obj3ctivity | 5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe
Size

55KB
MD5

d9d9b943acbbe0394122d68a5ac5919f
SHA1

1befa767e5ae1f06658563cee6520bb7598999aa
SHA256

92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435
SHA512

3ccf9b9050c878f60abeaae5b08b57e631b05d110d70f27788aa7d286e22d7ca40ea4575fb69ef09d305348b529bbfbe8a39a9307b57aa4397595e5a1b2f4780
SSDEEP

1536:6/BsBQBWHVuH4yB9OIBABttaAOeXc5aX2r8I:6/BsBQByV0vB9OIBABttaAOQQeI

Score

10^/10

obj3ctivity discovery stealer

Malware Config

Signatures

Detects Obj3ctivity Stage1 1 IoCs

Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

stealer

Processes:

resource	yara_rule
behavioral8/memory/2780-1-0x00000000009F0000-0x0000000000A04000-memory.dmp	family_obj3ctivity

Obj3ctivity family
obj3ctivity
Obj3ctivity, PXRECVOWEIWOEI
Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
stealer obj3ctivity
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2576 2780 WerFault.exe 92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

pid	pid_target	process	target process
2576	2780	WerFault.exe	92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

description pid process

Token: SeDebugPrivilege 2780 92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

description	pid	process
Token: SeDebugPrivilege	2780	92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

description	pid	process	target process
PID 2780 wrote to memory of 2576	2780	92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe	WerFault.exe
PID 2780 wrote to memory of 2576	2780	92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe	WerFault.exe
PID 2780 wrote to memory of 2576	2780	92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe	WerFault.exe
PID 2780 wrote to memory of 2576	2780	92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe
"C:\Users\Admin\AppData\Local\Temp\92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 1472
  2⤵
  - Program crash
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

Filesize
4KB

Download
memory/2780-1-0x00000000009F0000-0x0000000000A04000-memory.dmp

Filesize
80KB

Download
memory/2780-2-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2780-3-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download