Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe
Resource
win10v2004-20240508-en
General
-
Target
2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe
-
Size
2.7MB
-
MD5
32ec9dc8f0907845adef528ebbf1b016
-
SHA1
3657a6df7fda6b556a28ef8fe70c33c39be2863c
-
SHA256
2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc
-
SHA512
b0d06f262e5144d74667cd19d7c93959a9a382d27211c2c355e3f8e6c0ca5d07ed0acbf621da150d46e178c3a1adee5695d6097b62b525c4de4ba3af7ff47e98
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBy9w4Sx:+R0pI/IQlUoMPdmpSpk4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
xoptiloc.exepid process 3952 xoptiloc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeXT\\xoptiloc.exe" 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZWW\\optixec.exe" 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exexoptiloc.exepid process 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 3952 xoptiloc.exe 3952 xoptiloc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exedescription pid process target process PID 224 wrote to memory of 3952 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe xoptiloc.exe PID 224 wrote to memory of 3952 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe xoptiloc.exe PID 224 wrote to memory of 3952 224 2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe xoptiloc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe"C:\Users\Admin\AppData\Local\Temp\2f6ee05e70af1b9d6af78d2385ad461c64cf98b995fc1b50b7d448ab4b95b5bc.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\AdobeXT\xoptiloc.exeC:\AdobeXT\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4252,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\AdobeXT\xoptiloc.exeFilesize
2.7MB
MD5dffcfe488a15569c740e3f14658b55db
SHA10a841b82439b8ecccef7e1cae7f4cad62fb72183
SHA2560f98aa7f6048afcebe4affdf78eac9d71c8bd4b3e5bc144de6feebf42e259d5d
SHA5129fbac678bc29c243e109f74bf46a72d6861dbe2247bb96b01b8854b147d9bc3df9137744b98a676051e415d5e7994c8cc1a8eed37cb84700ea7a2d5c19ce12b7
-
C:\LabZWW\optixec.exeFilesize
2.7MB
MD58415de31a5c1038ccae11c2101b3c1a2
SHA1f95a492efcaf981a718500fff25c5bed8fb19170
SHA256489d343730516c5624f5dd2e6face2a6f0d009a7996156b8c863722b065b628b
SHA512d9376564e44c338b4c586cd3b910750df3822077d2fef3019696083d20dba9049dd24fb14ccad5d81c40d3231255d0b3e6a94ef590afa21aeee13e3fd0d28287
-
C:\Users\Admin\253086396416_10.0_Admin.iniFilesize
202B
MD562b4e175e46a8e0bae34f05a75f82592
SHA16358d0d8ff32e51947a38225faf81a51e23d6bb9
SHA256c83da3d41dcadf5dc52f94beaacd5fc631337718487592641c715c46fae2e6b3
SHA512578aa918d322ccdd4430c494ff8166f52c7ac0f523c22b4d07f201173158427c86cebdf9cc541c3e1b4affdbedc6a92d8292a357026717cace15628f03783b27