Analysis
- max time kernel
119s - max time network
118s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
22/10/2024, 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe
- Size 2.6MB
- Sample241022-ewh7jayfmp
- SHA256 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33
- MD5 5cd19c26d2b0873fe4d3c53a60ef0580
- SHA1 7a5d9bf7212527eff078c78a1bd30d299cc6231a
- SHA512 aa1f8203dcc936930b785ec9352a2707ba9d9a5214cf655c6c408c024bb4d22164d6b71b8a7ad3efeb3244673cd7e7f2d9f471d96965bf77d58d5bef9375fcb6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bS:sxX7QnxrloE5dpUpTb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe - Executes dropped EXE 2 IoCs
pid Process 2756 sysxbod.exe 2764 aoptiec.exe - Loads dropped DLL 2 IoCs
pid Process 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocVH\\aoptiec.exe" 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintN0\\bodxloc.exe" 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysxbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptiec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe 2756 sysxbod.exe 2764 aoptiec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2756 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 31 PID 2708 wrote to memory of 2756 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 31 PID 2708 wrote to memory of 2756 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 31 PID 2708 wrote to memory of 2756 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 31 PID 2708 wrote to memory of 2764 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 32 PID 2708 wrote to memory of 2764 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 32 PID 2708 wrote to memory of 2764 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 32 PID 2708 wrote to memory of 2764 2708 6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe"C:\Users\Admin\AppData\Local\Temp\6adb261531da1a0edacb424292539ab0126e76f377a49f0366bafb68fa02cd33N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2756
-
-
C:\IntelprocVH\aoptiec.exeC:\IntelprocVH\aoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocVH\aoptiec.exe
- Size 2.6MB
- SHA256 f9c8ab6437b9312534b45484dccbe9121fa023f9cbac68c8d6621a4e149a3339
- MD5 ce6a1a3379b4cdda7369ba050eb57528
- SHA1 4e796bb449a810ac48fc706b9b78dec124511884
- SHA512 1988442fc665825f94aacacbe5680184136cfec51bea694a18a8005222135fe9ed8ef95632f718cc59af12b4a5fd246f4c0b6c3d7b25d7d544563f21c962d9a7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBhB/bS:sxX7QnxrloE5dpUp6b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintN0\bodxloc.exe
- Size 2.6MB
- SHA256 a9617ec5bee3e9ecef7016b0896d110dc4d6efdd1c04c1abcce5c9e23818de7c
- MD5 863512e8e2e83828cecf746518bb5076
- SHA1 8a729764f9f536f3d9c9a3f98c5d0dc4b4eb7c72
- SHA512 999db30ed2f5e2695a1562839fd42c7de295cf4066c4a268110da058ca03d0ab64f2b458c396654327810cc60e505b1ecdaf248717a4b6bd7c75b0328b48a1b0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bS:sxX7QnxrloE5dpUp5b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintN0\bodxloc.exe
- Size 2.6MB
- SHA256 6d46a968510b31923a9a102db2cbd5ea6193bc3b03ec2614e0e64b3df38162ec
- MD5 5258d0683529cd75e45404413ff20538
- SHA1 f579cfbb9b993d93944652764d96929c680d3634
- SHA512 87ad12ce691430c2ca091443a1f0e0c8f60be2c91c013676294b059df750dd2bbf14f6292089308356db1a6c15cab4c4281a19124c1590073b05aaaeccd09968
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBuB/bS:sxX7QnxrloE5dpUpBb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 172B
- SHA256 b45009d7200c2f05bd1299a41e9a661fd0ebb089cd4c2209a50110ebc0a77d44
- MD5 fad32630951b5b03fa06c182bfcd8687
- SHA1 90fe1a7803fae3946b4f151a6807573210da6230
- SHA512 f80829864703a1cfd2bced647a6d08c8820ecde23babfcba349070861f4608281cab11b52dc03052c3b1619fed562b897664cead78e7202bf36320e6dad2d892
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 204B
- SHA256 3fea74a8a37f62e10bd37106b6ceab7de41fe88f058f86b91d90f353189cd65a
- MD5 5917841ae9515b200b6cf6c997e71eb6
- SHA1 ab208dc46206e7592e718c5d3a60ec86294f528d
- SHA512 9b59d7a3e6d88e6da22cd28d521b32bd9d969da3b66eae4d772a254a57c3468705e2f9009efea83300d44df455c918135dc24b0a8259809b2de1c85753e45a2a
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe
- Size 2.6MB
- SHA256 dc606968d2fb4cadd188e731012ee52bf04d6a2b360b954c7850c925236bdf54
- MD5 eb4e5dc3f723d18e6366917b433554af
- SHA1 1273f12bc275301c5eb3d10ef3e901dd2ba15105
- SHA512 a23ed235abf8bbc220232d3dae87327923286afc35699c9372d17d119d83711a15cf6a249bd38344d8f56530e16f5a924398cd926265b4fa188521ddb969ab78
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bS:sxX7QnxrloE5dpUpIb
- MD5 SHA1 SHA512 SSDEEP