9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
Size

2.7MB
MD5

b305119fbfd6be4361f175695b595eba
SHA1

1c344f4ff82c0e9b938772e78d6e64aec8f05cc5
SHA256

9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da
SHA512

8eb171536fd85a8f16158636db29c3f39d9bdc1a0a8dc6514c12482e75de48155ac1511b3aeb4dcb7f146f5dff8c34adeec04dbbd3d888c697002586b6ec3207
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBP9w4Sx:+R0pI/IQlUoMPdmpSpD4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2292	xoptiec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvYE\\xoptiec.exe"	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidZR\\bodxloc.exe"	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
2292	xoptiec.exe
2292	xoptiec.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 2292	32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe	90
PID 32 wrote to memory of 2292	32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe	90
PID 32 wrote to memory of 2292	32	9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe	90

C:\Users\Admin\AppData\Local\Temp\9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe
"C:\Users\Admin\AppData\Local\Temp\9f74e3aeb6762f6e1f32721429eed0de28a5c6ca98818e50949bb7410ad412da.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:32
- C:\SysDrvYE\xoptiec.exe
  C:\SysDrvYE\xoptiec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\SysDrvYE\xoptiec.exe

Filesize
2.7MB

MD5
c6ff9836460f0fa3e970b43712cd8711

SHA1
9d6dd89329275c65d0ec0c2dd960b47f7a1705eb

SHA256
1c3a9e78a18dcb184c3cd5e9b356c2b203c100749e7dc38d16257ffedbd02b30

SHA512
87b899f1ff89a654f047ed6d8d419a06f06b4a344b19f6f35537d0b83af00d53231c4679791858ef6f19c0ad95d0d773831c4608a7cb694cbfe30a750401db8e

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
200B

MD5
f684acb65fa6470ec8080714d80e2720

SHA1
57e80ffeb434f10844bc05c417ac6a2238b5f387

SHA256
07f79d0515d42058663eae1ecf04f64c0ff2dc3f30477666530f29c7f9b014d3

SHA512
230302c790f52c926259b1ed8f359bbe37f506c89437a7ba468f1916ee6d731b97c0ab3e5788c40d4634d0ec8860d423b3e2aed16ccf11549b55741c5b2314fc

Download Submit
C:\VidZR\bodxloc.exe

Filesize
2.7MB

MD5
913a8bb76d93bf81d1b27a2dfb9fb33e

SHA1
9764fe68bdbeb298d61bbfda21f577b2d3262392

SHA256
4137ad38d245357061f8387f6aff2734e42d1f618ad88b128f270a201122df86

SHA512
8916471136d848e02bf1fc84fd93a6c7e4c846bb8a61bc5ad8abe0c2e3260233c229fef8c6afb41010cea46aed0fee2ed01d387a3504de3682633c650eb4ca4c

Download Submit