Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
05/08/2024, 23:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
277829cfc63342cd4b804200155ed570N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
277829cfc63342cd4b804200155ed570N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
- Target 277829cfc63342cd4b804200155ed570N.exe
- Size 2.6MB
- Sample240805-3vbcasweqf
- SHA256 97864b05b54023e426af5c3ff111b867c7743f998a78857953d0d55b5437e5be
- MD5 277829cfc63342cd4b804200155ed570
- SHA1 837a16b365abdb87cd8c78351521bba2ed741122
- SHA512 bb51cb3aaaf3b3743104b5969fec32b08ebd9e513b2043fab5e61a307ecbdb04317010d93a5dc1b69ccd0eb9031fb5f2c8a417508d889d2d18ee2178d3adc8f0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bS:sxX7QnxrloE5dpUpsb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe 277829cfc63342cd4b804200155ed570N.exe - Executes dropped EXE 2 IoCs
pid Process 3112 locxopti.exe 4772 xoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc4I\\xoptiloc.exe" 277829cfc63342cd4b804200155ed570N.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB6C\\dobasys.exe" 277829cfc63342cd4b804200155ed570N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptiloc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277829cfc63342cd4b804200155ed570N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locxopti.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4016 277829cfc63342cd4b804200155ed570N.exe 4016 277829cfc63342cd4b804200155ed570N.exe 4016 277829cfc63342cd4b804200155ed570N.exe 4016 277829cfc63342cd4b804200155ed570N.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe 3112 locxopti.exe 3112 locxopti.exe 4772 xoptiloc.exe 4772 xoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3112 4016 277829cfc63342cd4b804200155ed570N.exe 86 PID 4016 wrote to memory of 3112 4016 277829cfc63342cd4b804200155ed570N.exe 86 PID 4016 wrote to memory of 3112 4016 277829cfc63342cd4b804200155ed570N.exe 86 PID 4016 wrote to memory of 4772 4016 277829cfc63342cd4b804200155ed570N.exe 87 PID 4016 wrote to memory of 4772 4016 277829cfc63342cd4b804200155ed570N.exe 87 PID 4016 wrote to memory of 4772 4016 277829cfc63342cd4b804200155ed570N.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\277829cfc63342cd4b804200155ed570N.exe"C:\Users\Admin\AppData\Local\Temp\277829cfc63342cd4b804200155ed570N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Intelproc4I\xoptiloc.exeC:\Intelproc4I\xoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Intelproc4I\xoptiloc.exe
- Size 2.6MB
- SHA256 fd193b2fe0094f44757b3af781da7b5c49fbb673f04c0aa3654cbea412d1718e
- MD5 5c54b3d48818978a094bf763656b6e92
- SHA1 d2039c97c6878f3f92d3d88e2f37ae482bf30533
- SHA512 1a69b2dca0dd9a55d7cb17595a85d4f94f2f1a822e91ea0237a75a8d5d74f9907dcff59365aa21746066537e01218301d8688b038717099d2d04277e01cadb9e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bS:sxX7QnxrloE5dpUp1b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB6C\dobasys.exe
- Size 6KB
- SHA256 7d956fbd2f73b9d56dbb1fa91bb438857ce1495cd868cdc6d6daea38edfcff17
- MD5 eca5ea25f6a32a95c09d2d11f140c43b
- SHA1 fc7c4ffc46b345747cc079073a62c80c129f2442
- SHA512 27d28a94c6c9d88714e07d1c5d856b348aaffe7164a680aa4aa760c4a738cf9fed9f373ea895b3dfa3e80ea1b8702679ff32bafeb7e84ada4fe30ff30b1add61
- SSDEEP 48:6BMk1Y8lp+j+nlXlnpVZlXHnznjLzrznzHTDzXT3jbU7LbL7Lb:3k1Ycg+n1FZlXnzDnznTT3jkHnH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB6C\dobasys.exe
- Size 853KB
- SHA256 482a5f82ef4227f4b69f4574a37758d1a56fe6150306dbc1e22efddb13cf982b
- MD5 e042d8b4790dfa86aface94a765fefec
- SHA1 b8844a473c158acfe6a6b3cdff92371c999efb7e
- SHA512 fc8f48defbe5496ad4c58a689e83854e24f97ba9796850eb2ff742ea34379fffafe104eb4386e64fbd117622c506db6e011bc5e1e9f05097959a6e6127677575
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSO:sxX7665YxRVplZzSO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 9d0341a2cf100e52526cb39c16f66ecaf456654d4f37a557ccf7fb779303faa1
- MD5 c7b9d276a8eb7cb01835fb7789f073a8
- SHA1 e0e6f55329080ede1a2837102e5119fd82bfcd8c
- SHA512 462b2ea5ed2c9fda7ce53cd3dd5481e410fb3b9af664ecf236cd39bfb3cd7c26dd758e1a14f004e8f5a9bb3eba12209e60871b274ff78f270c002dae1e047a20
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 174B
- SHA256 24c93671ff6ac5d4a79b06204eb0486e1ff00496a2cf2593d232b50d604eb22a
- MD5 208b1f6fe7913b57d8e0a2d53d672d82
- SHA1 c561c4e87c9bc88ac6cc52d16fafaf091d12d9b8
- SHA512 f18a306670f4362c0f45c4cb2cc96a2a968a5e48ddfdd55ad81e5ee745fd7d5f6b50cb13b1bffff3d3dd20bf2dbb98493c248cb05b0a3659eb2e0bcd5dff9998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
- Size 2.6MB
- SHA256 937559c583076009f5920e2e89d5a3f161c249c13e21d257ccbf4b4b5eecf26d
- MD5 42cdc9ea0ed3cb6910c43e5407df77fd
- SHA1 9f2c329f10bb8acddf06be9b6a9cb54f28efd276
- SHA512 a244e522775c20bb3a0d71565cdae2abd99aa9f887129ae3c8d9592c80c9d8cbda5f9af2d74b70d70daee5cdb4680dde81a93aaeb86f1efbe67b88a521e1c184
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUpPb
- MD5 SHA1 SHA512 SSDEEP