Overview

overview

7

Static

static

3

2b85ca0b81...54.exe

windows7-x64

7

2b85ca0b81...54.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 20:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2b85ca0b813c174631af58b0dfc36894337916b8bf8ded08e31ca5c48818ed54.exe

  • Size

    2.7MB

  • MD5

    c04a4ae2e046622336926493584a6d83

  • SHA1

    5c166d859b17980645adff8677db1a71dfd75baa

  • SHA256

    2b85ca0b813c174631af58b0dfc36894337916b8bf8ded08e31ca5c48818ed54

  • SHA512

    9a076cf07e5d882dab76b613434b5f50823a38322a91b3fe27f42dd1f478748cffe6bfbec3feb4c3f5514b2c25ec7fb12caa7f258c823902888e3fb473d06038

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBV9w4Sx:+R0pI/IQlUoMPdmpSpF4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b85ca0b813c174631af58b0dfc36894337916b8bf8ded08e31ca5c48818ed54.exe
    "C:\Users\Admin\AppData\Local\Temp\2b85ca0b813c174631af58b0dfc36894337916b8bf8ded08e31ca5c48818ed54.exe"
    1⤵
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Files7Y\xoptiec.exe
      C:\Files7Y\xoptiec.exe
      2⤵
      • Executes dropped EXE
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      PID:3576

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Files7Y\xoptiec.exe
          Filesize

          2.7MB

          MD5

          0fef57ad92302c1b3b635e85f92ca2ff

          SHA1

          88480fb0f3ce32c0ac295d4d17149f9ebd0078ed

          SHA256

          d89ecfea94377ac4941ae4a22fb1a2f2860deb447ad007e41c79ace7a8acc068

          SHA512

          fec78cc6985608f6656e18a57351b9982561af5ddab3c8be2b441abff1335a1ea7859c6494337f9e18301f245a7107c5eb5ed99b447e281538cb536aafcd2288

          Download Submit

        • C:\MintSZ\dobdevec.exe
          Filesize

          2.7MB

          MD5

          62c900dfc6998727d1f98e3e02fe9b6c

          SHA1

          50fb64d6c5381f7770998df5765fdcdc147c71d6

          SHA256

          467840431a9c744dd6831f3e58b68bbc786fde0ec6810dd1dbd83dc15ef3ee6c

          SHA512

          e04baacddf7b3b8a64f55fd1d9ef240cf48fa4fd5c6d425631aae2b66cc3b5ab033ad8211341f839f56fdd1fa16053ec280e200f3dae4381c848658bf9d8dd27

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          205B

          MD5

          b98c7a99114126d3effbde4c01e03591

          SHA1

          7deb12b308a438ba9281dea77978ab3b60f0afdb

          SHA256

          9861a94fcb172bf15eeb0dccda2e2135f81e1cc26428ab2632f7c4c2d12c9c78

          SHA512

          73cec8cb08603cb4a52b36f9bc640c9d59d0f2b5402becef551562914891a543bb69e49ecdf1951318a6a30e544e6fb821840511888d6bceb99a1d95689f8503

          Download Submit