Analysis
- max time kernel
119s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
21/08/2024, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a8d7f59be37f0a1d23b5e1e7f031050N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
3a8d7f59be37f0a1d23b5e1e7f031050N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
120 seconds
General
- Target 3a8d7f59be37f0a1d23b5e1e7f031050N.exe
- Size 4.1MB
- Sample240821-ps33msydrg
- SHA256 5684a1ac920717fae2a693632fde8cf42c4ba157b7a05c769e70f2fa97065cfe
- MD5 3a8d7f59be37f0a1d23b5e1e7f031050
- SHA1 983b82b1fd594ca27ac6bd96216c2167b7e342e1
- SHA512 9718b8694a1c930b3d839b190612bcb340fc78428766449d21fc9ae8632e2a3835b5800193d274ae7b155711b0336f0eefae26885160ad979278b39a13412793
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpn4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmo5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1900 aoptisys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv0Y\\aoptisys.exe" 3a8d7f59be37f0a1d23b5e1e7f031050N.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBBY\\optidevec.exe" 3a8d7f59be37f0a1d23b5e1e7f031050N.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a8d7f59be37f0a1d23b5e1e7f031050N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 1900 aoptisys.exe 1900 aoptisys.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1900 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 90 PID 2648 wrote to memory of 1900 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 90 PID 2648 wrote to memory of 1900 2648 3a8d7f59be37f0a1d23b5e1e7f031050N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a8d7f59be37f0a1d23b5e1e7f031050N.exe"C:\Users\Admin\AppData\Local\Temp\3a8d7f59be37f0a1d23b5e1e7f031050N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\SysDrv0Y\aoptisys.exeC:\SysDrv0Y\aoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBBY\optidevec.exe
- Size 95KB
- SHA256 6355ab1a78ffca052eb6a45683093a9363794e5d31bba1716105c4f69cf8f3c7
- MD5 91bf23b1f6d5ce3a63c090513c4b0906
- SHA1 be2a25d92647523d8487912558ca28737d2e590a
- SHA512 129db4c7ee18c8d8285147b5344b4bde096c0d7fdc5a01b4d7ff40bf49c6b7a6c0959f073066a982061e62e473045fa433085bdb68fee80f6c3c3a71990c96f2
- SSDEEP 1536:nD8RxTo1TKFO3H0KEZHAA5yGqwxzuPNZs5oqFyYihlVcQ8kgT:ngxTyTKI3H09ZH/5G3NZs5FFyYwakgT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv0Y\aoptisys.exe
- Size 4.1MB
- SHA256 89769611c227fe4316c298196304886031a664c6e9a46288441882d8df22a57f
- MD5 c33a148650721f7194dd27992123b958
- SHA1 edae4e7d404f610b37d272aa42231919e46eb79c
- SHA512 934a169222145cca3556d516921e29059bd6e5d4c04756a9368836e410626054b884b9db09575c63838cf5a6f0c70e5ed6a3decdfd8ec4319958141b6a36747e
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpN4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmK5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 207B
- SHA256 3f0339fbd307beefa7bfb1e7c5fa6cbe3311d9e895b1345fad8d0f8b5486f44b
- MD5 ccaa53d16b4264d37c42773f00844e29
- SHA1 6f9f4f6d0e575b5d013c67e1ccf7eeefb33ded89
- SHA512 fc55243f0318d28963ef79a101c488e2558a0b6d7e5d5066285dfcb7806f38ff436febea14b0f14838765d0c7546fdb4c0b03e5dae28760e22e0eb3511c46430
- MD5 SHA1 SHA512