Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe
- Size 3.0MB
- Sample240407-z7ry2afb56
- SHA256 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684
- MD5 afa8ef528ea36fe5d0664e6f6035b6eb
- SHA1 88f6d574506cb4572b88ec190da87286d624cb1c
- SHA512 261a453326d664b2ebd23bfe0da7babaa4c404afdf5dff83743997ec1cd31274a4be08b049bc1b14d631fdcf25aa5428249589ec918c9cb2a367f50ebee164c3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcB/bSqz8:sxX7QnxrloE5dpUpjbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe - Executes dropped EXE 2 IoCs
pid Process 4488 ecaopti.exe 1648 abodsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocLZ\\abodsys.exe" 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintZW\\optiasys.exe" 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe 4488 ecaopti.exe 4488 ecaopti.exe 1648 abodsys.exe 1648 abodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4284 wrote to memory of 4488 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 89 PID 4284 wrote to memory of 4488 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 89 PID 4284 wrote to memory of 4488 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 89 PID 4284 wrote to memory of 1648 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 90 PID 4284 wrote to memory of 1648 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 90 PID 4284 wrote to memory of 1648 4284 5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe"C:\Users\Admin\AppData\Local\Temp\5b8a0908a3fb2d622e7476bbf31843b26950c735d43c71950a9a863054955684.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
-
C:\IntelprocLZ\abodsys.exeC:\IntelprocLZ\abodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocLZ\abodsys.exe
- Size 3.0MB
- SHA256 9a647593800fce933da32ed7c83f3f41b5f1b9d885302e251c00b9bda5984211
- MD5 d7b4e27628f26d8c3341a17bc2447256
- SHA1 729e850dd5d7bef8d1d12cf2af8787505dce8505
- SHA512 d93a11ca63fd89bceb41b9945ecf3983387107cd79b034c3fff4308ba513bda8d0c653d928903962d4b89022724a5a6983372c1b003b563a0759662e8fe0bafa
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bSqz8:sxX7QnxrloE5dpUpHbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintZW\optiasys.exe
- Size 16KB
- SHA256 f49a5b25906bde4ad4744acd2ddf6b578eb40dcaee1e76a6cce91e836ac9e050
- MD5 7194af4ca8b5784e038c373119d798e5
- SHA1 9c114add88126c1358d7020ca7697c5b0528ea2d
- SHA512 dea51aa435f72ea947472a3d1ccdf8ab4c514fe964d86c9fdfb0484772ee56ab728d2b0ca997da1d392b38e9abbc4526ec702dbc83c527a01e04264766012992
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKYLJSl8:04ezXTIk/IxT/ES70S7TqOODVtLi8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintZW\optiasys.exe
- Size 3.0MB
- SHA256 4bdbc2515269c7c3219bca644ae539faa92f25127bebfaa6346d7bd87279db84
- MD5 353cb435661efa54112f488fc81a0cd7
- SHA1 5f9f64513e6750478e04df1508b8ef353fa5c7d2
- SHA512 619febb43b2929d65187e6493cde4be74211681fdc56ef66262b82c7449b01866636cd4faa207b83e010d2d890b78bf480a6a42c07f079eabd598698314129f1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSqz8:sxX7QnxrloE5dpUpybVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 b8a2b1165e387d252b6be30038b0c3d6d5e448e96b814023559cb4fe83f0a80b
- MD5 68f00c3ce248db42d7437d7252f5aa6b
- SHA1 6741fb5b917121ea24127b5089763b20991aa3f0
- SHA512 0f89bc9c8671baf766a56061018be48569613a38ba3826dc11123fa3a7cdd92f309872c22a725fa4882f2ab2f9eb2070c94505dea8045e9d1deaa7360199e2ad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 fa3742d29ecd0fb0a2c931a5cab98a9ac8b56b2174b59c7a39bdd624e42d705b
- MD5 9572248cff784b80166c434af570043e
- SHA1 95383dbbc44fcaf72db68a8d13a0c3fa3674d061
- SHA512 60a3f03e4ec5723f8373307ed5581805a337c238bdefcf34881101f1ebe3db2980fd1d37f09fbc857665a2e80e3213f814f7c4206086b29e5cc450139d5391fa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe
- Size 3.0MB
- SHA256 416b806c2cdc2fcd1ce5684c02a21cb9112d7c52fdac8b2cf75ae775b613530d
- MD5 1a4a9ff886a75632fce486aa3731c8c6
- SHA1 adc81989b2dcf3c2518c21e299b646c213f844a5
- SHA512 754ecf81b9a604561e0a903e4ce788fa56941b86666b66e24e6f71259e8c8ed37093a9bb94853f4ad2d91b010aea86825d2765718c5bc62778b6c17d3fcf23c3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bSqz8:sxX7QnxrloE5dpUp6bVz8
- MD5 SHA1 SHA512 SSDEEP