Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 05:37
Static task
static1
Behavioral task
behavioral1
Sample
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe
Resource
win10v2004-20240508-en
General
-
Target
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe
-
Size
3.1MB
-
MD5
4f5d3df84940771701815930ef5fd25a
-
SHA1
5e304be597a6e89fe2ab986e61bf9ea571226d59
-
SHA256
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d
-
SHA512
aa6dac202564b89ae6a8eed1a6baf45d39264b83dde37f1c0641eee76f01ac54a46a2cb292ea4fc385955ae6005fd2a186454113d11b06c50f4bd555751a8be1
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSqz8:sxX7QnxrloE5dpUp2bVz8
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe -
Executes dropped EXE 2 IoCs
Processes:
sysxopti.exedevbodec.exepid Process 1444 sysxopti.exe 2616 devbodec.exe -
Loads dropped DLL 2 IoCs
Processes:
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exepid Process 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocPC\\devbodec.exe" f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZL3\\optidevloc.exe" f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exesysxopti.exedevbodec.exepid Process 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe 1444 sysxopti.exe 2616 devbodec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exedescription pid Process procid_target PID 2264 wrote to memory of 1444 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 28 PID 2264 wrote to memory of 1444 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 28 PID 2264 wrote to memory of 1444 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 28 PID 2264 wrote to memory of 1444 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 28 PID 2264 wrote to memory of 2616 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 29 PID 2264 wrote to memory of 2616 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 29 PID 2264 wrote to memory of 2616 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 29 PID 2264 wrote to memory of 2616 2264 f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe"C:\Users\Admin\AppData\Local\Temp\f672a1c5203b9137cfec8e78ef7297ec97ed8b1bcb09371582248086323d8a6d.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1444
-
-
C:\IntelprocPC\devbodec.exeC:\IntelprocPC\devbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
931KB
MD5db8b90a1e2c680d6b4903dd6a427762b
SHA1c86f9629fd3e2f7d0b7e60a1a51c9127e6f45180
SHA256e6f555a5ab87dbb7cd8e28d0c86e4025337860d3a261fbf08e01855e95d0c63c
SHA512451d06cc93032b1beba273789eaad617760ae0daf6e1c44c005857d168bb55b99a0d03385154b78de07083ee91c4da48ac65c92f9fd09e60821a5c95dc18771d
-
Filesize
4KB
MD5b61f1c7ad73efe910c92dd7a7c9a7a0e
SHA1da9ddf3e1877afc7efd9c8d203fc7f7be3458ddd
SHA256b362504c75e4817110ee35bd9d522710e988aa3feb5cfb08054cbe0cfa6e45f0
SHA512224073e4b1011e45541352166fffbcb47dc06282baa16dc5279ee78e858f642e1495bf79dc1ee547b1db3adc2c1a1fbb08ea75a50ef49d2a238000e931ebc155
-
Filesize
3KB
MD5b85ef880820ad2f02706b10170e533fb
SHA171378239fb161e35c8f79d7a951d7d09d4f45b33
SHA256824b6d312a2dde817fb21948332f4b59c54118a25d0c2deb5bfc92aa1a9daa78
SHA512f430b5b60b9ef1cf4efe9787c7b0f161b12f4212956a065e1f0b6a07907600fe307c8323482f6e6d85953fe9576ba09e3b9876d9c27e916f7ee62a9c3665a6d3
-
Filesize
177B
MD5731615a8ffefabe1fe4a5cde7a04b729
SHA1a6cf7d0517e2e7ecb2dad5673a5edfa7d15aac7b
SHA2560082e24907aab61d01028e118116f9ba543a5216cfbd29ff5863d50489ff2ead
SHA512dddb4dff10558959c0174769ca57d41d2a896f13d8dae79e07afe6c0984df1936340ce39a7363794d28b6dc2a930a7bf2d9dac4a40ea6e212be5a93296e8fd78
-
Filesize
209B
MD5672bf2510a2e4fa4267fa8fb0f010fe4
SHA1dc0f9af00f2edda6201473d80d5edf271229b553
SHA2566e0dbbcea7b51301b40cc8d7807a6a014235bfffb3669e833e18f71b5bffc269
SHA5129994705291061efe651a68e0441883130a0356fb6493faca98f9feb40b636d226d97ed51ca9a5a3b274a5e2f1d3468e29a7a0a7d4e75b2eeb7f1f70760c01920
-
Filesize
3.1MB
MD54c1347ab26ea24322b08b6b85bfe2bbc
SHA1b11ab69a08d49798e428837af666b3ee52a35b2f
SHA256300debed46c8f798b67aa9b0f26f16907873a1105c21a2106e7b95c40ee23155
SHA51254f1663196dd1388d9259848e6ae9ed80800ac99c1445890ca9a54a5c63499e7ed215ecac8910fbccc13c6210619e6bdaf99bf462db6dc2710bb2c0898f114ea
-
Filesize
3.1MB
MD5f4119ce62573f7bbcb0c8addcae774e0
SHA15c44e843da3d4a96889a2a8abdddf46a261883a6
SHA2563dfc0d1fedc84cc95e2ab82faaf29cd5629cd6e257bde6a4e0eca18c418ae827
SHA51202481c55a807729af45ca919fff74558de9c07200a73a9e1b65711d8cd125a7f154852ada64ef799361fccd2132ccc63e1d8917995719d3bbb4be6dedd904a9a