a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
Size

2.7MB
MD5

161c5943a30ccb57c050b898addd3ece
SHA1

b15d288301146570f922d43affa9cf8b924cb4bc
SHA256

a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e
SHA512

a2269fdc04073b58c6b98beb6305367e3ad05ec007dc85d5ddc8e0fa759fe8474e018cc54d5a9a467f6138f272969c0b30e0f73573e527df5b961fe34b6f4dc2
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBy9w4Sx:+R0pI/IQlUoMPdmpSpI4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4368	xoptiloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot4P\\xoptiloc.exe"	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid3O\\optiasys.exe"	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
4368	xoptiloc.exe
4368	xoptiloc.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4368	940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe	87
PID 940 wrote to memory of 4368	940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe	87
PID 940 wrote to memory of 4368	940	a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe	87

C:\Users\Admin\AppData\Local\Temp\a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe
"C:\Users\Admin\AppData\Local\Temp\a5bc115f34da53d702c7b94e11e756c348890eabcca31e40aa53b6791858641e.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:940
- C:\UserDot4P\xoptiloc.exe
  C:\UserDot4P\xoptiloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\UserDot4P\xoptiloc.exe

Filesize
2.7MB

MD5
32738b139f6d23e1633bc8d21b2d9d2b

SHA1
ea6e043099791c42e685eeba87c519c9b511f4e4

SHA256
f7a5c506211d506b59a5ae0ffc7779ef63f9f1ddb6b7aa3fd23d0e8dc0ccba64

SHA512
d3e19b0d4f3da611051755c2cfd23241c7a7ee3a6213c383e2faa7a7a9afcf1e07fdfa66c8900cca02736cdd92a7d9e894fa3a22e980af6eb1e043487d182861

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
bfc94f2bcfde6e022bde3cffc329c865

SHA1
6f31361e4759164f5641b6b691703ca179723cac

SHA256
6f69951a9428f016cea6b4336a7a6f630122690b8fce271195d6b144272abf14

SHA512
37253fec74502248044859a08fec43afa4918e435ee4dd0fe998d5868165fccf0c53419c28c6f5c95bb446ea98586ae061f95ffa6bf50196f345d2b30962aa37

Download Submit
C:\Vid3O\optiasys.exe

Filesize
2.7MB

MD5
0251e3dc282186ab2f37bdcddfb1c438

SHA1
e97b006af3b2095157e4351642ebd50a90c355ee

SHA256
2e64c27a38899bbdfc4ca47e2ee4f732d6936ac1e0fb52ef0b55bcbd4ae43e01

SHA512
91cd7e90c49879e6a0a3dda088b726313573ba6b8e0cc9d1ab384f80bf88c9600632cb34f8ab08028171144274fb7aaa560883698b13479a8231619f3f90431b

Download Submit