Analysis
- max time kernel
119s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
22/10/2024, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe
- Size 2.6MB
- Sample241022-e4lbvsxekg
- SHA256 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327
- MD5 1f150169a2c97923c6b6edc8bcdef090
- SHA1 b142252705a05e03d025c47de8a0765249f7bf29
- SHA512 44d0c91cb3c43c0c1df9aea49f6c21c2f581160564d75f7c7ddb72bf05d699621ed922e1292206b093b3eb8fe3560dd61a3c5ca14138c16c229d48c529c204fa
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBNB/bS:sxX7QnxrloE5dpUpib
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe - Executes dropped EXE 2 IoCs
pid Process 1248 sysxopti.exe 2632 abodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot7L\\abodsys.exe" 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidNN\\optixsys.exe" 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe 1248 sysxopti.exe 1248 sysxopti.exe 2632 abodsys.exe 2632 abodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4180 wrote to memory of 1248 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 89 PID 4180 wrote to memory of 1248 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 89 PID 4180 wrote to memory of 1248 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 89 PID 4180 wrote to memory of 2632 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 92 PID 4180 wrote to memory of 2632 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 92 PID 4180 wrote to memory of 2632 4180 2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe"C:\Users\Admin\AppData\Local\Temp\2ec30d8b0beceedc389754f0fd301774b3ecc7e1475e539ebce4ab10ba0d9327N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1248
-
-
C:\UserDot7L\abodsys.exeC:\UserDot7L\abodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDot7L\abodsys.exe
- Size 2.6MB
- SHA256 2f5e1cb5933118f2acfeef517d80443dac7cf35d2e25970dac2b8eafd4ad5afe
- MD5 18f78eace9ac75e9ba86f6b6278956b5
- SHA1 3cee0c7b939b1a893c89980f67dca0935fbc87db
- SHA512 ce87af0977fc22038043f6504d29b5d698a6a796f0ddc4fa4d928ca6f57adf89747ec54d00b3c0f2efd4e01597350a636acd8fdb8b406c85f30dd43ed882ebbf
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUpfb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 b2ba866b71f400b1c611e2145941b721c43a505db52c22db4aef38e5e6f44b47
- MD5 d21f03e7147591b4de22d1e2ff7b432f
- SHA1 265ffa097f653b118d668492d7f2dc556f31f7fb
- SHA512 a278284a6d4ef47db42659e039cf723ddc8e44e78c116ba89461d13b79f9ea8359bc655be3fc07eaa348840cd776085e64e06b0a68dcccfc9205579a0bfc640e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 086179958ed3921b0264d246e78dc616b558c103527a73e4b454736ca0112683
- MD5 9ff542a1feac320905c0e0971b1c30ba
- SHA1 f30bf885fc65c0b7666c5a0d9e3c737a2b419e12
- SHA512 ea9d1bb7578656eddcb4c13822d5a14ce7e652664bb0eaf20f6e62abbf6635d2e97a4e7fbac489eb2355271a2f2eb5036fa0f23f5b24c596ea702d24830e5c0e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe
- Size 2.6MB
- SHA256 4139ee1d8256ce85bc2cba31a95a5c738bf3d759eb3e2258cb5a94f1a445d655
- MD5 76444215a0a84a412e0075eacc5c2a14
- SHA1 35609ae5ade817cfbe0e516f95be992ff7077d86
- SHA512 bd800658a81970e14da2f36637164d6040b8fe1b6f9e7402dd24abd6c789ec1dc535e4d90119e8235865d7b89a04ca8b71be38d507967d6ed759a603cfea3a50
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bS:sxX7QnxrloE5dpUp4b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidNN\optixsys.exe
- Size 2.6MB
- SHA256 4371d373096538411e41ee35588eba21b8c1556be07a36405801edceb2c3a359
- MD5 477513306e5e6dc59ded7ab5872539dd
- SHA1 fa163b5737a51ccd81d76ea6f1bed75907fbeeeb
- SHA512 c3967cc94101cf835104cb74eeec8b4d373656783ee82eae76a3471b74fb26691dd9805cc08079cc0e144100421c7dfa020fdf70a0e5493abc81f7f705076570
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bS:sxX7QnxrloE5dpUp2b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidNN\optixsys.exe
- Size 14KB
- SHA256 4bfbd1374923be20f98b58ddc780be3cd5a3714124580ccf4631700f056077a5
- MD5 eea4aa3d13cff294fb9de101050d3b95
- SHA1 8be9253d0215e54c585f56eadb2280278a3ef3fa
- SHA512 8793ab23bc508ea67a7d382f851f692b10c6141d6a08aea34676af615c93c597ab6a7bab354d52cfa7c84c568a31eee4521a37ed280aa9a5c1a200be1d176b44
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJja:04ezXTIk/IxT/ES70S7TqOO
- MD5 SHA1 SHA512 SSDEEP