Analysis
- max time kernel
119s - max time network
118s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
22/10/2024, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe
- Size 2.6MB
- Sample241022-e82jmszdrm
- SHA256 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26
- MD5 f47e72d61dd090322178f3660adae130
- SHA1 515fc1a5b13a5cee2dde451992bbd85d882bce2d
- SHA512 5884df039d12e6511f09fe9a54b63eb779d8c18a46d791237af9eb7044d6e318b032d7b7fc22d50d33e4149dbbfc90d16d02f1b1af69d38be48066941bba3712
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bSq:sxX7QnxrloE5dpUprbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe - Executes dropped EXE 2 IoCs
pid Process 2532 ecdevopti.exe 2932 adobsys.exe - Loads dropped DLL 2 IoCs
pid Process 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocBN\\adobsys.exe" 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB6U\\optiasys.exe" 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecdevopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adobsys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe 2532 ecdevopti.exe 2932 adobsys.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2532 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 30 PID 2904 wrote to memory of 2532 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 30 PID 2904 wrote to memory of 2532 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 30 PID 2904 wrote to memory of 2532 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 30 PID 2904 wrote to memory of 2932 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 31 PID 2904 wrote to memory of 2932 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 31 PID 2904 wrote to memory of 2932 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 31 PID 2904 wrote to memory of 2932 2904 1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe"C:\Users\Admin\AppData\Local\Temp\1716264098c02a5971c874eaf987039954e8dbcd15e032f3f61bc2726585aa26N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
C:\IntelprocBN\adobsys.exeC:\IntelprocBN\adobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocBN\adobsys.exe
- Size 2.6MB
- SHA256 d148fdc0f872995ddd2cb642768bd72421ea8993187d1294bd0a41508d5583fb
- MD5 296f379e207189055dbb317b6c0205a9
- SHA1 f9a1d71abe631872bf86411b4dc20fbd7483b1cc
- SHA512 863e422dd760674fba1b339ec7686bd2a03b73481a447bba0c4a31b3964b08b0f06efa81fb9b23082c0602d1ef5bfeb62c1fd350149aaff5e52e86126369fdd9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bSq:sxX7QnxrloE5dpUpLbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB6U\optiasys.exe
- Size 1.6MB
- SHA256 35416fdcfcc0e7e7ab942c1c6e66785d5597f6db24296c602840395b0e7f407b
- MD5 f4c9953475a57f69852518f4202293a9
- SHA1 e2bc0cea0f534515b3bd373f4241ccc294191f0d
- SHA512 26329a853276f10575d8f8b86bc67de1f2cce819406b986a14b1351b195ac8037bfa62bc15c60cbcbcf2cb7cb6e132eb4b21242009f9212f06fddb92171a7299
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDZ:sxX7665YxRVplZzSKntlGIiT+HvRdpcD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB6U\optiasys.exe
- Size 2.6MB
- SHA256 011e1ce7aac413a200f621006a7f77107915957ac8a24511bab5454f363c1f75
- MD5 bd08fc8de8075f6a5b539f96aff26a1a
- SHA1 cef392ae8e1e354761de4cea2f9d181b18542089
- SHA512 717148464564c99b69241b237a8cb62ea380b9b10ff4bec2fc9254532228e1dafc624e707aa1b0d7269b332c73bfefa61f51e67505413cc94aec67c1baa31848
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bSq:sxX7QnxrloE5dpUptbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 175B
- SHA256 14be82aef4f3fc3033ab6ac02dbf7c0bb68e211e99829cdde15a4d040c0be14b
- MD5 ef3c6c0a4b1a8298e050d7e9838412d0
- SHA1 5422de6a3f7a7edbccba03deffd62d2652eac39f
- SHA512 39202397343aaa412dc05763305830e2767d9b60a72dc3d899c4141947567fff60cfdf9fd1526a2f5241a3c9a0db558006cb6ade0a11835cc01f6e522eadfc16
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 207B
- SHA256 59352b91c386b781a5b3674faad5312ba7eb8f8ea6072a569e0d8ee8e6c14d0b
- MD5 dd2af84d82a63d3664b0f150de86d646
- SHA1 8c633a373bcd2774c8d5a9d2b2a4ab7fc24cf564
- SHA512 99637e87286c54b9a9acdd96aee10e87d62b35f87f9453c6cccb7738fd225d26d13a1063c59c347ab1ff474a1949697086da6ad7b3bc8fa593bf9fd318b4c061
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe
- Size 2.6MB
- SHA256 b0da33138ef1f6cb29c820ef67b774614e1d4e84f1796b34bfb69c8fbfb32878
- MD5 b12ed5e0caaf1b1741110c7347cbc3b3
- SHA1 6fa1af388ba0c58889b4c0a5e40a4378b247b6ef
- SHA512 5845e33e53de4a44e12130bdb35a492b8bb6bb5246a896f50f01d1b4bbce57b85e292a70187991afc51489c304362a9b7972c246d934f71eb1ea92d8cbe5765a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBbB/bSq:sxX7QnxrloE5dpUpYbV
- MD5 SHA1 SHA512 SSDEEP