Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe
- Size 3.1MB
- Sample240609-jbt6hsff2t
- SHA256 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7
- MD5 5da0f1da2a60a0eb4d59962fb8a71f25
- SHA1 d1ea6745f8fbb0dd66aa25532a46158706564fb1
- SHA512 ddcbaebf0c7b750ee4f4f74c5021e4a812181b7c1f1a4a6679f6ff0df8f919da8cd64a95bb75107d401f6e32e94bf84c94ee145c71be78c46678bd0cce0398c5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpsbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe - Executes dropped EXE 2 IoCs
pid Process 1968 sysdevdob.exe 1600 aoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot7T\\aoptiloc.exe" b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidLN\\boddevsys.exe" b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe 1968 sysdevdob.exe 1968 sysdevdob.exe 1600 aoptiloc.exe 1600 aoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4064 wrote to memory of 1968 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 85 PID 4064 wrote to memory of 1968 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 85 PID 4064 wrote to memory of 1968 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 85 PID 4064 wrote to memory of 1600 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 88 PID 4064 wrote to memory of 1600 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 88 PID 4064 wrote to memory of 1600 4064 b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe"C:\Users\Admin\AppData\Local\Temp\b773127fd0d94ceca77a37e620ba3489ceaac2792275c18da9bdce352c3e09f7.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
C:\UserDot7T\aoptiloc.exeC:\UserDot7T\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDot7T\aoptiloc.exe
- Size 3.1MB
- SHA256 aa5b4e79274427648db452430fd11565f7530a648fa36b8c8d4c1dc1fa02cbf4
- MD5 a8327859a4cbf8087e97ae23108aba7f
- SHA1 fe5f4481c62c3bfacbbb7b1c770a31361b550fcc
- SHA512 0aec370e4042046a57d9b954a76d42d037b8a5885b7e5986e82c0a9a78a51b6b053b39040ad6b694a58a94666a96f304ebd22edc2df9b0a3ea81820a5c5b6ca6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBzB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpgbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 95510a29051c7512fad7fe69431f0ad0db25de881adf40a52ce64e512058dd10
- MD5 07cc16bea8741ff47f5e332d83bf0b95
- SHA1 7287875ad4048e40c6805d327f2ea1baeae24283
- SHA512 abd29bf222f7ea31e2c36eae88f42004d793c92142dbe65cc35978ab6197820707e6dcda2eba5803123c226226329d28117601c524c7429526dbc5ca9cf4877a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 174B
- SHA256 de7af9d4c0f48c40a34c621599a18e311252b99376dce87bfa172b39db15e108
- MD5 f7ef8f6e47df90834f01cdb43779d319
- SHA1 b827a34a50b8fe2cf6be9badd8ba64471a465dd5
- SHA512 595cb0a3addfd169b7d82b08d4a3a529cbcddcdd5e84d020bbcb334d4d67463fcfc8ca9d0822dc2743fde8e7d21da73765e7201f47969ba6eae75b6dacf4b0be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 3.1MB
- SHA256 6bf633ed89b45318266767c2c832a6179cf0e87154ed63c39c482597b0e86d73
- MD5 f84c0e12497a0e9e5c5f2e27f03e9c6a
- SHA1 a91a15abf93dd243edab4675e0b666201962deba
- SHA512 cb96a480dd3048291a76b6a06fa53ee1d5143b0ca8e2cb3c66f56a7afb96b760b13ebb0c40d156756476c50be3424b76b1bf8d1ab66858825dbcd42f4dc0d688
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpwbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidLN\boddevsys.exe
- Size 3.1MB
- SHA256 51195c5ecb6e3772e0485bc5db1a5dc28a6dc8fb21b3bf35771c68476f53a3cb
- MD5 f42146496850a8717b93cf749914e91e
- SHA1 8e82cb0c69167f48b8594ff70abc58f41dbcf131
- SHA512 915003277d8ddfccb6135bb7392230f72e753be9a761c4a3ab450ac3e5519de2887bb4cc16e160e1d570404b5c9beba4c58a31eecbfb19d01c52d35071279743
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpHbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidLN\boddevsys.exe
- Size 11KB
- SHA256 e09faa78045b943266c903ad6e7b69a1069ca062bfda7c5f794f8e9e7eb9ad9b
- MD5 3193f6732970f64ca3094d85171d7380
- SHA1 0d2f450337cb69eafa727d6d6de40feb0750ba1d
- SHA512 b23afd97dc8f9fe6ddb53b3a780345bde4ea50f989055db34d69d243649f4b7cb2c2c4429e9fa318a396fe363aaa923f2c261ba475390673664ac4fda7c5b3f8
- SSDEEP 96:3k1Ycg+n1FZlXnzDnznTT3jkHnHO1n9dn9FhXYitdWYeFn8PM/EKRd9pPUEBbo:0fgezXzDzjUHK9d9/XYxFn8E/ES76L
- MD5 SHA1 SHA512 SSDEEP