bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9

General

Target

bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
Size

2.7MB
MD5

9dc8c6baa1b6ecf6bdb561b598af3986
SHA1

b4397f53f217ba282c305f7fb7a94f58832a6846
SHA256

bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9
SHA512

469daa5c87ed07a95d9656f3940dc6817a128f64f113b67274cd5f6627be1893b2c01cb158f729268a480d790f178c85b49daaf4074a11086bb031e366075c5c
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBN9w4Sx:+R0pI/IQlUoMPdmpSpx4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

aoptiec.exe

pid process

5092 aoptiec.exe

pid	process
5092	aoptiec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxXH\\optiasys.exe"	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv9A\\aoptiec.exe"	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exeaoptiec.exe

pid	process
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
5092	aoptiec.exe
5092	aoptiec.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe

description	pid	process	target process
PID 3252 wrote to memory of 5092	3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe	aoptiec.exe
PID 3252 wrote to memory of 5092	3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe	aoptiec.exe
PID 3252 wrote to memory of 5092	3252	bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe	aoptiec.exe

C:\Users\Admin\AppData\Local\Temp\bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe
"C:\Users\Admin\AppData\Local\Temp\bde1375791c43560474c980757fc957bf9a8d4b072c840ea40e9df22679a69b9.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3252

C:\SysDrv9A\aoptiec.exe
C:\SysDrv9A\aoptiec.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3704

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxXH\optiasys.exe
Filesize
2.7MB

MD5
085b86bc2eb0d62b5583df7cc7c5a2a7

SHA1
b194bda6b275c042580b256c55996e8e26ab14e7

SHA256
42109cfc5d8833f7af66a429b2fbcf08bf4abdf6413322c67d3395aaed6cc449

SHA512
49f0d1b2c52edd11a89ededf222eccc5e254745db97d024a5f897c388e5de5d80ab5a4936e69d2bcabbe30d9c94fe5d06a3ae88f444831164fbc4c7d579e2e3a

Download Submit
C:\SysDrv9A\aoptiec.exe
Filesize
2.7MB

MD5
61bffa551828f791aec39fdb98d30437

SHA1
67c95b23b14cf6f49946225aa9dbfc7b2312dc6f

SHA256
65c2410f57c42733a65a8bedbd09ab0f6ec970b8cb8928d6d41385127f9e7698

SHA512
bbc829fc03ea801a243d23e88c51427295706c03c0d6f05cf36400403f637a101e2b3fc6f9c18b6bc71f78d228ae75c2d7cb67671c8e5a1026c6394d26d7c65b

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini
Filesize
204B

MD5
0c778cdb69532d76c42f5dd37b92878b

SHA1
42ffeb957903f6ae5487490c530fb72fd71f221f

SHA256
0aa28ff03e45275e7e2b1650671ab9e8b6aed2b6651cb42067ea74a607afd9a8

SHA512
6e8e366ce7a392188b40c5e42aeb10a594c6b14dfa96d0ffaabcb475bddc26cf43b0b14324d057b96b9283e499f5b89ba46d751c0d714769e4dd6e77df63317c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads