti.exe 3124 devdobec.exe 3124 devdobec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2836 wrote to memory of 4272 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 89 PID 2836 wrote to memory of 4272 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 89 PID 2836 wrote to memory of 4272 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 89 PID 2836 wrote to memory of 3124 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 90 PID 2836 wrote to memory of 3124 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 90 PID 2836 wrote to memory of 3124 2836 e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe"C:\Users\Admin\AppData\Local\Temp\e3ed947b87412cfe5d9611d29e21f40b37f82d9e02d37e7131caed72eb3e9b5eN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4272
-
-
C:\Adobe9Y\devdobec.exeC:\Adobe9Y\devdobec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Adobe9Y\devdobec.exe
- Size 2.6MB
- SHA256 4c844cf06203eb8e0fba5d60db66eb2db3f2332c0e6d1d8daffee483efc56f16
- MD5 c33e4f7c3c5f6419d574846481d6f40d
- SHA1 0bd336a2f8294b60d86f0e32fae5ce9181c0d07f
- SHA512 111bf15e5a985995475a6ae14954c64a0206c5893a8b49f3118fce6de56fed67d62a3ab87e91dfbf6da44f04f06148774b31e8b88e075584fea711adef9069a2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bSq:sxX7QnxrloE5dpUpsbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint3D\dobxec.exe
- Size 2.6MB
- SHA256 ef93f256185073fa846b430b9af925cc7fe108786730e9fa7bafedeefd535f24
- MD5 3007fbb55979bb5692c59e6f9cd8cdb1
- SHA1 458571a2785d5feca98e39e72a55487b61df6601
- SHA512 68913fa4dd12346576c06fb760f65f2a3d52110a71b0d6209fb282df96f0682c2987eb7afdee3576c5687d960008cbd097279f6a9472e1cbe43457edfaf2172f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSq:sxX7QnxrloE5dpUpFbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint3D\dobxec.exe
- Size 1.2MB
- SHA256 95db967c76a97f220ac69083da8205dc232cb635dad141b4ce7b59ba2778182e
- MD5 51387bf65f6ab52367768502a2735d4f
- SHA1 adcba95f62ed11a127237a38267dbea37b262242
- SHA512 62a1c5440a88ccdf2a2a912e0f4b677e0b1955ff22222c62664b5a0e8a9fd5c8061bdd404a9e2058552da4a379d8195ff64f4c9a39b1c38daaaf8612096b6297
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafD:sxX7665YxRVplZzSKntlGIir
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 7300e6185db80521363b55afcc8bf852d7202e279884138fe00d6d2762eb1967
- MD5 fd61c0b9e1b97a742b09c85bd193325d
- SHA1 10e5c2c1b61abd984e0fcef08c814d9392eea68d
- SHA512 7128cd57050e99c0af406d8dc421d3a8a90e353547de44118945c952a16c813496c31ead536c9c8a30e482dea20d84450c5b142c7cd30c35191bf35a3bc1b37f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 8903db978660edceabcc794aff3479f2ece3c3c8a3e8bb116264603b9067d61c
- MD5 a2e41a5b040f00c508764ab9fea0a856
- SHA1 1b6b65ea4f83784edc5b5fcc79112d9d4ef93379
- SHA512 3707862de8f03dd99b269440dcf694d0474979c18d2025ef4a697f49a822d65eae06962a1563d7a5ad7254479d8c6c48890848f9f0f3968fa3d62612b21870e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe
- Size 2.6MB
- SHA256 7d92023d22c585e27e18adf392252ebb353d67ab067f5ccee881542dc695fec4
- MD5 bff6a9c635c28a325702a91199908c3a
- SHA1 ed50fa10573f3d2a8468bb72a6e1305c6c07b2fe
- SHA512 387644b329a908ee834d2e1403819cbc2324593c3c9b64e6383f013676cff3df75c591bec9404577d0043381080e7909cad1203f5954c77ad8f3035d9cefbad9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bSq:sxX7QnxrloE5dpUpAbV
- MD5 SHA1 SHA512 SSDEEP