86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
Size

3.0MB
MD5

da5bb53f6741213abe8f596ded7f5530
SHA1

fcc2e1a8953d9c1ec70c2cb205999090f581d0d9
SHA256

86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea
SHA512

2d449357c1a9299e14be8bff678cbc7cb3c9ac6a8c9ebf62dffa0be66242025bb33036308780e1387ecee7b068941aa71fcc4dc422513efeda01180a6e20fe97
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bSqz8b6LNX:sxX7QnxrloE5dpUpnbVz8eLF

Score

9^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe

Executes dropped EXE 2 IoCs

pid	Process
3016	locxdob.exe
4424	aoptiloc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv9A\\aoptiloc.exe"	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxN6\\optiasys.exe"	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	locxdob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aoptiloc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe
3016	locxdob.exe
3016	locxdob.exe
4424	aoptiloc.exe
4424	aoptiloc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3016	2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe	90
PID 2972 wrote to memory of 3016	2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe	90
PID 2972 wrote to memory of 3016	2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe	90
PID 2972 wrote to memory of 4424	2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe	93
PID 2972 wrote to memory of 4424	2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe	93
PID 2972 wrote to memory of 4424	2972	86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe	93

C:\Users\Admin\AppData\Local\Temp\86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe
"C:\Users\Admin\AppData\Local\Temp\86aa45430a4510bf0704d1f5ed7da4897af77d35c74d3898bd240b706a2a6dea.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\SysDrv9A\aoptiloc.exe
  C:\SysDrv9A\aoptiloc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxN6\optiasys.exe

Filesize
3.0MB

MD5
631381967754bd7e3c24ae7f17908847

SHA1
0f1228355ca5de4228646f67eedc31c6f8aac7f9

SHA256
e1c5fd30d5e933523d472009de2988f6c4e5794c0ffd8f90efd2fd7f7daa1992

SHA512
6624d4913383818650cd866e94096ab761d8baacd1bd6ac45fb19f0efe50b4410b5196660f5ca703acc849badb5c4818f2fc9440cf4a0692a8fdafd95ff6b202

Download Submit
C:\GalaxN6\optiasys.exe

Filesize
3.0MB

MD5
55c7253c621027ed7de9c512993442d5

SHA1
9742b8c324a42c8df00794b4f0f1c864b60a234f

SHA256
4503bcc670daec449c82744bdcda77b823aa658e507c60228fa839c7b5cae0e6

SHA512
182b9e8541138a6c8715756a381f3dbf816357a4b1bbe31ddd4b7a9c15730b0319f53c6837a87e2d4d50a9c77ac1feb4ffa44ac29a6d0c073cef18529be583f3

Download Submit
C:\SysDrv9A\aoptiloc.exe

Filesize
3.0MB

MD5
2ddf68830b280d1562abb09f5904390a

SHA1
69cc9cff14bb4a3bce2e2f3b140ed84dff32db3b

SHA256
e455afd4a739521a54ff25074348288bfccc74f2e8d901d8d8d5a39503ca210c

SHA512
a0b8ff32a923a9ee13bc5f2870cdf31618b1c40ecc49e8d928d81345564151355e9dc24da3f05abb25d040dc94dba7ae4b72b16e19001240b5b8175c3e36f902

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
05afe675125f9f9b1fd2ee7be59c4f66

SHA1
1519d8e2add162c59c83f3760cac5b0d71f3f523

SHA256
f6f02bae0f87880838e2bf4608a7d45827d6657752c25083ce2be9ce00928a28

SHA512
0e96b497a92daec63a6e64994d3204b43293952e4575ca744ead5ebe0f22d9fb328ec87cba999f9bd35109d22fcb5d3d012fcdafd7844433d311d91bbac4c9e2

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
172B

MD5
379979e5854b2cef7ca60dd2aa698dc6

SHA1
38b6034487f7b453009872400d10f7a09f402350

SHA256
f7cf5e73d8c739deebda1b9fc96da3a841e3efbb3aac8d136cf621c098e3ffd5

SHA512
dfaa8581ab06d21589b534269e39dd7bc3e581c9bd4e5a74569d04f5579103b9b58dc7dc102e303c6a8e722825dc835be9e80d6c5342a1c32a5b46687b1c59c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe

Filesize
3.0MB

MD5
e2033c2e3a777142ced7c9dd6ef307b1

SHA1
8317bb7e678770ef57082f1895182dd72c7a82b5

SHA256
2c53484883373cc7db430929bce7917e8829c0df9e451c6cac10e106dfd64ed1

SHA512
f019162e48e1aabcb8926f0c564a7ce4fe196096eabbba09cd62fa23022b0c435e8a45c866843568d12a25b4cd7251215c8312b587dd0d524166e0d9e4021326

Download Submit