Analysis
- max time kernel
150s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe
- Size 2.6MB
- Sample240407-2sm3mshb22
- SHA256 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798
- MD5 365bb9c9a1c7054c28225584650d3647
- SHA1 96232c706831d88e8059f5fb9210cb19aecf5149
- SHA512 94f848ce60dd1a2012ff7401950456142a2670c6602124c7b0de7e94779e9249a59c2085624e7d67cf3122be7c33fe2c2eb8cc2e02f10a0776e2a81a0569f07b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bS:sxX7QnxrloE5dpUpWb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe - Executes dropped EXE 2 IoCs
pid Process 1984 locxopti.exe 1932 devoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocQC\\devoptiec.exe" 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidOF\\optialoc.exe" 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe 1984 locxopti.exe 1984 locxopti.exe 1932 devoptiec.exe 1932 devoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4880 wrote to memory of 1984 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 89 PID 4880 wrote to memory of 1984 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 89 PID 4880 wrote to memory of 1984 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 89 PID 4880 wrote to memory of 1932 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 92 PID 4880 wrote to memory of 1932 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 92 PID 4880 wrote to memory of 1932 4880 8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe"C:\Users\Admin\AppData\Local\Temp\8241635db2180caf24abe245b6568d6f2446e74f5345d19f920abb4d080ad798.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\IntelprocQC\devoptiec.exeC:\IntelprocQC\devoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocQC\devoptiec.exe
- Size 2.6MB
- SHA256 be9fd31cac6c28044d5df544b38a81a1872d608ada4e7b1b8dbc2b6a16b3014f
- MD5 dec265bff64d4fc6e0ecd486b7d8d111
- SHA1 247a7f6ba81fbe978d2cb0ae418c32581f263c0c
- SHA512 94fe311ab5e51fc98b79b07d6bdb9f85dd351dffee126ffac99f65bfe768e934b13338a91b549cb6505168f8a87008e511df4a134a6618db3acb595bf7ee6fc9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bS:sxX7QnxrloE5dpUpRb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 207B
- SHA256 965d6ddaf5c2e541eeb92f3e2bd657bfad8e9c53c8e9136ccd3f4460ce297009
- MD5 b80e8921ec3520f6af1b62f36b094a5d
- SHA1 65d5bf396542d2ac3b738c1b032799796fac81f3
- SHA512 61be4f031d6ba9bd67471ca7459b2564d37514bf8113ad0c5a7ab8fb41b283944c6b44d11550449591baca21ccf2fa4cae8f548f8af84f03ed84a45d0c8ca408
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 175B
- SHA256 086afbd0c15d213de8ce5da9530b98d555c75383946832c1096a25ba8250a712
- MD5 9493424922cf6419e794807ad9599f10
- SHA1 892982c1f1c56676343bfe6e7ca48f907ba65fe4
- SHA512 6c407070cc663b870f4962e732238a561b4165888fa95bbb78c028e251061e5300208c41d32d4113d1498a39d93c2ad0a926adf05c0d227bf81dfc1d277a1740
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
- Size 2.6MB
- SHA256 bd60fb746ef4ed0451c3378290d0a462e57d8aca1fce818d5621c1b1915321c7
- MD5 d4a73a2462a96698ba66037e7d4dd304
- SHA1 6870635aa2fa4676ed9380f07ea66fc5c689fbed
- SHA512 883719b8b460f5f304678c75fa1b6a45b0116bb72eed07b5eb0488e3df2ecd2fdffbf8d958d2c332593f2d7169cf729c13bd4cc5c3de07e1c433caffd50ba35e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bS:sxX7QnxrloE5dpUpCb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidOF\optialoc.exe
- Size 1.1MB
- SHA256 bd2e458f973f6a3241207ab43bbddaf46ae5aa877b83bc7a774c83c8c02c841d
- MD5 27368e922d93fe7f1da44a9206ae15c5
- SHA1 dd6458d3f2138cc15473ffbef03ba9827673fbe2
- SHA512 3df32f3c9a91d367e7f34cd3c1f3aa49184e35aa9f0880fae7456c925f1ac4fff51afe4db105fe392ddb02decb7bcab527b70b8f3274e0edf3ae5a21f09b00a0
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooM:sxX7665YxRVplZzSKntl/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidOF\optialoc.exe
- Size 10KB
- SHA256 c2beca0f3cf592fda96ba710769ff2d67fd97592da9df195990bf22499d20a4b
- MD5 211c211281a83cae04ba8989e177223a
- SHA1 2c6a912a90ce71ae095e8f16a97222e28964a271
- SHA512 10dbfb3c33737e1b9a691fdbb89cea3f018443e481d57887d53a605597bc3ba56db26480f2efdbf443c71b4f4a0b594257d8f34f4cbd7826ff71936f4b5487eb
- SSDEEP 96:3k1Ycg+n1FZlXnzDnznTT3jkHnHO1n9dn9FhXYitdWYeFn8PM/EKRd9pe:0fgezXzDzjUHK9d9/XYxFn8E/ES7E
- MD5 SHA1 SHA512 SSDEEP