Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 00:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe
- Size 2.7MB
- Sample240607-a5mh4aef5y
- SHA256 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656
- MD5 7d8b4c20bdc0fab94bd0b255f4a10001
- SHA1 023cb39453d4d2f79a45dc95e155da847de86480
- SHA512 ce2e9c38098b46ffefab250eb581f8b930207299223223b4a53f1d6ab7932d872b67f2223de76bc8e17c9c24d6ca73fa18a4ad4f72c88925737acde1fbb988a0
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBu9w4Sx:+R0pI/IQlUoMPdmpSp04
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4852 xoptisys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotU5\\xoptisys.exe" 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidZR\\optixec.exe" 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4852 xoptisys.exe 4852 xoptisys.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4852 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 85 PID 4616 wrote to memory of 4852 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 85 PID 4616 wrote to memory of 4852 4616 6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe"C:\Users\Admin\AppData\Local\Temp\6e31e316f14bcc5ef7acaec3488923bd87e81a15098ad5740de35b0c8d054656.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\UserDotU5\xoptisys.exeC:\UserDotU5\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDotU5\xoptisys.exe
- Size 2.7MB
- SHA256 8c07b1752f0c91d1b6eae517d47b8f5a3fb55c076e9b9694e6ac7e1d865633dd
- MD5 03e578c28508582670c91153209c85f7
- SHA1 64c7067f81f7bcb72788540a3baefcb81fd096fb
- SHA512 baa0814bb4b1c5cdddb049c5e3767428ef726c3ef2909fcdb850077040a73d1ae33066d13364ddb5cc40f7b1bff4367ef513fe47ee7e82b7d4bbc18e1de3bac0
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBd9w4Sx:+R0pI/IQlUoMPdmpSpN4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 25fab4604f3469137fc7ec508011874717b64f63f2b5f39323f5ad33bd84ade4
- MD5 299b081ac4925e5c331ffd9c51797a91
- SHA1 acbcf9981b119f4871875b90b18c8f971fb2eff3
- SHA512 f806be26a0ebb8e413bd65a87394a07171d4a52056be2c10ec07b10831c37a31cd7ca7de755cd54867df9a41e56f5983d607b2597bd3733611370755e4671bbe
- MD5 SHA1 SHA512
- Path C:\VidZR\optixec.exe
- Size 2.7MB
- SHA256 68b57104dc4a791eb7a1fe2a747b62d5de86fcf9f8c6d088199a71c438ce2205
- MD5 c1c24f9604b087e664dc676ce8dad26f
- SHA1 28c5f14346cce2627304c0ce4f1e5555280b9325
- SHA512 9b4184da8221047a7f5c791903cd402bd983ccfb5fabb41b41abd7df622cc043f912c3a2fad3cf733f8ee6b45972d6076d183410efa7ae724805bfd9a4897f5f
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpc4
- MD5 SHA1 SHA512 SSDEEP