Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 14:29
General
-
Target
0602411cf02e23aca4ea7054ac2396d48d26007de2fe9d81617b9d8ee8669b0dN.exe
-
Size
2.6MB
-
MD5
862cb8e2382e60c026ddcc067449be40
-
SHA1
9983c11623b540412b7457323ec7aabd3e3aa803
-
SHA256
0602411cf02e23aca4ea7054ac2396d48d26007de2fe9d81617b9d8ee8669b0d
-
SHA512
185de46ef7d0fb87cf9504beb767f09a1f0d61122226a23d08b2428e6b1066bf8b123eacaec0f5127e48ec07b85b10a9900812d330165d133a78c204e724cc49
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBFB/bS:sxX7QnxrloE5dpUpWb
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0602411cf02e23aca4ea7054ac2396d48d26007de2fe9d81617b9d8ee8669b0dN.exe"C:\Users\Admin\AppData\Local\Temp\0602411cf02e23aca4ea7054ac2396d48d26007de2fe9d81617b9d8ee8669b0dN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\SysDrv61\xoptiloc.exeC:\SysDrv61\xoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD52dff986cc61223660683aa80d1fb2fd3
SHA1ac5237d7ccd9da2176c983c09fd0de51c3c51ce0
SHA256d6dbc819fca8f6ef5308e2d398543b8c6b788fc1f430a45a795a12cc15eda624
SHA5125684dd0f5f49925fdeaf0d0b5afc2cd2e27ca45f55b438595f3dc82b458e0f6c3e9258400a4bec6d6cd2d18d84c03167b150ca1ca46a35027b56b31f5267bf95
-
Filesize
2.6MB
MD52f9f0a0f56e387dd2c6c398569e77a24
SHA13e383c6152ffe1146764be7252209780055e72c6
SHA25661ebe7cbbce0f1de6522cf99e1463619e7788e3b389662576fec9e84ceb138f9
SHA51293dfe61c5896a05a2164a3c9eef6e92e54201c89f2332d9703cb3cd0d8df2fb8f2646481e9a4ee584a51e18badb09f62724637268f2f92b410bcd662b7c93dca
-
Filesize
2.6MB
MD517fbc7da3d2c6e792fb7da27e2830ec8
SHA1a6b098cdf4a8f69c4db70cceb5975e4577adaa79
SHA25609c0e313444fc1749b136d5c1943c0d4c7095e7c159cd39728c02a300bb94aaf
SHA512750f2266938eec103bafefdcfb573bd5f66ca85749f5c2ed3d0ba6e3234c385eb7c00b16f9989cc905938d1506a3dc0e57da542f5b934ae7f3ea7ca5f853b401
-
Filesize
202B
MD5b8227df583a11a8df8106d1f8380981d
SHA143c17a206fc7b639525fa881b5fe15664f061827
SHA2569a2ac72e52f0592f2f2d0fe09cfcb2de03648fd0cef473726c35a47aea070b04
SHA512ce1058ad8c063cc336f222f2fdda9dc08c4f801e7e0986a2b026134d8527af7833727342a892355ec780a2342143530a34d874b8b20c92cb003aac3c35ff003e
-
Filesize
170B
MD52a35260a06f8b1a0e59c8c3057ec6f05
SHA1aa2524d8080a163f9d0a9f9674fd4b1e9f6ce9ea
SHA256e091c668c3a14ecc0a13631b58132d68600e33c90149c05e27f04647917a8d77
SHA512e7365954948b6c709a7a9c6102029ad7a1a27972c1995a3664c1aa51faf1c6416f85d3c412911385f8e18d854f83b7ce44f6d52d98cfa75f5363988d9d5b78a6
-
Filesize
2.6MB
MD5fd141f84d437095e776caecca4819d95
SHA1e07820b32591f06f02ae93be3b5de4771d3a9e9d
SHA256e00ba897a0d79066a86701edeaa73d07ad04c36dda7a4d4b38dc90c16fb641c6
SHA512e610081135f8e9a0a67260aa9ec0723f4cab1a5b95f485f57dc4b47997f61063cd734189554df9bc8c25e41d8683bd5029c139c187a00f528e98e25a8ac583d7