Analysis
- max time kernel
133s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe
- Size 2.7MB
- Sample240610-d4lrysbf2z
- SHA256 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22
- MD5 66d3a06bd1eec601f0c67601171af8cc
- SHA1 7b31ed32922f0de36df1e5c43f7f6fc24b1eb455
- SHA512 e6128f17ea29834003e06a7a37827329e698f5a7f6ece1de19e694f5081798724a94a79a5de2a576a44b7c16b401ed45d47a45a21ccc00f9e70b3132a83db4d7
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBT9w4Sx:+R0pI/IQlUoMPdmpSpP4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3056 aoptisys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesOH\\aoptisys.exe" ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB8R\\dobdevec.exe" ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 3056 aoptisys.exe 3056 aoptisys.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4264 wrote to memory of 3056 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 86 PID 4264 wrote to memory of 3056 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 86 PID 4264 wrote to memory of 3056 4264 ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe"C:\Users\Admin\AppData\Local\Temp\ce26e62bffbe628e371225b65a8bebe6d7499f378e937fbf54836a76631b9f22.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\FilesOH\aoptisys.exeC:\FilesOH\aoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesOH\aoptisys.exe
- Size 2.7MB
- SHA256 324742c24ee238efdc6f71818d43d29bc6bfedcbaea63f0211319581ba9df85b
- MD5 1e5a6e059bb93d0317d9c1e58d70be27
- SHA1 2538f5a80818c44f03bbdf9defde2b4aedf88514
- SHA512 4bdc7ffc7bf619892f5ca72928d91abe04ae04bbe628614587dc01995084550349f06c631cb20cf63cf7d5f274cb8308e1ea3769fa26c89e338eaa7fa7567a95
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBU9w4Sx:+R0pI/IQlUoMPdmpSpG4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB8R\dobdevec.exe
- Size 759KB
- SHA256 1300ca31571d051d1d3f641136106e39d8d322942a2b3713518dd1e26f3f3f69
- MD5 07c092f5bbd56c78d75bf8d36775840b
- SHA1 0804fba92bae34c8d5e523e04a33b99a8257bcb2
- SHA512 55bec2016037d18c72fa42e9cb67f260fc99812850a3367d5c7611110603876e07a7960549d735a6f99570ecb05f1283edab09ff1224686875530c7ffb2f54a1
- SSDEEP 12288:n+e3H0j/4cFSakgnCf8xCD/8xmlBLaXPATazr4ekzDlYFWtN7E/N806pQ9l6e:+RjQgSjgCf8xC78xmlVaXPATazr4eoD8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 bbc1a73739e2f2e640e9fe7dc05f25844076be55c5600a4ce04224e5a777c9a7
- MD5 5fb56aa8ac7c4c2cd3f0e34e39edade2
- SHA1 4b31cd0c08fea9a0a414d49843f9c3ce7747f462
- SHA512 f632ca407d534fad78eeb8012b6650f49814513403f1ddb6c82a8aff0a8425d7f049f39301b972b398030fd51a46b221936c56d86296e98ab41cfb8482404f38
- MD5 SHA1 SHA512