Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
13/11/2024, 20:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe
- Size 2.6MB
- Sample241113-ze4gcsskdr
- SHA256 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506a
- MD5 ee9c8e533b661f443d60292afc21de60
- SHA1 34c3d3c4576f54bdcc445353dcab28c2703d066b
- SHA512 9d672b5e086e2cc18f22987621106b202166b89e903e4cb8ece04429c04093193e9b0b699037d9ef7c090b83c9132c50d9128f850ba79934cbc0169c40d5d252
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bS:sxX7QnxrloE5dpUpDb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe - Executes dropped EXE 2 IoCs
pid Process 2468 sysxbod.exe 2248 devdobloc.exe - Loads dropped DLL 2 IoCs
pid Process 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB21\\optidevloc.exe" f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesBC\\devdobloc.exe" f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysxbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devdobloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe 2468 sysxbod.exe 2248 devdobloc.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2468 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 30 PID 2520 wrote to memory of 2468 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 30 PID 2520 wrote to memory of 2468 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 30 PID 2520 wrote to memory of 2468 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 30 PID 2520 wrote to memory of 2248 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 31 PID 2520 wrote to memory of 2248 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 31 PID 2520 wrote to memory of 2248 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 31 PID 2520 wrote to memory of 2248 2520 f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe"C:\Users\Admin\AppData\Local\Temp\f8d231717253c841bb6adbf69751672e8887780bd1cf2464fdf1093d1c8b506aN.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2468
-
-
C:\FilesBC\devdobloc.exeC:\FilesBC\devdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesBC\devdobloc.exe
- Size 2.6MB
- SHA256 d2962607e508cc86f27102304a8f8b174d17738229dbb7e35f350e2927cefd41
- MD5 d87bcf2ccf3b60f661ffd4977d45a0fc
- SHA1 36775539121c631fc2357cea5cd8299619ef9d9d
- SHA512 a0a0fe9aa9cb218f2afea46b5559b0dd739c07b4d7e2de184b2f0d4d42bed5a1940f9569a05782e71d2c3101e28e1f5a9dd28c943dab421f74ae287b6eb827f2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bS:sxX7QnxrloE5dpUpFb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB21\optidevloc.exe
- Size 27KB
- SHA256 afcec9da3d6ab02251f8cfb55fdbb99d8a48092388bebeb354a5ecbedcca04c4
- MD5 9066f9da2f6e14f558228b695e72cbf2
- SHA1 91038a2a5cdbee686253b1163db1462b67afdc3e
- SHA512 41a27889d2f9e9fe12ceb02ebb86a9a7b9be8a9c8b34ddf510ffdc5876880d78e33cc31be4832bd57fa4af876e75459907f209f89f94d42328c4aa001f56117d
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/7TJRKahcO8oRZjqOs7e67CKD:xezkk/DUj7TlODVED17nKFO3nq/Ka
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB21\optidevloc.exe
- Size 2.6MB
- SHA256 ea43bef58861b227b62400265aa609580786fe3d1b1251f0ac087a7e5a48f0e6
- MD5 4934682d27447686871410cf569bb2f5
- SHA1 b8365a2ee2e9b8deb6e42126f5dcce39a16e0f2e
- SHA512 5652ee9e351617b9828da7372cb247732c122253a34781447ad9d7e6dde88aed74cf84e4643082c5f1417b6970112de709af0298805a4011d09dfc8ce66ed02c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpzb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 173B
- SHA256 4e4282fa18f7afbed8176b5afb2008be5295db7254343f8f7bf68fded368c545
- MD5 97f0f3495e65247510b22cb2131f0a71
- SHA1 fd6b92612b08b03b0d9205e19a5c7ba081b75172
- SHA512 ed5e1f54b1607820110c0c15713d2b7a73454503ad1cd4ffe2aa5c35fade46b1ced7808e5d6a483cf7f57c1f3e1814117ea5dec1189daaf17be8876f000d5af8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 205B
- SHA256 bae465f5db56a23595e0a098ceeec82d5d7069ec6c8c52da7dff6291394e6682
- MD5 ac41dcf8137aca189a73bdf74d15141d
- SHA1 e6c0bd83fcd44909b4c1fa5c2d1b23ea45563f77
- SHA512 92f8e6fd78f46875347460cb2062d845d66028bc6e41dd6366c4f427dbc9f26009a65c0f6c3e1c76bd8a81de5fa51622ec858d62842af95ae90195c53490f916
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe
- Size 2.6MB
- SHA256 4f4c6dec3013e9e39310fe625972339a6d17b236369de613590e02071e595beb
- MD5 c1630b53cef45e97730748462a55cb60
- SHA1 43332cd1a6a782f28439b9d747b0dda680e74f9a
- SHA512 3ad33a644f65f9746b56e0c8fc57b3c720a1c8b0943181224e6c4a26b04aeab58be801ab6fa628bf1ebdcbe5fb29018990b384eeba48d00a48c618cfa920de94
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUpEb
- MD5 SHA1 SHA512 SSDEEP