Analysis
- max time kernel
119s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe
- Size 2.6MB
- Sample241113-zgd99ayfjb
- SHA256 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543
- MD5 ba5bc323170a5ccd7eeb7aeb37bbae71
- SHA1 f9a920985ccc330ef85b11dbfdfbeccd388ff2e1
- SHA512 c39cec0253a87f3be5119f96701ff65c96b1dcf9e83db09de124158c909a4bb9854b2b49993a16026200faeb66e05a30e514b85f306c4cb9be863f1f2d382080
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bS2:sxX7QnxrloE5dpUp0bX
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe - Executes dropped EXE 2 IoCs
pid Process 1624 ecaopti.exe 3940 devbodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotAV\\devbodsys.exe" 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintX1\\dobaloc.exe" 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecaopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devbodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe 1624 ecaopti.exe 1624 ecaopti.exe 3940 devbodsys.exe 3940 devbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 804 wrote to memory of 1624 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 86 PID 804 wrote to memory of 1624 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 86 PID 804 wrote to memory of 1624 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 86 PID 804 wrote to memory of 3940 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 89 PID 804 wrote to memory of 3940 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 89 PID 804 wrote to memory of 3940 804 9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe"C:\Users\Admin\AppData\Local\Temp\9cffb98bad51973b5f006ce490a8827b8fd0a2d71257eb23eae45b712771d543.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\UserDotAV\devbodsys.exeC:\UserDotAV\devbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintX1\dobaloc.exe
- Size 2.3MB
- SHA256 9884586d632ea16971be436643b8046053082481fe8411d0f2dcdd4a4e98a985
- MD5 efad21d86f711ca5cda7b3b44eae455f
- SHA1 fa4cb70d9b29d7fb9d136af6bfa6eb6792a5edbb
- SHA512 40ebeba2a81da6109f75cd66a698375aad39e3eb1ee86271213021a634effc7a125692b86d54a42a5fdc0d32b5b170d518471f25f83fd3366bfe61d365d4577d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnBo:sxX7QnxrloE5dpUpr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintX1\dobaloc.exe
- Size 2.6MB
- SHA256 bb930e038b6219c7e5e3e3ba437cbd2cc75bcd926bd1c53b6231dfe200e39783
- MD5 200c78597533d08ffbb69b3a09edd3ac
- SHA1 2e902a5d1d381c84b5fe9637aba473879d3542c6
- SHA512 4ff532bf0bb231ad8932d821a37fd624572a2f81bf31b4fd269946832d4283eebd8b775f32d2019ad988b13961058bf30d7886ac6c0ebcb52d9d997af30f40d0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bS:sxX7QnxrloE5dpUpob
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotAV\devbodsys.exe
- Size 2.6MB
- SHA256 7131da710e58caac3c73076ef303e356059bb732421a1570d21a169206eadbbe
- MD5 5f0256d427d765fba493cc690db1d20c
- SHA1 9a700162df1edc1b5bc38df1544f5d21847f3b7a
- SHA512 f08bda42bb18607c88826aa5f4c2b896e5ed5e8cbab992c4add1f85f2aee44c93174b4666f09f4c830ffeefe6802df1101f5c6472dda1ab888b1b11102afa0c9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bS:sxX7QnxrloE5dpUpLb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 9e54a3b0dedc30317899a6488b2383d08174794c0d4bbdb316c90650bc97ac6e
- MD5 808ae8826c48aa2fef44bb5610db5f06
- SHA1 9723a03584d9d66889cc45b12c62eb70f30fcdc7
- SHA512 5a95b94c2bb90d9f8c4dfdd317cc3a309b7b0b3c9ee082477540dab982430dafebb6c5a901e9c69b48247ad13ecdd43ef18b7769a82e5408dbbff7522d5d87fc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 f2beae6ab9c28ed2181ab9fbe3f459de311a64186272aea341a4fdeb06a0d782
- MD5 91dcde62f6cb2c06f32cc4ec99e2dfb6
- SHA1 18bcadb839a5cb020eee76f69602502e34314005
- SHA512 a568a02b6c4f4d4c6787a4d1a70fc4fdbd051cc7aa12d7f83cc314804fc98673857d17605d5153a0e6447b27562a51d6b610028967f42abce90023c32a1ddfde
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe
- Size 2.6MB
- SHA256 9ca448ca82589717b99158733a2841284b066099fa9c856f1168cd9252f950f7
- MD5 96c9782ed2ded3c7a9601548548c3051
- SHA1 3d0a79fab4dcb7a6387aea24b853b8c43decbfa9
- SHA512 b4bb7329a0a5d76ca9c7cd9ac4180dcccee534410aaafe87319c85d9d1f6ead851a8e52856512c59f74a472e4cd38042162e0b83857aa83bc3ea2ea55e35f05a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBGB/bS:sxX7QnxrloE5dpUpxb
- MD5 SHA1 SHA512 SSDEEP