Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/11/2024, 19:30
General
-
Target
28a21b8d4d1d93478860f76cc9360d76497870757f9137528b2345ab4bf57f9f.exe
-
Size
2.6MB
-
MD5
f209c846e1a1b20508b5fe51356ec156
-
SHA1
7bca8a1428780dd829507ed882072dd4476cb802
-
SHA256
28a21b8d4d1d93478860f76cc9360d76497870757f9137528b2345ab4bf57f9f
-
SHA512
7f6cb697759e3da1e7843f547d6fc1fad50cd4a9a912123239ef20984e93a10a4e2179ae220defb7e9169a7f6ab4bd5b3404633e9b9bdda5a81452d3fa6a42fb
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBpB/bS2:sxX7QnxrloE5dpUp+bP
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28a21b8d4d1d93478860f76cc9360d76497870757f9137528b2345ab4bf57f9f.exe"C:\Users\Admin\AppData\Local\Temp\28a21b8d4d1d93478860f76cc9360d76497870757f9137528b2345ab4bf57f9f.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\SysDrvS3\xdobec.exeC:\SysDrvS3\xdobec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD50d44cb81271dbd9977165d1138ed8471
SHA1f3342586a25e368b1eef6de559d0c26e36dd815c
SHA2562616617aa6d9425f2c613059f3153d18b2c88a87b5f00569347fa839f92240b1
SHA512bc56cc86c28eeeab18c8b7a5dc698a7a88f150241206cadd5a4a6d741f4335c801e83159d586dcb949e9e15453b1aa18e87380cf274d60268cb52b0febeeb4d6
-
Filesize
169B
MD51aedf10f34bde73258ed408379229c3f
SHA10f5aac71c638c1523fc2f6859a73280369418f8e
SHA256ca8c2b30d91093edad7cec9ddad81ea500964dffefb3783f8f9a045919cf148b
SHA512ca209b6311ac371a0a28807f88f274faab13b232b0f740b61ffddd8332ffd1f07ca7324c1fea221a9f3ecb78bceb0f2743f3febac1eddf0bc57235d44aaa985b
-
Filesize
201B
MD543c889237e2a8ef0bc9c4e185f6b5039
SHA1fe4df18a9b4d6078011981b51863e8569ebb5b69
SHA2561d76926a96b93f5fdddc13daf2d5226a6b1f76335ce8717450171ff03af0686b
SHA5129eec46c12d7007709fa7d10943e37d1fc34f5b89cdd0042d6c0a1726f98cc46cc2c81cf40a30829c223f45dbb3611290fe2464a2ef695ed80f6f33949a311a8b
-
Filesize
2.6MB
MD5b776cd5cbc056da47de4e153a43de610
SHA1e3f09080137dacfb4be1447d4eee7b8f770bee85
SHA2564a530a5e3095e179a245e366363e16fe61ec7718df913a3cada8bcc9126c912f
SHA5125ccf47b19782b99731fcb53f53cb4a557e3f06f55c56333e2c5a651efa57eeac7774921fb3f4e702a4d7590591020ba6f3d46c91bd92b4f856d5bf5bd177e881
-
Filesize
2.6MB
MD5a2821fd92fa2edafdc64b00559addec5
SHA19f80835e1b82debe2119db22dd374f632b5f4a57
SHA2569a7938a88da9914e49839264028be41cc079ccd46f4edd6d417751b684671368
SHA512e099f871e92e40a3e10f74716707c1c14d8ddfb78d3f78943863c2a16c6d83ba8f208a8150a4533ea2e44991793bbb8e01755ff5de023565967cae35ec357da9
-
Filesize
2.6MB
MD5b2cea3c5ad640c160f182f68b1b3ed61
SHA1f25b84bc0cf03cfc64ab2d658b4487c574d4d8f7
SHA256ed3b60b0251748c33a6e7d50655e98768042dfdb305f2adfbb57b300a9c308dc
SHA512bc9f872a5821678543323ccb8968855b89862e1e92b4085d769ba483696ec84c94ed5680a2762b7aea6409163727409d54ff93abb418a47beeb93eee54237c1a