e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
Size

2.6MB
MD5

1d6c11ec7dcc2a8be3ea0efe31061d40
SHA1

9e5678ec7a2286eeeb10b2a2fa0c96895f9c7620
SHA256

e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342
SHA512

bb389a68720b589aafe021fb7f35acb82ce644b10275ec7857e7ffc0e3fccddb59ba8690facc9a8ae63b84ab892e58e091bb672ebece8b94a75fbc9914b0de71
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQB/bS:sxX7QnxrloE5dpUpLb

Score

9^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe

Executes dropped EXE 2 IoCs

pid	Process
4000	ecabod.exe
3800	xoptiec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe6P\\xoptiec.exe"	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBBR\\optixloc.exe"	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xoptiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecabod.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe
4000	ecabod.exe
4000	ecabod.exe
3800	xoptiec.exe
3800	xoptiec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4000	2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe	89
PID 2252 wrote to memory of 4000	2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe	89
PID 2252 wrote to memory of 4000	2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe	89
PID 2252 wrote to memory of 3800	2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe	90
PID 2252 wrote to memory of 3800	2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe	90
PID 2252 wrote to memory of 3800	2252	e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe	90

C:\Users\Admin\AppData\Local\Temp\e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe
"C:\Users\Admin\AppData\Local\Temp\e2c493b65359a28006d6fadde427a182caf5d4f07e0b034fae57fcab71dad342.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Adobe6P\xoptiec.exe
  C:\Adobe6P\xoptiec.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Adobe6P\xoptiec.exe

Filesize
2.6MB

MD5
352bb09fd32aae313bcf9dee95dcc1d9

SHA1
80c5811f4b4a1b53d0f37f3b8bb0fbf9338a29af

SHA256
acfb6896e42372c2de4c0cadadefd7582e7c8775252de30e21063db9231b2d66

SHA512
3b1cb992da3d8b302fb823d54df1934f6c0af635b2992b42d6c53d240a8811309fe0c5f2d46d20b392ea2ffea6ac76bd083426d079438d7e065dcd84ce912f9c

Download Submit
C:\KaVBBR\optixloc.exe

Filesize
1.8MB

MD5
a11f76255b9ca6234bfd6aa66474643d

SHA1
e3cc3fe2e8e1a624e3288e828320a33d91a8d733

SHA256
2a97025511d98dd7e5dd0d7449ac38752616c9d970792c41fea246edadffc1d6

SHA512
5b3ad563c733fb5554189481e067a3fcec5460f763afe6445d5eb45bde640f5543a6c59de55edeb77e6711b5792e8c3ee8001ab9a7d7f8f8fcdcc56932530c56

Download Submit
C:\KaVBBR\optixloc.exe

Filesize
2.6MB

MD5
1d92fcca56f3236abbb0e9c71a89bd8f

SHA1
e5ffbc82520d372cd16f616418d5f325bd429a52

SHA256
e06d5b203ec3d0cec22048b44e564f2bb447ed82760c3215c439390842d9c739

SHA512
e7f9f4cba38a2fc00a80733f3e4862f9eb6181fe95ba4512fca7375d985c5cd059907b645c5f4a43e16b341adc75e507dba6dbb7b3d9097d8453faaea3d20d20

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
200B

MD5
06966ce556ec1e1cce7eb71f73deb902

SHA1
98bc9189fea7feb4958ade92001fb6863f8151a7

SHA256
2af90450d88f024c5e9b222b93fb6e2f045c2e00a753dd885df409aea90dbb41

SHA512
282828f4c05d79efc2e5038c727efa356423aa94cc82cbf57702c15c895e50989f1cfa0ec3cba02cd21b53f7103d466d41b6666e79858cce224965a8c095901b

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
168B

MD5
5a3305c61fc2b56ba6cec443f1560788

SHA1
1ec32567808c6145fc980a7d4bb5a6b260c2fb43

SHA256
061ff2955bf06f796238e0426ff927553d955084c13c0a6528ea777d8fe19aab

SHA512
1be42f78c84dbba3ebce8ac17c30d5bf2bc54f18ed3bee1d28372127038cdc1ef6ae2157c262f18df4de0ff51a66cd257bf2328be27139f57ac6f3e230f01c8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe

Filesize
2.6MB

MD5
30c8ff3fc8b3eae1f3c2a30b8ee1d077

SHA1
e6622fbe50d5c927cfae455ae110c9083c37080b

SHA256
58e3d75df7c68b5046238e909d0a8ea4d423c32326b872feff1cb133d80f043a

SHA512
2442313e6ea9bd79241eadf3a2a010bcca220b9d2b1cb164e675945f2bf21b89b1447bd7fd0e9f8012b690c8bd8c51c8bef2702cc00fda1d4b1b616e2f92a0b8

Download Submit