Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 23:58
Static task
static1
Behavioral task
behavioral1
Sample
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe
Resource
win10v2004-20240426-en
General
-
Target
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe
-
Size
3.0MB
-
MD5
59aa1e504bfe3f827d1aa215281d5672
-
SHA1
e1f7ba0ac7eaaa98906129d6d1e455af1c11ab09
-
SHA256
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b
-
SHA512
079be82c10748216401c1f70a55e841738e5f8127b449444bd3df4c546477544c06c8b6d71d1c1880110ecc147952efc4cc8f57a76559df6ca2ddd70cd9ca491
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bSqz8b6LNX:sxX7QnxrloE5dpUpzbVz8eLF
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe -
Executes dropped EXE 2 IoCs
Processes:
locxdob.exexoptiloc.exepid process 2344 locxdob.exe 836 xoptiloc.exe -
Loads dropped DLL 2 IoCs
Processes:
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exepid process 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesZ3\\xoptiloc.exe" 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintSN\\optidevec.exe" 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exelocxdob.exexoptiloc.exepid process 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe 2344 locxdob.exe 836 xoptiloc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exedescription pid process target process PID 2196 wrote to memory of 2344 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe locxdob.exe PID 2196 wrote to memory of 2344 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe locxdob.exe PID 2196 wrote to memory of 2344 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe locxdob.exe PID 2196 wrote to memory of 2344 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe locxdob.exe PID 2196 wrote to memory of 836 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe xoptiloc.exe PID 2196 wrote to memory of 836 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe xoptiloc.exe PID 2196 wrote to memory of 836 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe xoptiloc.exe PID 2196 wrote to memory of 836 2196 8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe xoptiloc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe"C:\Users\Admin\AppData\Local\Temp\8a97dbf067499cd6a2d8bfcf9fc18f4b494eac273770d663bd949eb8ccb4a46b.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\FilesZ3\xoptiloc.exeC:\FilesZ3\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD525b865003b54619353e1098b866ebbdc
SHA19b30603ba7974ffa1aca64922e84efe0c9557df7
SHA256c6c5006eee01a2aee83675189743a6379822718ba06fed3943afcde4cba00195
SHA512929e959693d0b80b15290ba82ead1673ed9ac2c557831149f65f1e7dadfd5219e5e9e411f3d932e675d565cad011013e2fabc4c08ac2d8d8b2bcbc0b687343a8
-
Filesize
1.2MB
MD5211f25780a949ecc47fe103d46655355
SHA19e61828760283cbf311ef63c6da4b54bc8e38bf4
SHA25603491075aed567421202b9da1912d5f0684570b8bfcfac389e16ecab234affe3
SHA512425b07a8bcade19beb7d3eb2c68a5c38fac85217de4e8894bab479305438f7596b76f74008bde826ec59080a7a764188687505f6ff96e044ff9027820a3b495c
-
Filesize
3.0MB
MD5c4f1574ae17f866c6d229c8b2752f281
SHA1ac57045ce6675372cca1808c8816c0f2eddbc543
SHA25686e026acbcd213d58ae4799defa534525785d175dad58888556664ada4560f9d
SHA5127b25b0b26584b3552ed09ff0ec676a02a2354145b966e87ad7a596aa282bc3d4f5b296020dc7b5ff51f5c23703ad95c9fcc79a3082505ca29ac190889b3f6cc3
-
Filesize
171B
MD5888b6484c83cd7c402ad61e38d4590a4
SHA120188ad8d9e497196a0741ae5090a6e17ac2bc72
SHA256b400e97b81f8f98fe027e7cddd377c2935639a90ca4c5ddc9bede22381cc6302
SHA5128ca00f9494c03c483ce3375a673a21ddd55b85404988c50e2c59c7c442131ddf5776d38a2fe3a29b122311099f653a23ef33832ffcaf369dad83919d8e6d94c6
-
Filesize
203B
MD5da78b45c490b652ab3a0504f7784ab16
SHA10a15893ee69eec3b9f19b85f95f11ee148bc3ffa
SHA256d78edf158fb0a5c4f7187525603c1b2dfc52cdc23eb2009cc288a80833db5055
SHA512c74f0bc9c59b6be6d8771901c4d419f79f862319f08b0fd0829d83f5456d112dc6ad634ebb744ee4113a7ae4cd3797a04c133e764297806e20d3c13f62b4a95f
-
Filesize
3.0MB
MD5d647ecc0753ed21fb935e0259e070450
SHA192bfbbb6a7cc8bb8842c8081593e4e64818da3d4
SHA256dfb18e521ce70b3cfed9c90cc73aa9b8b194d329f2118c66b74ae2b4863b3398
SHA5126afa599f658df3f3cfded980bac337992bb4765a097d33491687d0e75fdaed11c4a5404274a463b6402d2996bd337f7eb3361a698af0720478162846b891cb37