b267b2a338da99999f1ecbd1d7dfc6b54a1b1e57d73598af59e82b291711231f

Analysis

max time kernel
119s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29df7206baa60d862e4454e81e36edc0N.exe
Size

2.6MB
MD5

29df7206baa60d862e4454e81e36edc0
SHA1

3f59ee5953ee7542fd5ca6ecff8eedb33a804cd5
SHA256

b267b2a338da99999f1ecbd1d7dfc6b54a1b1e57d73598af59e82b291711231f
SHA512

76e90954800754849f8d549ee214971244af967bb58d4d176b5ffb4bccc390a790e20ee6c1b146b953157785b7d779ab498fe3a53853f6aec43aec3b2f4de087
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bS:sxX7QnxrloE5dpUpHb

Score

9^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe	29df7206baa60d862e4454e81e36edc0N.exe

Executes dropped EXE 2 IoCs

pid	Process
2640	sysxopti.exe
2924	abodloc.exe

Loads dropped DLL 2 IoCs

pid	Process
2868	29df7206baa60d862e4454e81e36edc0N.exe
2868	29df7206baa60d862e4454e81e36edc0N.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvQ9\\abodloc.exe"	29df7206baa60d862e4454e81e36edc0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintW4\\bodasys.exe"	29df7206baa60d862e4454e81e36edc0N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29df7206baa60d862e4454e81e36edc0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysxopti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abodloc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	29df7206baa60d862e4454e81e36edc0N.exe
2868	29df7206baa60d862e4454e81e36edc0N.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe
2640	sysxopti.exe
2924	abodloc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2640	2868	29df7206baa60d862e4454e81e36edc0N.exe	30
PID 2868 wrote to memory of 2640	2868	29df7206baa60d862e4454e81e36edc0N.exe	30
PID 2868 wrote to memory of 2640	2868	29df7206baa60d862e4454e81e36edc0N.exe	30
PID 2868 wrote to memory of 2640	2868	29df7206baa60d862e4454e81e36edc0N.exe	30
PID 2868 wrote to memory of 2924	2868	29df7206baa60d862e4454e81e36edc0N.exe	31
PID 2868 wrote to memory of 2924	2868	29df7206baa60d862e4454e81e36edc0N.exe	31
PID 2868 wrote to memory of 2924	2868	29df7206baa60d862e4454e81e36edc0N.exe	31
PID 2868 wrote to memory of 2924	2868	29df7206baa60d862e4454e81e36edc0N.exe	31

C:\Users\Admin\AppData\Local\Temp\29df7206baa60d862e4454e81e36edc0N.exe
"C:\Users\Admin\AppData\Local\Temp\29df7206baa60d862e4454e81e36edc0N.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\SysDrvQ9\abodloc.exe
  C:\SysDrvQ9\abodloc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintW4\bodasys.exe

Filesize
2.6MB

MD5
67bf00ea4bc9428fed1d191b4733ece5

SHA1
6cc7f205628ef33ff27e0f5bcf9fbd5b36bf2f3d

SHA256
042ac84f1a4d3cf637609a0203c7d936ff2584fd5ad8567b7d4c375df78a8c17

SHA512
4ba36f8f84738af8e2b6125edcd6436b3634f3a480ee6d331e70fc2aaf2d946186d2b61b0997555dd9145fcf4c8513a5db8fac39031df4262072638eff613fc5

Download Submit
C:\SysDrvQ9\abodloc.exe

Filesize
2.6MB

MD5
41cea1673e7d3f200bb8dc21c16583e9

SHA1
0c5e8af6c0bba9a7733bb6b7fb90f98a4f13cf94

SHA256
d5c4713968e68f63e6933d144a3e0fa082b13b136b5084c6905799f66fbee951

SHA512
38ab9b72ac2663873252d0fc2a2af62b1a904250b18e761ecd1f6955d751a981ef5775407f0f1cb433e814a7db713e228015505b2df5d4f8be5a9ce20ccc0b46

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
170B

MD5
9fc5aa1da02092655f3a7d3cd9bcf21c

SHA1
a429f60450303213f6c99c67d6b584b6d2e582ce

SHA256
388c589156df61ca51d3f9b6ba4d9139ef0bb652f9035afb868891b0826d155f

SHA512
fb5977dcf8dbed9af3615ed4fd78b23214f1faa9260855cc4d5c0a08424bc8bae6c132cb8295e428cc8499cabd839b7662509a4ecfb016f82cc2a47ebb1a874b

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
202B

MD5
639bce9f6e94035d6e6304b709e8caac

SHA1
248ca306787ee89951f7ff5a94aff3ace16ef3fa

SHA256
d8348033f555cee4ac095cc58dfa3776f348b067a4d912a47bbdc0dc3317982d

SHA512
f227bb1cafed8fcf0240d5082826bc3ccafd73cb29d0a67ceda584fe9af5d5e282b241252665129101262bd29df9be489fb890f75c9189e00061415180473539

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe

Filesize
2.6MB

MD5
c451c629aba2143326dfca0adb7c5071

SHA1
757b5d90080d1deadd8be1c072765f9ca7409a69

SHA256
26c60f7aae687fe3ef49a04edd610fc85a19f13e4ec841a578c11461fe195cc8

SHA512
96b01c8d1568d3e63ec75b57297e081ca16643ed61c72e686d9ca42c85844c401daabec949c2fb7dcda334736ad9abb80250b098327bcfef87b4200449e68185

Download Submit