e2cadb0766cf2fc20a527c917f4475388ef3fbd73b8e0c6d071b695afbb1dba3

Resubmissions

04-07-2024 17:22

240704-vxyavazeql 10

04-07-2024 17:19

240704-vv7rhazenr 10

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
Size

2.6MB
MD5

6a1fe8f4fbbc726b6ee093b2688a33a6
SHA1

90259529d74b39d95a10c57d175622662f880295
SHA256

4b48bb56e58eb299e508228e91dbc466ac1fc5948e5975d400b89dca0e1c334b
SHA512

3a478f2d252f1203e173f0e5ff138ad1efd10b01cac22f3fab8d38895d4c767fd57f6fa9443f254e362e636f2ea12d914fbcb2db0f4b54f3e89ca58bc45720eb
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBZ9w4Se:+R0pI/IQlUoMPdmpSpR4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	devoptiec.exe

Loads dropped DLL 1 IoCs

pid	Process
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesTW\\devoptiec.exe"	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxS8\\optixsys.exe"	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
2028	devoptiec.exe
1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2028	1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe	28
PID 1008 wrote to memory of 2028	1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe	28
PID 1008 wrote to memory of 2028	1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe	28
PID 1008 wrote to memory of 2028	1008	[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe	28

C:\Users\Admin\AppData\Local\Temp\[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe
"C:\Users\Admin\AppData\Local\Temp\[DemonArchives]6a1fe8f4fbbc726b6ee093b2688a33a6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1008
- C:\FilesTW\devoptiec.exe
  C:\FilesTW\devoptiec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxS8\optixsys.exe

Filesize
2.6MB

MD5
7a9cd892eaa401cf4a056ef100c29fca

SHA1
b48cd571d5b5e161a280c5444ef781db28fc633f

SHA256
ee48a33ece0260c99a884299ecfd6fcc48aec3061f1bd33c0e6bf79e96d9ceec

SHA512
2e8b13aa40c575f63765f017d1a8670eff029bb60d3a7fbeccf8b8aca49a029de8b4ab010cb9388e7fe2792cc5e39d58b6453d706cb097235c4756689e5060d1

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
205B

MD5
49232c917b6af846c4be6d4bf598657b

SHA1
080ef63542e657903a61e21993a6dcd1300cf8bf

SHA256
23b1d9932ac0c6d587f06a1a797f88ae6c4eb3a3fa09742a4bc49789e38968a1

SHA512
ff475be70ccc7c982991bc37286181c99f01b17bc7c2f4b212382fc12e30feb7bb9c0a31a153150d08c9c47cb89871c2ecb5e648437f820162da83912f35de20

Download Submit
\FilesTW\devoptiec.exe

Filesize
2.6MB

MD5
e6750ce34eeeb06a899b18485c97f4d5

SHA1
9e6a0be7586f854a8c46ef9540ff7e945e5ae45a

SHA256
9bd101ce9b9c7ef0b883adaadd7a0d48109687a2803c48bd730c52cf859f3999

SHA512
0f412acb47505a1bb1aaf2669d7bdbaa3c0a55ece1f2e01f43f5a02ed6b6cd22da7d7111ac97e4540038f5d3886e60447eb6e7d4b78dadb0e775edd5c7571aac

Download Submit