Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 23:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe
- Size 3.9MB
- Sample240603-3cd1gadf69
- SHA256 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63
- MD5 6c7184e08feeadb9ac8a762634b69143
- SHA1 170bd2d20d0d44860b94b6a685db7819040c1d1a
- SHA512 37af9a8db3a17ffc1c2a9ec8854e1b91f383ce3e725f814425d12d10e055f95d6371a27d3a6ff2b0198531c328b0f9d703437fc16ec9a175a438547cdde8ac71
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpZbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe - Executes dropped EXE 2 IoCs
pid Process 2248 locxdob.exe 3368 xoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeOA\\xoptiec.exe" 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB6L\\dobdevsys.exe" 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe 2248 locxdob.exe 2248 locxdob.exe 3368 xoptiec.exe 3368 xoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2248 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 89 PID 2620 wrote to memory of 2248 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 89 PID 2620 wrote to memory of 2248 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 89 PID 2620 wrote to memory of 3368 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 92 PID 2620 wrote to memory of 3368 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 92 PID 2620 wrote to memory of 3368 2620 7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe"C:\Users\Admin\AppData\Local\Temp\7c4d4656abfc09f5d7f3440a9126e127514d74f2effa5d256f3a8f6fc197bc63.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2248
-
-
C:\AdobeOA\xoptiec.exeC:\AdobeOA\xoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeOA\xoptiec.exe
- Size 3.9MB
- SHA256 9f864ddfbcdf8c63bd8455a9453266f9620c0cdba84cb9b7e5a6378266e538d8
- MD5 f7cb00bbf59966ad2489e9ee74b503c5
- SHA1 674d14c3a018bbb0726ebedb9c82f14c7ad64973
- SHA512 de88e3e57f34335c48a27e4af3f20829e1bb4a229222bc6d3612e37acd9c5cae5cd7393d058e73134c89ffca2f3807016d71a757f7eebf52e97dcc471594e7d0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBZB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpubVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB6L\dobdevsys.exe
- Size 3.9MB
- SHA256 cf7144fd3e15d9c0f83366e8ffec536997a567325aa9437851aea6db916433a0
- MD5 8ce55e2a8e837a773b1e97e97fa765f9
- SHA1 ca0ad1256ee3e2e5a1a4235087a246c7731a4fa2
- SHA512 93c483269f1df4477bfd8b3f2362ca0682fccbc02b35a6c287912335040376e966b09a4b033935151f38c4447c01e751a464cd50f3e30f2d66f667c8f6a1d424
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpZbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB6L\dobdevsys.exe
- Size 3.9MB
- SHA256 68968aec92e9393308e73af86961199fd99b087914f7335998950ad40bdb3ed2
- MD5 864ef39de981153beadaecbb47602ba9
- SHA1 f7c5344f3182608f871835a440bdc99fc90482f0
- SHA512 0669602ab813e90775f24d3d7c2f07fed321264b4b44ac97e745d90a5fa66ef581c7919f6c950e635dddfb1503543530c6378b563370f44cd1422ab55fa2dc88
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpabVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 8d0c39a257356ff9f753d081439d05e9f138ed03701e6038a37f5e35525995bf
- MD5 f9d8a8e62ea17d2f40c805dce1412989
- SHA1 e00171ac785d929693aea980be66e1f23aeadf3d
- SHA512 bb7572f691ec6fc2a6eb2fa763da3bd33eed12a68ba29edcdc35b3ca0c29fdd07fff9f7b7e788a1b744cd136ddaa31d724c50a6903b959d349224fabcdfd03a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 bcc6c96e9d11dc083fb3276a6c732c65c6ef55d29498658d4fe96725ee9f9a08
- MD5 93f241b3d14f79cd1b71132985f7e952
- SHA1 a1dda9e14ebbc7c8403013471bacf026189989b2
- SHA512 d41b78a33df75e59c7f3736c8d86f0aee5073b1cac861fe4011115ae1bf0ee04f1836cfaebc531806fed6cc6da735f8412cdb1aa68db5b2d6edddd607dd25205
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe
- Size 3.9MB
- SHA256 d214ace25913e5af4c66718b433de7fbcd8752a12f4bc113400e63a048598992
- MD5 8559be560b43f1fe008cc16abbbbfe12
- SHA1 7f2f54e7fb3b241f72105e8222ab0d4315aabfa4
- SHA512 f2d2174e38a6ae124e6e67c24aae11557509db195df86aad4dc5a8283f295254a90687f1a0451b70148442e5580f480e6640aac41b007f6864ec1a2c5499b052
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpmbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP