Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/01/2025, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe
- Size 2.6MB
- Sample250119-vmkl1axphn
- SHA256 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262
- MD5 eeecd036a98bc4dd3a65781ba443e072
- SHA1 7bbb9bae0a847465858e1862ed59bcb8f6399c3f
- SHA512 ecf4f57fdc039f6d5666b49ce8692c778494f4c2de59f73c84e934bfe3137b4a8d95e4e908593c9b7a49bbb218e1f0a8794edb7672683587badf5c7b6cbb164b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bSy:sxX7QnxrloE5dpUpbbN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe - Executes dropped EXE 2 IoCs
pid Process 3576 locdevbod.exe 2832 xbodec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot5Y\\xbodec.exe" 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZEH\\dobdevec.exe" 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe 3576 locdevbod.exe 3576 locdevbod.exe 2832 xbodec.exe 2832 xbodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4460 wrote to memory of 3576 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 82 PID 4460 wrote to memory of 3576 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 82 PID 4460 wrote to memory of 3576 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 82 PID 4460 wrote to memory of 2832 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 83 PID 4460 wrote to memory of 2832 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 83 PID 4460 wrote to memory of 2832 4460 26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe"C:\Users\Admin\AppData\Local\Temp\26b43f2011ad21ca7a526e9ff9dd94e1689898cf830760f454e7c18a5db49262.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3576
-
-
C:\UserDot5Y\xbodec.exeC:\UserDot5Y\xbodec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZEH\dobdevec.exe
- Size 2.6MB
- SHA256 dff44d5f2198c3a910c3e312df7fd60fbdea08272cbfd081a3304f5e8986c46c
- MD5 6546795e6a73eef324e46b8864fdcd2e
- SHA1 501076219056c4d899b606e1a4663a35aed55769
- SHA512 8428052e974e5c26441db2f73882156d678b64a42af8ea622161eb4c9959e17cf71b8972c8d6824c642637f84c1b3c5199f72e8de76c5a3b6752a3d4bb4c2b40
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpTb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZEH\dobdevec.exe
- Size 2.6MB
- SHA256 4ed119c8bf30ec17d30e807d1bd5ab73a2955f266ff079339f6958a598e74f33
- MD5 128a31462f52f6ff2ff02751c912a831
- SHA1 a563499dea86a506e0ab3550155910dec09f8a52
- SHA512 9410b861e9bb25c38ff9003e895b3a3dc0c1baf539d3f132ea875fc5962dca7dbe9d120e5b01cd3f4f15ede78cb5b52e511249acdb61bf702a7e0ef9fbf0e639
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bS:sxX7QnxrloE5dpUpDb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot5Y\xbodec.exe
- Size 382KB
- SHA256 14e2b7daefd9f0fd1f346f37c7b47808db9ec4b849078b7090cd67d3b48fb0d9
- MD5 18dbad32548e540ff3a28037d610ae27
- SHA1 537bb83a8aaa263b9d93421ff02771a58eb29ace
- SHA512 7586281bf6479a2d410c04d8b8c3ad7fceb1d599ffe14795a03b9fd6261142b048fc2e69693fcb078119048af9a5e03d0b9bd0cf25a2931dd8f390ae189a2837
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7UqpcVZaK5hKnl:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot5Y\xbodec.exe
- Size 2.6MB
- SHA256 83c877ae8903638e9db8439fb14c342e9c379f333522c33b4ac0b57ba082d66b
- MD5 389b43bc8ebebc9dbe74a538ccdc91f1
- SHA1 a54c54af2781c909e3f70d524391120f427f5ca2
- SHA512 25dcee332c88aa00d4b1dda0198a60dd3c6124014e40f242d751acabd3018b8ca4102b62536a82083c16d658187a64d33b20ae441caf65debcea37e94b0ffc54
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcB/bS:sxX7QnxrloE5dpUpjb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 5b25dc3146d47ea8c02c57fe3baa0f5c31e26813b527bbdf742dc2b2c65cf1fe
- MD5 a74ba92c040b5705f78cc91b3aeff695
- SHA1 29b9d41ca14d3ae80a4a00599d81ee8273cb8968
- SHA512 d668fcb71746f77d9e489b383ac6c4cc229b4d69fa8c511479545c3ed405919b2a700a8dab510daf1139e7f730ed2fa28752b0d7ed5bef1d2c5c1667729aa4a2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 0f7751e4cc2b80713a330fca95a3430fad2e9b11049f5aadadfe9f6325cf6b49
- MD5 cce553bbcfa3c4477d8916125b8f10e7
- SHA1 2d9de5f3338ada2b6806b32bea0b661e6d523d59
- SHA512 68d416ee1938a49f33ff340a9f9839257a2600665c3bf1f0678affb81e8eac4444ccc31b75d4dd7c9ff97712682bdbd847144771335d2c998c69c44c88b2a1e7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe
- Size 2.6MB
- SHA256 67bdf5372cc8f44dcb66bb7b17c52a37b103dd457bade9792598d8acce49c08b
- MD5 9ae9d026fcc88d736109d4906d906e1f
- SHA1 9dec5a216e03dc5cc8287187e765835926bc7d3d
- SHA512 dc513b9e3ce40c32acd7bb96f023e49cb3f05231126f0d8ab8ddfb3d92e8456c88152018b81f199c2410cb45e341520b3899fa0d79648336d83ee256ce8d9509
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSS:sxX7QnxrloE5dpUp5bd
- MD5 SHA1 SHA512 SSDEEP