Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-09-2024 06:45
General
-
Target
b721cda796355822135677cd008513b0N.exe
-
Size
2.6MB
-
MD5
b721cda796355822135677cd008513b0
-
SHA1
a29a3537f0ef3f24c91697a1a97a4cbbc61e5456
-
SHA256
52a4b7ac73f100099b6bb3c6c82ffe809cf851880cd9a66edbde74ef3149b71b
-
SHA512
4eafc3171d0b9eea0ff93fef1bf8392caa3d2f90072268ee5aa292030e0bb0dad73911bc5cb060219a8c7705589b6a661da207579c05d115981b496f72523f55
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bS:sxX7QnxrloE5dpUpjb
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b721cda796355822135677cd008513b0N.exe"C:\Users\Admin\AppData\Local\Temp\b721cda796355822135677cd008513b0N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Adobe0B\xoptisys.exeC:\Adobe0B\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5d309993adf3359fc6b30e2e6670389b5
SHA125e144145d81ca7dbeae8d3c53dc2a2925276c7d
SHA256636ab2abec36b06b8e782d10d04c98f69e83472b32f98765b78a41b10e1a2242
SHA51245b4395317e248131ece721b2489dfb6d823d2a4c787b80e603a93b06370d462f1a652f265723445250aa227844ef2728eff7f233e85fae2ab85a6b76ca6a33d
-
Filesize
486KB
MD5e1b8e8ecd8cf17356b4b49e86ce74b3b
SHA1916abde448f2118c3558bfd3b126a4c002ee3a79
SHA25602ba0c9655cc6af1da95d351cd565a08c146f1fbc995850c5716eaba1b8fc699
SHA512b16660b31cfc57411332c8d6028a784312d4754e6e5dcc9a50bd9c4d90cdea9cc02b47a78386fbf3d10b10250110fc647345c49a9005fe26e99278b349dc571c
-
Filesize
2.6MB
MD5c4bd4daea9e8edb309ffb97044b99367
SHA1b0ee00276ab7c1c964ef41db54c7a59631b193d9
SHA256d326369e7df464f4080ebe52090c5f6d077a27ba5235602dec413b35871e6878
SHA51226be535e064ea6ff4e6f25d7af173e70f2489fc307639a36dd5e2dde0ecdeee90e42defdfd6c6b17a98f189ef557d19c143d1c24e33d6dac9d6da4a67fe971f3
-
Filesize
169B
MD5d7ce49077a81735a821648b9780854f7
SHA129e66f790edf9b050fe3b94c9a38809c11722974
SHA256e5f0df21c50c357e9cd4127c27bc36c5fe4bb75a079d6237d3ad09c21a4f979d
SHA512f55014e81c428a3ea5a753ee82a2bb47de9c5c2dfa670caa8b0e0cb254bcbc01c3165a87d262c67058fd60bee0116e86d140bb80c4a10496d129ae36ed39cf4e
-
Filesize
201B
MD557c57851535a43f549af9b62eb72193f
SHA1568ecc4ab7c61ac4d00fd6511b7cdb8ea1cafc64
SHA256ada0460e2bea3b4401becba1b6b48fa94405de2a9be688b9d1e192032e131f20
SHA512b5c4418c096d03678f7c01b46c47b3f28baded9e6f5c1cd1937a2c65f06ac917dff717527414fc78159d84589f4b0a6095a42c1b31571f7bc4348fd63caa4fb5
-
Filesize
2.6MB
MD522989b19961f6b9fe17d5cf183a2bfc3
SHA1b26bf935d49ee07c1c0744462c0dc2f77a67531f
SHA2566f5812a10f22a02b82e8950b65fcfc88c57045e3f2b190492939fd7e6c5d4003
SHA512a185a42bf86dba73f635bf2955e4b2992add49936ee5489db0d28906f02ccb2dfc6fa918156307f9d452a6f95fa65a65f7026eda2d20886ab0a0c4ae27f5c17a