Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 00:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe
- Size 3.1MB
- Sample240603-adfapsca6s
- SHA256 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f
- MD5 3d8987cc854b93683b4a784b9bb13e34
- SHA1 3768d7fbde1b54dc0818644d70dd2a59695ebe15
- SHA512 2eceac276f3d4ccde7021e4e63f3db0a072fbc527db0b9587526f56d0b98caa9b57bfb2e298a589fae8a3630351a41dd7197539df0bb721f50a810ea5777dea6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpFbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe - Executes dropped EXE 2 IoCs
pid Process 4612 sysaopti.exe 3944 devbodsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocYR\\devbodsys.exe" 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB2E\\bodaloc.exe" 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe 4612 sysaopti.exe 4612 sysaopti.exe 3944 devbodsys.exe 3944 devbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4612 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 89 PID 4456 wrote to memory of 4612 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 89 PID 4456 wrote to memory of 4612 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 89 PID 4456 wrote to memory of 3944 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 90 PID 4456 wrote to memory of 3944 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 90 PID 4456 wrote to memory of 3944 4456 7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe"C:\Users\Admin\AppData\Local\Temp\7f4e9653324aef044b75d67e46749fd5a328e424ba4ec8c71357e54c50ba1e1f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4612
-
-
C:\IntelprocYR\devbodsys.exeC:\IntelprocYR\devbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocYR\devbodsys.exe
- Size 1.4MB
- SHA256 a969f6e4dba329a513afebc6aafe85b92cdebbcaea7474b7b26720b230ddf501
- MD5 5ceeecfeed911b13bc7b41a07ad12a1b
- SHA1 80c10c608b9a412cc1ec849cb09b8ae18fbfaab5
- SHA512 3910c70989268e6eb683abfe5d321910528de9813c0ab77e53806c5627b4f182d4c1d3f7f6716a83804837badfbe52cf481a63c25788472d3b8923eac39d8a50
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDG:sxX7665YxRVplZzSKntlGIiT+Hvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocYR\devbodsys.exe
- Size 3.1MB
- SHA256 d6b2fec571b67e9e694faedc4927f06de3de89d1c2c6f95466427c32a9264a95
- MD5 2b27287efdf20441519e66f43131665a
- SHA1 858a44ae30f37128df88fafac3c1f37e894c2b5e
- SHA512 03f1af509cb535e479b794535676efbb1290e80a62845125758a316d9278c2f56fac02f3b5202d3d36cf01c7029bdf9eb8cce67477a108f28adc4c965cf0cf61
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUp5bVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB2E\bodaloc.exe
- Size 256KB
- SHA256 f26cd50b154fa5d33fef868931bed180aad9618c7ef3e9e90b312d29e53d26df
- MD5 9b5cd4013fcce036b21749394725d11c
- SHA1 8aef7eaae3b958cc54aaecb3b59e1509f73d950f
- SHA512 30defd2932e4799fdd208fabdf01796225a5ef9eb6f00ef3a902529a746414d226f06bd5a4f0a030913c86457e57d9b220ba39504c94479f5b39cc7941493099
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS55:6ne3n0DmAm67YEjAyu6qJ/+WS55
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB2E\bodaloc.exe
- Size 3.1MB
- SHA256 dad754137162f3f5d690b2cb4abae02bb809201abee576f4ba7c5c9e5b32ecb3
- MD5 c81e785248e24d1d7bc3a0e9f38b35c6
- SHA1 a2e4936647325c2365c09f6abd3caaed84603258
- SHA512 4ed7f7e7aba8ca851d4ad36924c586b5696a3cad3797ee4b6ce4a32ef7fdbe1be72e07274a079ddda69bf821dfe54d6e70e8fe4bfce7dc7616167e9e517f892a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpZbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 207B
- SHA256 c2d793f21645ebea150f8b2ff5048aac31d27f77099adc611c7c6ef674b50eb8
- MD5 55d7f016b8a8c380316c57fb48b39a25
- SHA1 7497b8fec93a819f7d8eaff98b4336b36dc4de8e
- SHA512 c610506dd8b12138799339fb52d06810c4e63c43360ee87ad9b063a38d7e05511920064d185a086d079c7ff68118a38dc5b20c3ace52490c1b407d50873b15b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 175B
- SHA256 c14f57660479297d0b9d881a2589c47e03290d3a419b51442ea7a362a874e643
- MD5 670be96e38aa44c5f1b2214f591946c1
- SHA1 0cb7658fa502a9fc5dabb2b010ef55185ba5225b
- SHA512 669085929f5a18abd59a8fcf1f80c2f5350c611a0e64ed2f69b1b349905eb456f01fc845b93018fe51e5aa103c000e9cf33348d23dcc6587f0dc975ec9c8245f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe
- Size 3.1MB
- SHA256 558edea980b8d7ea76ef355c4f41a9e906a99bd4f80f8aab3618e9c778d979d9
- MD5 db07b3b06dfdd2d2e9fc454027e3bfc9
- SHA1 0f2faf9a95e724d000df7d53b29485c839a41f17
- SHA512 f003eecce249ee1d4f2c5f76c89921ad2f2f56cd3c7aaad38b36904bb1a824885f485e34ff41b472fda864f7c5e9606938e3276a688ca0e78165ef22732aabde
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpfbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP