Analysis
- max time kernel
149s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe
- Size 3.9MB
- Sample240603-zhst2agg8t
- SHA256 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45
- MD5 2edc2a3f2f470b7dcf90dfd733947751
- SHA1 5f74c0119cfc82f650b6358c3065785a989362b6
- SHA512 52ff594ca607d58bfbf67052aef1c40fdb90662b053a8c32d88e56b93c9c0abf0cc6386a4ab24bd3928d89333a190997c1e6e9ff7e9b70df76cba080ad78bc26
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpObVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe - Executes dropped EXE 2 IoCs
pid Process 2828 locxopti.exe 2100 aoptisys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesND\\aoptisys.exe" 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBMV\\bodaloc.exe" 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe 2828 locxopti.exe 2828 locxopti.exe 2100 aoptisys.exe 2100 aoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4504 wrote to memory of 2828 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 85 PID 4504 wrote to memory of 2828 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 85 PID 4504 wrote to memory of 2828 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 85 PID 4504 wrote to memory of 2100 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 86 PID 4504 wrote to memory of 2100 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 86 PID 4504 wrote to memory of 2100 4504 40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe"C:\Users\Admin\AppData\Local\Temp\40425655281a2fff3720631d8057d88032c6941ee5862842e9714ca18f68ec45.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2828
-
-
C:\FilesND\aoptisys.exeC:\FilesND\aoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesND\aoptisys.exe
- Size 3.9MB
- SHA256 1ce8fe209c337eb09cf19dfef6245c7d41039ee6bd6c97ee8dda8e68bab3d670
- MD5 150b1edd43818aec1c800756892f1433
- SHA1 3ce9d145c83a1bfc9725eb6b34b6f826ffcc9668
- SHA512 1da864b79d7b0c8fd15509c8667a50ee0f61f02d97d790d34561bc653d78c6e6036958d039500cd9156c63bedfa3c5eb4468d0be799f2a63a4b74bd72916563e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp6bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBMV\bodaloc.exe
- Size 2.9MB
- SHA256 3a6c442cd97470829487c35efb719a1fe6d702ad9f338d68f1a04424eaedd462
- MD5 10e389e55e78712ee79c4d60744b0dd5
- SHA1 ffbb5c2583a67643805d09814beee2b5646c792f
- SHA512 9bde68ae63df90d9cb6f52f330a045893989f8df9d63f653d7bb2a5765fe68b30fb6be207cd13a6610b7ae6e337447ae6efd6c76d2e4a61101c2aa5c4da11cd3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bSqz8bh:sxX7QnxrloE5dpUpfbVz81
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBMV\bodaloc.exe
- Size 3.9MB
- SHA256 e481484086ec31cc74ce11492b3c1aaab99d82b1a134c617d587684139c812b5
- MD5 7f9ac69d7bec70bd9c2e4013048a5fa3
- SHA1 b0621aa79af23e0c667992d3e8644257389129ad
- SHA512 2150504c90a056f6e5e84b39ef6d546ce0dd2d706f6b7aff5fae5c5f26b85b70d198d0e67686db6bbcaa6b730d496e6b0a106a044f356935b261b943bd98a056
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp+bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 4e31fcacb47e397f1b7707b4537f23ddb83dc21251cea7c856f7f74bf10ac7c5
- MD5 c41b5b16d37c3d677fc8a3cec22cca90
- SHA1 99906cf8d45eaedb79aa5e003e64b40f0f533dde
- SHA512 aa098befc85f4bf1fd69a2ef90f3aca1777aa5ecffdd1079f67dd958ebb085fce7a9ce3670d279e589ba548c23acd98515e45121879d6896357fa1f60c940bd1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 fd21aeee0f8e6ddcc13ace98743636e46b40f45aefed77a4ae0ad9713f8f4a51
- MD5 53f7b1ac90d016aec45238f3c70871c7
- SHA1 0e3e9eef086defbda70011c9f03c19205334c924
- SHA512 94f2d24f730a1ca4134bfaf90ef4d5144b678be81e563aafbae1fb39ac1626fb565218c20f753183ee0c336c694e1d6ff114d8a332342b328f490cf350ec3517
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
- Size 3.9MB
- SHA256 724b2a007ccc895b5d9598ca39beb09367386f02e09cd99fe2c1e465bbe6265a
- MD5 bd74240877e5885a65e136affdf017be
- SHA1 6c8247233234b4ccfeda4570d1bf315d27392b66
- SHA512 af6613d8e66a95423668585f90f71592537da8b71fed17717cb47352c077658cb578acdfce07fb579d60f7ed52ffedd4eb46a89c49a2da132f01b6d7daa1fa99
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp6bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP