Analysis
- max time kernel
119s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe
- Size 3.1MB
- Sample241113-vbzlsawckm
- SHA256 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11
- MD5 3cdf638697e2d2667bda056f97a68590
- SHA1 2360596082dd2b7b1201f4a1d079526406e1ac77
- SHA512 3ba773202abbc9d433babc96c7693aac866f4af4e56706893d003c7453ed2f9fc653b12990105eea39db0a12c573a1ba052c04d2da66cf85c1295d32761b64c8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpfbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe - Executes dropped EXE 2 IoCs
pid Process 3544 ecadob.exe 3108 devoptiloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeE7\\devoptiloc.exe" 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxLQ\\optixec.exe" 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devoptiloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe 3544 ecadob.exe 3544 ecadob.exe 3108 devoptiloc.exe 3108 devoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2956 wrote to memory of 3544 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 86 PID 2956 wrote to memory of 3544 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 86 PID 2956 wrote to memory of 3544 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 86 PID 2956 wrote to memory of 3108 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 89 PID 2956 wrote to memory of 3108 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 89 PID 2956 wrote to memory of 3108 2956 7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe"C:\Users\Admin\AppData\Local\Temp\7fbdb3cc61b5d982f92751e7e3e81db023b49295dd4c213c44764244b8d56f11N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\AdobeE7\devoptiloc.exeC:\AdobeE7\devoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeE7\devoptiloc.exe
- Size 3.1MB
- SHA256 7cb7ec33654d4c87652b379102d6c09ebba724102e45c6ffed513b11c34e1079
- MD5 3fdc1219d935de2462d7a17a8f16f9e6
- SHA1 14716b6cb94b6f3d92129eff50fa465d90d59763
- SHA512 9488c336e51f55590001fa69acec98ebe09f313703e057a2bd9ebfb92fd5473afbfcfb95b4e60b37e0a182873add8feac4a7c17f5230f177169965b16c2157d4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpXbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxLQ\optixec.exe
- Size 631KB
- SHA256 9efe2d3bdf18df17f9b16cce7b28b95013833c42a0eb19ba968aa8ab24424515
- MD5 61e0f30a4ce029ce143d9185e2eb5912
- SHA1 5e06a384407369d951e2c31a8626ad29c506fd3d
- SHA512 2be98e563db9c92802207e44d636fa9efea6d2ff6b793e3b09aca4da4d4a8076fc1039804702e97e635812727584b340f31ce181dbf3d54ba267f6572d68975b
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCZ:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxLQ\optixec.exe
- Size 43KB
- SHA256 2f89c7cc3412c23b8cde969d2821afb1340c96f237b22bd8c0728d4ec979acba
- MD5 7ede023a8833398270be098bc3d18603
- SHA1 f35fcd4629617ebee908c24fb8cbc49745d41bf7
- SHA512 1af81b50c9288794e49cf85660c884fa1af12f7cb53b8eba42743f90800093f2ea6d5918201fb26ec933f9a6103014d69c29ec0026d371503653e28397b62f21
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkfn:ABalOBo1TKFO3n0KkZHqX7+g2lQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 7d1025b1fdfe329e9e0b3069f055a0074b1dbd463da19a2911632c23c9208d91
- MD5 1c093e8503203fb89db42aeaf367ad1b
- SHA1 3e942f499b5cd23fe375af22ef5adc4892aa006e
- SHA512 e1674e0079a60b8fe25e2ee4e099028a41ab16dbf2a3507c26d235e88fbe04bafd41b0c95a40425c172e34598c7ebab52343034838ca656416d470cf0d3fd766
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 1736c55f363d68477d83cd7a0a23a2cc84058048d6afbda1b6f6a9ca9dbce6f2
- MD5 81880201b1b5a7c6fe629a0541f5ebbf
- SHA1 13684f0f7c929cc52958217c10338764c3a11ccb
- SHA512 41aabc7777cead55149698e75f788ea19c580272fb0a6920dd57b972a8ad0e25804836a5bd2b6a3f3ccba2af7f868afacac346c198e5212aa6ba1fc4bdb82957
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 3.1MB
- SHA256 522df1a668f735fb9a6fb510f86889892750121fcd276b5d910f012cd1f5d01c
- MD5 d53a5ca6b0d73a043f9c5f77016d4ce0
- SHA1 699cd440b38432a96778289583dd9d7bb5e505ee
- SHA512 651fc5e59eea20e41f5c0edf65b261bb9c77862cd1aa2803d7413dbbb52a09dcc9b0df76e7a7e4e69446a4838b39bc35066f9e9bbaf722bb916b6cbc3bbdd0c1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bSqz8b6LNXJqI:sxX7QnxrloE5dpUp0bVz8eLFc
- MD5 SHA1 SHA512 SSDEEP