Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe
- Size 2.7MB
- Sample240601-fd62baac9w
- SHA256 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3
- MD5 768526353f43fbd2f6f476ebcba93764
- SHA1 644459fa8fa5515872c49dcd409434d76e287b4b
- SHA512 29a4f132ea0734ab0ecd24af88a26060c7a9f61dfca996532055130fd4791757f29d71b6c6c469419144a98058141f796ce3ec8ace0c2991d28bcb353f3a68c3
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBN9w4Sx:+R0pI/IQlUoMPdmpSpl4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3380 aoptiloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot7T\\aoptiloc.exe" eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidLN\\boddevsys.exe" eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 3380 aoptiloc.exe 3380 aoptiloc.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1408 wrote to memory of 3380 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 88 PID 1408 wrote to memory of 3380 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 88 PID 1408 wrote to memory of 3380 1408 eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe"C:\Users\Admin\AppData\Local\Temp\eb8b9cf66690de565d56cf0084d17ffa95b8b85ab112fd7f6b42891b3ce62da3.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\UserDot7T\aoptiloc.exeC:\UserDot7T\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDot7T\aoptiloc.exe
- Size 2.7MB
- SHA256 c356006abd7d73d78e7c98cbabd7c64f7c0479cb6f2b080883d4b11ff6be8212
- MD5 e8cc3b85f9516d4a2decbc029d2d2320
- SHA1 b680905f1ff6b1ca2d598183ba1a7db3676e0271
- SHA512 32c6850f51dbcc15a80ba6ea4d0f765fab829d6820b9742c3b46d2bcce72fda85c7598d81f2f0f45eba632dca4af310d3dfe3ee232acf43405077267d637ff68
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBS9w4Sx:+R0pI/IQlUoMPdmpSpw4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 31c5d86cb6aefa0c823217fde163a2316e99ed40822fc9b7007bd4580f6ec8fa
- MD5 e2051880b9d35b519fe141aed2716893
- SHA1 e22431acdf8f386d81b22fbf8b56e92bb7d0e0e5
- SHA512 96d05b73deb2f6d298182e4b809d2a18ef2f100c526be4f51e4ad2afad4b05e5b86e068a7b791caafb1b87c08a3d20ffb89fd29ac9d5d375da76aaacd23dadc3
- MD5 SHA1 SHA512
- Path C:\VidLN\boddevsys.exe
- Size 2.7MB
- SHA256 9d8162d1be25a575f8f5357d5c8e337fb21fc74bcabaa0f6ec798f318c990619
- MD5 a7598c6b3c8914e757cdb246d63b35fa
- SHA1 aca727ab07b041a226efe66243edc2a5ceb7c452
- SHA512 46b7571b0e6a9f93968192b7dc430000d3ab66c178a50ffe99bc879a0d1d2d1548f2d7936f60621e26180fd01bc80b832012215fb69dbb5ae27a12cc8b0110ce
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBZ9w4Sx:+R0pI/IQlUoMPdmpSpx4
- MD5 SHA1 SHA512 SSDEEP