Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe
- Size 3.0MB
- Sample240604-be85vafg2s
- SHA256 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3
- MD5 1a680f868f797fba770d84bf85e84ca7
- SHA1 90e2d9a96603e59b8182984d379971d6505a772c
- SHA512 4ec311c76498a63d45c31df04ef20c4fa7c84332dc406a0c576ebad7700229a5bf684b4a432787e6dce9f10dc037dd56079379c37a4546f55efe08016d20d34d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBNB/bSqz8b6LNX:sxX7QnxrloE5dpUp6bVz8eLF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe - Executes dropped EXE 2 IoCs
pid Process 5080 ecdevbod.exe 1556 xoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotYO\\xoptiloc.exe" a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxV9\\optiaec.exe" a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe 5080 ecdevbod.exe 5080 ecdevbod.exe 1556 xoptiloc.exe 1556 xoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3024 wrote to memory of 5080 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 88 PID 3024 wrote to memory of 5080 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 88 PID 3024 wrote to memory of 5080 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 88 PID 3024 wrote to memory of 1556 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 90 PID 3024 wrote to memory of 1556 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 90 PID 3024 wrote to memory of 1556 3024 a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe"C:\Users\Admin\AppData\Local\Temp\a38e104c200624a19b65081a223dc06a5536a7d84f90ff04440e6b1ab97a0ac3.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\UserDotYO\xoptiloc.exeC:\UserDotYO\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxV9\optiaec.exe
- Size 3.0MB
- SHA256 d8e4f35a03d2733d30df2107ae858921cd7c95ff15c1b57e711ff82e128a4d40
- MD5 8bff7c130c0342ab88f6f346bba2621b
- SHA1 e1802795f7c469d2427a2389e6c8d39e9efe31b0
- SHA512 81b5148329111a1969ff01800f58e78a271e4c35743d9c57e93c9928f5480220ecf4e572a6a65d6c7d6bf99cd14adf32aea10fb19f12128357ab899c8e459c56
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8b6LNX:sxX7QnxrloE5dpUpgbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxV9\optiaec.exe
- Size 3.0MB
- SHA256 febe40b79d1e4028caec2c4e1e9e20699312d263db90f3f32bb6a83e5bd0854c
- MD5 a0e24780bf2ae808ad9935d097774066
- SHA1 aa0797db3434bf5c0db2bc66752e31a2a3614500
- SHA512 06a6ac7fe2fe1b24c8d2854ae1493fa62b85b12a1540e946c5773a7e5615f47ee851b24bbe7ef044750c687e80e8c34498521a501ff0594d828e4d83ffa6edc3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQB/bSqz8b6LNX:sxX7QnxrloE5dpUpPbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotYO\xoptiloc.exe
- Size 255KB
- SHA256 472414484e925b977974c00abd85d3c533fb3674287106eeefc61242a195f0d7
- MD5 1539dc0b817aecfb1dc562b152f8d286
- SHA1 6330c7af18196423a6c277efd3946d9a95972278
- SHA512 1e658ac18cb6ab1df958edb64ac177c34f43b8ad3a00c997736b274112a1eb353a85fd60eaa97df794d29f550f8a5e1abe001e308da8b85796c2c9fa34def564
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnSz:6ne3n0DmAm67YEjAyu6qJ/+WSz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotYO\xoptiloc.exe
- Size 3.0MB
- SHA256 15e1da6758f9540d5941f0ca911699bb3c66ae3e03d2149becad809709fec9fa
- MD5 ae4931146b0cdd35d4c4eb708390fa00
- SHA1 31d77d160526040a7f507c23da42267a67f4d155
- SHA512 8547add040e223465d5ce17d010bef5ffda17470e041819345934dbc50a50278f5b967355a0d8a304c349ced124116449db2d55f2bbcaf300145c02085cd8bb1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bSqz8b6LNX:sxX7QnxrloE5dpUpsbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 aa58f04d86ef665b837e58f805ac59d9b757d7b177ea124dca82c1860ca2ac22
- MD5 1a4fcebd7a7079cd1994760e1ea7b070
- SHA1 acf9bbd43c627c66b1e5371a56d8168a4f9b1a69
- SHA512 da6b34144e8aaa64ae182498e87e3211f4139092402a6c35aae60cc8af2fc493489807eec7b265230a467f88658da45551735aa3daa28c0b67c31ac52a3865f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 856ece9415a1d7d4c9628d11db6b4b3167a7bd2ab8ba64d87d1ddfbcec0ba6ae
- MD5 5bc4ad30ae067768b83ef3e812924be9
- SHA1 0c8275e172f32bcbc5a8601bf6ac95dfc681b4a2
- SHA512 1331ba4298d607210b4593fdacb6c580a556c9516597cf1c6ab2e45b3d7cc8e0ff9ab0f9c42c3ca8d80217fb055f42ef083e3384a770f0aa662a17aa5af92de8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe
- Size 3.0MB
- SHA256 48efb4d1daa9a0008a0d84a89e50556c3508bf74e47bda875534c4126333be5a
- MD5 7108681a8d4086680c8e439d0d989e1f
- SHA1 74bc12659bc371e37a684cfa47f9c0eab1f3ba94
- SHA512 4c6152afc2498074ada3f405b388d28d7de7f9abedeacfe5f7c4d30489f9a7f3571a0342bd04bb7b5b6065f37e488a9528e43482d464faef18d4638bb65cb75f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSqz8b6LNX:sxX7QnxrloE5dpUp4bVz8eLF
- MD5 SHA1 SHA512 SSDEEP