Overview

overview

8

Static

static

f9c82b093a...84.exe

windows7-x64

8

f9c82b093a...84.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe

  • Size

    5.7MB

  • MD5

    5e7766282d74ebf8e5b95c422180b6a0

  • SHA1

    68654a5c5219f27d8ba5a3f7b74ae74d1dc9acf0

  • SHA256

    f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84

  • SHA512

    fedbbfceb2a164283f7d3c4672317c79d6744ed099950f9a29ea8c4784f9dc410c728ff3ddab4fbefbfe3c525c1ae621d58ce044520149a20e8b857c27ce2442

  • SSDEEP

    98304:jL+p957/mfkAb0JOyEmi+thHGAa0P9CQOGCfRJ2jlTDZ2l4wdcACdcruV95czN:f89J/ANzywiJlgQNUJ2BTDYiqcAViVwR

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe
    "C:\Users\Admin\AppData\Local\Temp\f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
      C:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /VERYSILENT
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1812
      • C:\Users\Admin\AppData\Local\Temp\is-QUD0I.tmp\optprosetup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-QUD0I.tmp\optprosetup.tmp" /SL5="$B0046,5286589,118784,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT -install
          4⤵
          • Loads dropped DLL
          PID:216
        • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
          "C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:3716
          • C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe
            "C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe" /START
            5⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Optimizer Pro Schedule" /TR "\"C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe\"" /SC ONLOGON /RL HIGHEST /F
              6⤵
              • Creates scheduled task(s)
              PID:2004
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT
      2⤵
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:2404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

2
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Optimizer Pro\English.ini
    Filesize

    22KB

    MD5

    17c6915f5142b3d576c19dbe9615f1ea

    SHA1

    c2e4c3b15ae9744ea564bc3393923e3e12e38f09

    SHA256

    e0f54af0f070c5a37dc67182fbc53bbda664d714e0b100f398fddbe5bb817884

    SHA512

    346e7e982401b43ce5d8e19b2f77848802f3dfbb279d369031bb77388edd4b137dc52ec96066c79e27eb49cf621a3a9d8f81c7f8a3c04a8103aadfd46c12a66d

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptProStart.exe
    Filesize

    643KB

    MD5

    1713fa8e8ecdfb32c46dd466c63107c6

    SHA1

    3798f368de630f751d3c05de7f9cfe7134caa604

    SHA256

    8e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f

    SHA512

    71bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe
    Filesize

    3.1MB

    MD5

    c2c83c1e16f8e452951257ef4e5421cf

    SHA1

    19dbd5ea6880f0ba2a2cbfae18c814a038d8a092

    SHA256

    0d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39

    SHA512

    03941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe
    Filesize

    3.1MB

    MD5

    c2c83c1e16f8e452951257ef4e5421cf

    SHA1

    19dbd5ea6880f0ba2a2cbfae18c814a038d8a092

    SHA256

    0d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39

    SHA512

    03941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0

    Download Submit
  • C:\Program Files (x86)\Optimizer Pro\Scan.gif
    Filesize

    55KB

    MD5

    6858a1ce31e5f92785fb525ce9725b8a

    SHA1

    6f666e761cb39ec0efa78038038706c6e09641ca

    SHA256

    d576f0c14f855954701b054d625f7a95a5bfcd97ace82d83a4f00bda7a4cc908

    SHA512

    b23b40e5f278dc12be7ebe0872acff893df84ff7c936f56de8111e0dfc442dd2797583d7bb5feb4157bb67292344ea078bce1f93f5a3f60a5bbe20032ccad9f2

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-F2QIO.tmp\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-F2QIO.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-F2QIO.tmp\itdownload.dll
    Filesize

    200KB

    MD5

    d82a429efd885ca0f324dd92afb6b7b8

    SHA1

    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

    SHA256

    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

    SHA512

    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-QUD0I.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-QUD0I.tmp\optprosetup.tmp
    Filesize

    1.1MB

    MD5

    50488cf899d007d697893fc72a823fb0

    SHA1

    bc5512f623656ad69a054d558c35d463a5a8a6c1

    SHA256

    d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf

    SHA512

    2b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    3d31e999e8433d22b740ee0c55ac93ce

    SHA1

    73ad53e7f5198f124f70d31bf2b2c6511aa8caea

    SHA256

    769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba

    SHA512

    85654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\optprosetup.exe
    Filesize

    5.5MB

    MD5

    3d31e999e8433d22b740ee0c55ac93ce

    SHA1

    73ad53e7f5198f124f70d31bf2b2c6511aa8caea

    SHA256

    769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba

    SHA512

    85654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b

    Download Submit
  • \??\c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
    Filesize

    3.4MB

    MD5

    8565b14afbe6625e11065a3526c75192

    SHA1

    2eff65173426ca303dec447d66028552629836d5

    SHA256

    da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11

    SHA512

    2740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9

    Download Submit
  • memory/216-146-0x0000000000000000-mapping.dmp
    Download
  • memory/1812-132-0x0000000000000000-mapping.dmp
    Download
  • memory/1812-154-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/1812-141-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/1812-137-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/1812-135-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

    Download
  • memory/2004-158-0x0000000000000000-mapping.dmp
    Download
  • memory/2404-149-0x0000000000000000-mapping.dmp
    Download
  • memory/2672-156-0x0000000000000000-mapping.dmp
    Download
  • memory/3716-151-0x0000000000000000-mapping.dmp
    Download
  • memory/4900-144-0x0000000003470000-0x00000000034AC000-memory.dmp
    Filesize

    240KB

    Download
  • memory/4900-138-0x0000000000000000-mapping.dmp
    Download