9ba0eed830b8b0aeee27ad598d2c260c97b96255961f21a8b3a65deeb7023a6e

General

Target

7e02d382dee84a0293ef5963de225a60N.exe
Size

2.6MB
MD5

7e02d382dee84a0293ef5963de225a60
SHA1

aa2bba7c9acce55472b87205d60d0840e21bb761
SHA256

9ba0eed830b8b0aeee27ad598d2c260c97b96255961f21a8b3a65deeb7023a6e
SHA512

88b40cd0e2e93e20ee78889d1a5d591a06af92e0d7ecaacef745e624945a3e3db47196754dfde4b2fc1da16fbc76d21099d437153633e9deb7701f60196951c7
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bS:sxX7QnxrloE5dpUpKb

Score

9^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Drops startup file 1 IoCs

Processes:

7e02d382dee84a0293ef5963de225a60N.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe	7e02d382dee84a0293ef5963de225a60N.exe

Executes dropped EXE 2 IoCs

Processes:

ecxdob.exeabodloc.exe

pid process

4844 ecxdob.exe
1268 abodloc.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4844	ecxdob.exe
1268	abodloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7e02d382dee84a0293ef5963de225a60N.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvGH\\abodloc.exe"	7e02d382dee84a0293ef5963de225a60N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax4X\\optiasys.exe"	7e02d382dee84a0293ef5963de225a60N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7e02d382dee84a0293ef5963de225a60N.exeecxdob.exeabodloc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e02d382dee84a0293ef5963de225a60N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxdob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abodloc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7e02d382dee84a0293ef5963de225a60N.exeecxdob.exeabodloc.exe

pid	process
656	7e02d382dee84a0293ef5963de225a60N.exe
656	7e02d382dee84a0293ef5963de225a60N.exe
656	7e02d382dee84a0293ef5963de225a60N.exe
656	7e02d382dee84a0293ef5963de225a60N.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe
4844	ecxdob.exe
4844	ecxdob.exe
1268	abodloc.exe
1268	abodloc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7e02d382dee84a0293ef5963de225a60N.exe

description	pid	process	target process
PID 656 wrote to memory of 4844	656	7e02d382dee84a0293ef5963de225a60N.exe	ecxdob.exe
PID 656 wrote to memory of 4844	656	7e02d382dee84a0293ef5963de225a60N.exe	ecxdob.exe
PID 656 wrote to memory of 4844	656	7e02d382dee84a0293ef5963de225a60N.exe	ecxdob.exe
PID 656 wrote to memory of 1268	656	7e02d382dee84a0293ef5963de225a60N.exe	abodloc.exe
PID 656 wrote to memory of 1268	656	7e02d382dee84a0293ef5963de225a60N.exe	abodloc.exe
PID 656 wrote to memory of 1268	656	7e02d382dee84a0293ef5963de225a60N.exe	abodloc.exe

C:\Users\Admin\AppData\Local\Temp\7e02d382dee84a0293ef5963de225a60N.exe
"C:\Users\Admin\AppData\Local\Temp\7e02d382dee84a0293ef5963de225a60N.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4844

C:\SysDrvGH\abodloc.exe
C:\SysDrvGH\abodloc.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Galax4X\optiasys.exe

Filesize
2.6MB

MD5
299574ae795713a87fda9242e39a91c3

SHA1
4b8a50d450971c182f7a39e3bb01d5ef8db6e01d

SHA256
ce3ed5f16eb2ad352ccd7f82afea80f41af9f53f230f5237635729ae922e5d81

SHA512
3ec0d3a64bb422014db1dcfda003e6f429add3c0fbb184fa24ff518067f00f97df0cd50d7f75b05a3165e93d5974131e8d66492a11150e79cd106eee98fbc7f0

Download Submit
C:\Galax4X\optiasys.exe

Filesize
2KB

MD5
d0c1cfb1bc751f796263e7f6ddb68f7b

SHA1
e35ef7c594cb6baa90f3b77146b71e296e56c4e9

SHA256
1a6c015cd3f38350b98a4f16e42869a081c8c2b12faf73546f606cb722413f4a

SHA512
cae3f67e99cde353b575ad9336db1f03f0a932d3a54e204190c32c3ac66e11ce387b2173bee5874627fd1c416b95406b774b630d0f3a6fd4b69f5987598a54cf

Download Submit
C:\SysDrvGH\abodloc.exe

Filesize
2.6MB

MD5
ae3712ec4f0952edcda1e62812d13538

SHA1
15e87dc228a4567241b71f7e0c43e57e9647377b

SHA256
fc2f9f664ff98be1363a46d1c606bafe4cf2fc0ed468c7a66c048e9ea04956c1

SHA512
9accc524b66e18be58186f06d5525ffec66db2fe1b0bb8a15fd893fbdc56a57ab3ff182e7bfdc4b7a4430ba186e126ad2d0291859783f4ab5c3ed7b70c60ee1a

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
202B

MD5
99a20c320060b654a7d4715587b77b23

SHA1
c7a29c481f392da50a08a658bb5a413b1ceca8c9

SHA256
3fc0aee7a5816dfa745bcbf5cadbe9aa8c3b45d4951357ed93059be57412c637

SHA512
e81ab6bc12c02499ec376cf9f289b7cfc9ba1812acbb3873fe3c5bec5e52a7ff9ded5cf247cc23738db04e5122167f04b461fc1ff52fcd6adb11bc0471a111ef

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
170B

MD5
0bf4cb912a4f3618779c191cbb09f27c

SHA1
5cc6bc4d62c7d77351c72af511f5796612f8844f

SHA256
1a0ed9056f11065774b2228374024f4ebf090bc6c96d2467468448f678646679

SHA512
b1fb21ffe8bc246afad039c2e895a52d4b7ea9e6fea36b7307ccd30430c71f1bc3b6c6b70d2947f31ce1e7f0031d74643b38daabe14716b7aca1f6b2644c786c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe

Filesize
2.6MB

MD5
eca56588d6e31bb7e0a5176db8626b5d

SHA1
99b5ae48a6d3fec0275b52245f60ba2014e7daea

SHA256
c61497a59d99f13e13c66cd7250d2b2e919f5371b83f3553e7f7031aaca22baf

SHA512
4e02bdab4fbca56f2bd31a91ce5ce51e0f31695035369a743c62c49c787dff0fd4bfc862a5f6cc7ca5cf5ddbb509095d647cd603613f2a099ca729738f97563d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads