Overview

overview

7

Static

static

3

17c511bb02...e1.exe

windows7-x64

7

17c511bb02...e1.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-05-2024 19:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17c511bb0240169f471bc9f0b438911429b1d273ad6a886501a390b3045238e1.exe

  • Size

    4.1MB

  • MD5

    46090c041258fb477abdf48d414bf06b

  • SHA1

    2cb7366fc1756e87844b2ea89d0d40d5eda5c9c8

  • SHA256

    17c511bb0240169f471bc9f0b438911429b1d273ad6a886501a390b3045238e1

  • SHA512

    d3167c340849fb284f10c9b4d6270d5523f7e0c77f8d20a748391e7554b84f6afbc920a67ecdad83eb0be9864dd47f6c0ffaa576806774782cc8788a44025830

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpR4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm25n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17c511bb0240169f471bc9f0b438911429b1d273ad6a886501a390b3045238e1.exe
    "C:\Users\Admin\AppData\Local\Temp\17c511bb0240169f471bc9f0b438911429b1d273ad6a886501a390b3045238e1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\FilesVK\aoptiloc.exe
      C:\FilesVK\aoptiloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\FilesVK\aoptiloc.exe
    Filesize

    4.1MB

    MD5

    2083b5563914f8cecb61d9fa34e5bee2

    SHA1

    aa31479a89aa78df4d4829cee20f1762bbfda8c5

    SHA256

    4932430f4dc46d0f4e3150f68c8cfdf207f911bb3dd2e763158fa9b2ae044d7e

    SHA512

    dac193b5f3c09cfc79b4883523c9507a59e43d175aa303fc8301dfe3fa285c33cf1544e3154d8914ba6a1b126a9a2e480df559241422f6726009e95f1a5029a0

    Download Submit

  • C:\MintOD\optidevsys.exe
    Filesize

    1.9MB

    MD5

    6a0b3632d40d4435e5764147e5552080

    SHA1

    16ac6b99638066bcd9dfd17a5da7844e83397ab8

    SHA256

    e3b5c5f342c0b94453ca12bd042c3f3d8ba28c8bcd18f6358e0188bd611623c5

    SHA512

    65ac33a0179d9878484a2324a109092395590b20d9680cecdbf422cd6e37e27d63c74b8ef1ac514df0bb42960bcdeb286866ee510628bfb68a7ff48c7cbf33cc

    Download Submit

  • C:\MintOD\optidevsys.exe
    Filesize

    4.1MB

    MD5

    b383adf35dc3e01e28fe68fe8c7adf7c

    SHA1

    1cdab3d232901d94254fd0404d8a46028074add2

    SHA256

    68a38890469a0952ae98c4da91c30f220369ef60bf7fa3be4f8b53d98eaeb1f4

    SHA512

    11f1170061d11030963b63b9f04fd9f8805942d30af5b9d8f5de10b6fdb6bc45ecf4b290a69611863ff2186860be23a19747f190d722bd8b0d689ab2800f0f8f

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    203B

    MD5

    98009a80cf5feddf2e7c81ef7cc69b73

    SHA1

    3a4a86b9316d3811919d9fd182f78dcb8ad21ef0

    SHA256

    57bcb9816e66c36fc5853a7a2cfa8983ab742b40162dc7f38bea09cd9a3e1855

    SHA512

    91bf61cc41c4c07a6938ed7609fc7369e45b53df379b19d262968c3b47d4953da80771527b42625a1725aa2033b0b2d315e5c50b3fe7e19eddef218b36896c2a

    Download Submit