Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe
- Size 2.6MB
- Sample240825-jd3wfavall
- SHA256 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36
- MD5 177bc717d1047ca5c787e330fcf18555
- SHA1 dcd707f87c9963871ebe50f7bf5d8c86c5f15aa4
- SHA512 6903645ba8ec0c0651e916c21d9c734e19dca20783ce2fd45a09a487f277806ebb2a3c1705a962703feecf233f314c3616faf553f42b067b4dcb02ed351981c3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bS:sxX7QnxrloE5dpUp3b
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe - Executes dropped EXE 2 IoCs
pid Process 376 sysadob.exe 1308 xoptisys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotOB\\xoptisys.exe" fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax5I\\optidevsys.exe" fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe 376 sysadob.exe 376 sysadob.exe 1308 xoptisys.exe 1308 xoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 208 wrote to memory of 376 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 89 PID 208 wrote to memory of 376 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 89 PID 208 wrote to memory of 376 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 89 PID 208 wrote to memory of 1308 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 91 PID 208 wrote to memory of 1308 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 91 PID 208 wrote to memory of 1308 208 fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe"C:\Users\Admin\AppData\Local\Temp\fd9e680859241b7422d50516deb739b7d4beab9d4c9c4aac394485c9ab43bd36.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:376
-
-
C:\UserDotOB\xoptisys.exeC:\UserDotOB\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Galax5I\optidevsys.exe
- Size 2.6MB
- SHA256 6d33f1ac85bf1104b06b204f324ab6fb40c6bc63a77edf329ad548a1aa90a5fc
- MD5 a25e5a1fd1e66ee461d993396692c1b8
- SHA1 cea74361fb81e8d2c79ab6bc893e8dfa6e6f6f1d
- SHA512 31f8103c452b17079fd1837ad835133c3af0a7ae5470186968596e1cfde762f39a31a829ffc98cb1a1deabfe8f48b14cc6b23122726971c3707243f3bae471a7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bS:sxX7QnxrloE5dpUpFb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax5I\optidevsys.exe
- Size 2.6MB
- SHA256 0b48b0cc5c5d9f9c344fd6ad131a0b883b2ae53802a08f55a99684a31967b714
- MD5 ea46f1e21d518614e293c6b411c28184
- SHA1 2de66ae0fc64d8fcc201253b44ba36a2bdee73e0
- SHA512 b6c3efefc573c5fd1e8092ec8f2cc151daab9293a9ebce0149c5163587733a12a91c8d38db96d54953f413ec5ed928d387e2a6e6253ed397ac76e7bdbdc48087
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bS:sxX7QnxrloE5dpUpXb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotOB\xoptisys.exe
- Size 1.3MB
- SHA256 afd2f00a852415bc117156b02648e8036d3dcfbc69588f20daf15f23bb9a1cd3
- MD5 a082b5eca6d627f5ed08a7aca97cc5bb
- SHA1 c7a9413a419927e10aff18ccee7e7849c6a291f2
- SHA512 33bf6b7c43c64578feb5fcaa60c850059b4d393b63c6c0c8b2be2c9ea7fe97707726cc0b138b78c07511450e5c2ee76a718160e072eed87f3d352c858fea3e9d
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDw:sxX7665YxRVplZzSKntlGIi0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotOB\xoptisys.exe
- Size 2.6MB
- SHA256 155069c694cbcb88e4907e475a87657ea3b9b5b8fb24b7a6f00198234c57426c
- MD5 de66bc0e37455deedda9530912c78028
- SHA1 35e48ecda5b14a5206f80e518535ae8721ca9be1
- SHA512 d4c84299a27646a5e8fbfb3e5f5c6867bb9a90f09d30797e41afbcb061ec0d625798c432c9720f9d9a46441cff07713fab731b7b17acb43c16e627bbaa99ef7f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBzB/bS:sxX7QnxrloE5dpUpIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 207B
- SHA256 e83f23bbb6be5b8a253e5149e1589cab196357a63e1cb902c6669c77f7874294
- MD5 b3bf50855f2b9ffa53a7be8c982fc323
- SHA1 0427b48e91fbc4a1430a9a5df387f144471f8205
- SHA512 634b4f1420b10edfee0df6cc9bcd8053df9cc9cbe157f97ccf42a45fcc4a338b4c8c48e4f6580503288e9832be013b9959ab9c04bac86f361116cfdd36fa22db
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 175B
- SHA256 5f425ef337a6bbf5d09b1f8988b4d5dc26a6683dd4056310820c5ca4d8094b9c
- MD5 c8d02212817157b56fe135d810ff09f6
- SHA1 6d31a76bf324f3ac13e59131ff75b10fdeb24852
- SHA512 65c350478ee6bde7b5fe4e6bcedfc1c10d3cd56b82dcfd738f1732bb838d8a94ac441dc3acf02430608a37a0088ec071f9b47c891c5a74ccc4412b5600ba1970
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe
- Size 2.6MB
- SHA256 0eb7a06e608dfecb50e65a02c24da15db5645eea279d0abd496898d06bee003b
- MD5 742696f6513567cce7cc3b2ada195a97
- SHA1 2297e7c0b5ec515c6653e32164de5d2578c89401
- SHA512 1d29e87615bd1a4b5f1d76a579726aad652f6721d0596f446602c788843af2f45828526868b146c2ea8ebe56ca2ed00381ceeb46fa236c784c7c32648c63dbde
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bS:sxX7QnxrloE5dpUpNb
- MD5 SHA1 SHA512 SSDEEP