Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
18/08/2024, 22:25
General
-
Target
4988649ba96b880285e77e05407502b0N.exe
-
Size
2.6MB
-
MD5
4988649ba96b880285e77e05407502b0
-
SHA1
a032870f28a68ea284980cd59d43c93d7af44406
-
SHA256
7e86a9d732e9c0f0031608545b1961f9f34e69a646cda0199f21a5cfe46e1572
-
SHA512
a8c7f2225b1cf7efab145ff36a35808ea40ca51b0ac196849acebd4f9299e51864a8dd7c7cb3c78ecfb8349ca921ec2a3d1bba88ab7307531dd23c46b142b7be
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bS:sxX7QnxrloE5dpUp6b
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4988649ba96b880285e77e05407502b0N.exe"C:\Users\Admin\AppData\Local\Temp\4988649ba96b880285e77e05407502b0N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\FilesOV\xoptisys.exeC:\FilesOV\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD56410b24343235e8aabd4498e0527c77f
SHA1b82ec52900ebcc111c640a3d56f8d39d832496b0
SHA256982db565a7411113e0cfa92ea187f27fe2cbbcf5e2015d24e66127015a8c2b14
SHA512171f47a937bb31dba89dbfa5b0e1684106226e84b4f4b022c28392ef6153c812aa4c1dfae8e5097fa0082f17c0e1b5ce1fa618e8a9f190bc7800f2b26b904f63
-
Filesize
2.6MB
MD559a1fc599ad9600441602e7448a0aae1
SHA1faeb3b0a781c402f8e884b1d2f906e05e501fdf0
SHA256090f35290cc32bda7a6581f48c6270462a61ac62159192f5ddbab4366bfc76ed
SHA512571c1ec9cb4e1baa66557ec6cbe41734b7005b9ca1d0740c928e9b178c77e3bf509fdd3f910a5489fc985bc5edf949274ba4f93aa7ea1fce080de0a8dbf346f4
-
Filesize
72KB
MD5459618bcca750b5533666c7585e055b6
SHA16202619d112878a1bdf8014a2e696dea9752e00f
SHA256957265a8f281496de3480f04bbfb3a1761a968dfa4e3db5c51a5fdbffc90bf9a
SHA5129b436fdfa54f87123149c7209f9dbe92f1c4526c46d1d5a39762e96ef0a37835eb05478e6c37721ec1a1551e738149d352f9e678739621b0179fa5783ad0e1c2
-
Filesize
170B
MD56036a634f14ddb4116a1c5d10b68142a
SHA149bf72bd0e62c28b62a574d3adb60eb7a6e6dc52
SHA2562df8bae296f07352ca6282a9079b7c0f9ae00fc828edc761f0f74d1ac44ae4ce
SHA51238b5bc081eacd3b90c355ea28e254482ff15c53e51d4587899d4725aa8ba4c1d5eb84ae2887d52743371fb9fcba8c0115174b54924c8c6f74b4a97378050757e
-
Filesize
202B
MD59093a76a99da9968f9cc019ec618755b
SHA17f486948327097112637df55091f4a6f56f99d24
SHA25610ced686f0034f5f4438365be72fe1c65017cf6b80a388f0e6d6826dc8e304e8
SHA512b0415d60aabacee8c8f5712330872018705fd139f25df55674e35ef80eaaf2a2f4d9a3cd0e04d2686237f5b79c21bf9810afbbc5983ad154c3b724e9bc0117eb
-
Filesize
2.6MB
MD5b35bb2be1b8ad1a72dbb312094dd1e91
SHA12a201b04bbc68ababb51730333884cab5cce43c7
SHA256ea45f1d966362a99b54f3624ce2c1411f861f1686fcbb6827685903c120e255a
SHA512a2bb1b5a12661287623a700f7904baf1decdd687ef692c9386a46b0b1e86af1e8819e7bcd0b9e1544311d6cb98cf9f9ae541f6db113006bd14c849870152137f