Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:05
Static task
static1
Behavioral task
behavioral1
Sample
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe
Resource
win10v2004-20240709-en
General
-
Target
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe
-
Size
3.2MB
-
MD5
4162ddf5275af7929f36bb4f04a80ede
-
SHA1
20b1c07822775fd6523d2b876d940d76aed79b5f
-
SHA256
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49
-
SHA512
dfab67b475476723478145be8f3faa7907004b173e798e46d74448e1ca0fad8885695942ab1f059de26abcff15ec7d2e730779ec085e972b30d66320a0c70d90
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpHbVz8eLFcz
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe -
Executes dropped EXE 2 IoCs
Processes:
locxbod.exedevoptisys.exepid process 2128 locxbod.exe 1936 devoptisys.exe -
Loads dropped DLL 2 IoCs
Processes:
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exepid process 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvI7\\devoptisys.exe" 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintRN\\bodxloc.exe" 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exelocxbod.exedevoptisys.exepid process 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe 2128 locxbod.exe 1936 devoptisys.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exedescription pid process target process PID 1472 wrote to memory of 2128 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe locxbod.exe PID 1472 wrote to memory of 2128 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe locxbod.exe PID 1472 wrote to memory of 2128 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe locxbod.exe PID 1472 wrote to memory of 2128 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe locxbod.exe PID 1472 wrote to memory of 1936 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe devoptisys.exe PID 1472 wrote to memory of 1936 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe devoptisys.exe PID 1472 wrote to memory of 1936 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe devoptisys.exe PID 1472 wrote to memory of 1936 1472 3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe devoptisys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe"C:\Users\Admin\AppData\Local\Temp\3455b0b6874da6c84d72d1500a2f77fa6137a04cdce926687ea7c0bf6f0c8a49.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2128 -
C:\SysDrvI7\devoptisys.exeC:\SysDrvI7\devoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5d13a4b76a17b7e9380ff2a2df3b3e03d
SHA1b675595279066c853ba487ed61886581f8ab1acd
SHA25669418f1769a9b73c0821421f4e725873f3421d84077969c12b7fb3b851da7414
SHA512766e1074f05eda91ab8c0607e4a79dad0953bea04607e7078bf25ac7b6d588db37083c0836758be7720960c359f243937379801ea62f83c45227186d0e5b339e
-
Filesize
3.2MB
MD5845ea76fae4644e301a0c8f392f31b74
SHA1f1071f58de831e606b159a9a6f141f27f1b2ea94
SHA2569628e9d64466505901eeed3c09756927400a98cec11c315983206ae0c7046a1c
SHA512a50440a3c65b09fee9e8af23362702697c2ae6fa5add26d13e3286bfae7217edbd50a728824244a66302b73e1f088ee57c46d9db8b4229355d7d82568f397601
-
Filesize
3.2MB
MD5950aac5f02593b60a7acc39303c0a0f0
SHA1d9de9aca942392b2bf68544cfcbba5d202071b7d
SHA256460e43aaae85fd18c8f8de8aa7dcee9696ba21d7572045daf21ff1debbe05094
SHA5128f54677a981dde0971fcdca20d93ed2fdf307739efa9a0ed7beb507920d3167b19f9f5595841738fe66cf0733832c05363f69cbafea069cea3dd9caebb688b83
-
Filesize
172B
MD5a620defe2c7980e403ecafb437b982a7
SHA152cc8f7d8323a8b39af7ae67876a750f54686689
SHA256fe1997d4e4fcae3047c6637d53005fdbf96c437191b3a5452d0843e7bfa9bdba
SHA512465a37f0b22560263fc2f0bdc58aadae46846b2df2874fc75bf764eb2a9315e094f5ad084e5a123589370830ae9edb47dad28fa12547d8797ac5cf338d17253d
-
Filesize
204B
MD5fc1ee109de6bfdd2f182665d82872681
SHA166a7bba26b363efdf9a1f6df2e5b9b22a037b345
SHA256291280ae7678bd32faf368e533d68c2a3ebf4d5b6b37c92be3794bb2e28b84db
SHA512de3841bc83a15dc9de7548fab56cbbe769d613246d23c2a6609ab0bbdfb02543c63393f28f6c84bccda65a3f297c249734a1d9048d9b6fbcdbfadae7e0cfa6bc
-
Filesize
3.2MB
MD50234666b88fbe09b0304699c1075fe58
SHA17bb526d5a778e07d25f8b72e5c65eba16f1e8b1d
SHA256c8f600813ace316c35ee651c985a4e39cbf9cf9c036879633774d8c0f3f7e4a7
SHA512a4477b6371a38635ce2e3bdef373a6622554807642ac023f073dc295933e419504683a5d3fa79d09878e631058177e9659d487d4b269a529ba471bcec6fb02cc