c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692

General

Target

c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
Size

4.1MB
MD5

9fc12f85b24abda226dc964a844c357d
SHA1

aa28ccf6d4397c43c728439de3c4e204f6b48eda
SHA256

c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692
SHA512

0b895f2fd889696d0d609adb990a5493c67d72be2891e8cc24144dff489c1974e406c2d0cb36ff3637e9986cbc14a23c0f99f30eca359843d3e93945daffb5b8
SSDEEP

98304:+R0pI/IQlUoMPdmpSpK4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdml5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

xoptiec.exe

pid process

2128 xoptiec.exe

pid	process
2128	xoptiec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeJU\\xoptiec.exe"	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint7L\\bodaec.exe"	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exexoptiec.exe

pid	process
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
2128	xoptiec.exe
2128	xoptiec.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe

description	pid	process	target process
PID 2240 wrote to memory of 2128	2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe	xoptiec.exe
PID 2240 wrote to memory of 2128	2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe	xoptiec.exe
PID 2240 wrote to memory of 2128	2240	c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe	xoptiec.exe

C:\Users\Admin\AppData\Local\Temp\c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe
"C:\Users\Admin\AppData\Local\Temp\c3a88557fe28bcdaa1191d3b4e58b62789052c3fd3f66c5705015fbbca3d9692.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240

C:\AdobeJU\xoptiec.exe
C:\AdobeJU\xoptiec.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3520

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AdobeJU\xoptiec.exe
Filesize
4.1MB

MD5
ee46a73e3f4a46f28df5af5f759935d5

SHA1
1f95efaad5a349479f4c166d3c7a4285cfff2a7e

SHA256
e048bade76edd297a1c44f99e4dc5a8cc59559e6702c0837416f7f7e3f095b71

SHA512
5e574ca3a370f21ca25ec21bdc94b66a5db62bb78f192a956b0d296f89781f57d41f796120c830f8aaba92d7cb0fed97221a1c1eaf70472c86f26ef259fe4a9e

Download Submit
C:\Mint7L\bodaec.exe
Filesize
3KB

MD5
3161dff010f251bc927e6e78cec9f490

SHA1
c2d8e5e54300810e861e8bc27b869b3e8053b8f6

SHA256
b1a15ad4b5bb8edcf1808226895d8dbb5d7a9b52f7859584e51dab938991a13c

SHA512
40a22a64ff72d4b9528f24e1cc4a5a59e79cdc441d00f9a9853cac1a3cbde37f264ee95d3fac212e89beb62a050da325fb2191f881422f57ba38ce13876e4679

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini
Filesize
201B

MD5
2e140e7bc0eaf36e50e22e722a05bf81

SHA1
f33838430349deca0494dfece361d7c6a56a5219

SHA256
0fb308d1a2a08138bb9f20c15c669975c102a226c6aa37eff61bd51ab6916f5f

SHA512
a97882bd11749306d15f7a0648d57566c9ddc6c596d7d25268ea3d5c72d6034fb13b12646e05dffcf4dc2ea60743d34d6d05e39bc4ab923ba06fc1d968b303b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads