Analysis
- max time kernel
119s - max time network
19s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
08/11/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe
- Size 2.6MB
- Sample241108-ywp5mayfpn
- SHA256 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63
- MD5 5d8c0153a69d13c654051f0f395cdd80
- SHA1 a4375e2d984b8581e710d1224b6902adb420ce2b
- SHA512 464724b0e1808ac7423a724c4608a397bb4ecf6d5e5a8c4a975cf4192312d07fbfea4ef4ac855bc1d9c3b8562b0ec6347566b3391ef11f5c47797f0c20322ee5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bS:sxX7QnxrloE5dpUpXb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe - Executes dropped EXE 2 IoCs
pid Process 2836 sysdevdob.exe 2864 aoptiloc.exe - Loads dropped DLL 2 IoCs
pid Process 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv3H\\aoptiloc.exe" a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid36\\optidevec.exe" a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptiloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe 2836 sysdevdob.exe 2864 aoptiloc.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2836 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 30 PID 2448 wrote to memory of 2836 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 30 PID 2448 wrote to memory of 2836 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 30 PID 2448 wrote to memory of 2836 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 30 PID 2448 wrote to memory of 2864 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 31 PID 2448 wrote to memory of 2864 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 31 PID 2448 wrote to memory of 2864 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 31 PID 2448 wrote to memory of 2864 2448 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe"C:\Users\Admin\AppData\Local\Temp\a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2836
-
-
C:\SysDrv3H\aoptiloc.exeC:\SysDrv3H\aoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrv3H\aoptiloc.exe
- Size 2.6MB
- SHA256 54b2872570030dabedb05b76f56752c47f174f2c439c83647e1a9dd6425595f4
- MD5 4861c16d31ca1c6b55cbdc8dfedbb25f
- SHA1 14eb02be4a3a7fb9bc5dc6c53dacbf0b49e1d1f8
- SHA512 9da0c182608f141fdbbdb19c8998255910f10ea28501af8de89a0850f322f17c9b5b8b8da26830b1f00baa14ebe42b40d0abee04f2e72d69b0bf9f85c3497a46
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bS:sxX7QnxrloE5dpUpcb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 173B
- SHA256 4ecede4d4b1d9dfc1897f8a4cd126be815b3135935f8bca877d1a1396729be84
- MD5 0899f8fbb99969131d9b673b54ca79b7
- SHA1 a74f71e2ffac16fce9d697c57d579abb0a350749
- SHA512 cd4bf3d76c410b6ebbba636e1ef35b6b222a69a67f3ca0e4901d73966006ecd585c13f0f77f93d046d5c818623748101e81ff52bb939fadeba3c0e08d62ebef7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 205B
- SHA256 d2fc078a5c60fae5b61713752f2cc5f38cdb1615215fa7352f05ceef2441549d
- MD5 34b4b064b9d1daca2c1223a069eccde4
- SHA1 eb1a4b77bd7487df6f8339afcba293590a61078d
- SHA512 874cf364eaef719c716dc3d409ae92853bf7229f9e8999e32524624899d818551e2cc5877ff04bc8d81192e91507a73d9eb9aadbb1163c4cee41d5e3d42a9919
- MD5 SHA1 SHA512
- Path C:\Vid36\optidevec.exe
- Size 2.6MB
- SHA256 b45ef9d5aa2d35e169f4bb97f9b1e977b3b13b37f8e5a1620fe39c4f4962b429
- MD5 7bcc4f082bd22b9e54087c070278f847
- SHA1 123b058eacba2917c77985fb652413f9298bcc29
- SHA512 185a24e9765b55d818432da99f40613bf0784318f9a7282d397ea00d36b20af43eda72d578b056d20ce68f53304c72362353474f84513f6ffb255df6cfadf49b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpDb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid36\optidevec.exe
- Size 2.6MB
- SHA256 eeaf0360b5bc9a85a00b9e85bb47791045519fbbef79d378461f7c3065418725
- MD5 15a37c050af2546459168b439d1aa3f2
- SHA1 02faff642be543b967305018f04e33fc8a09ad1b
- SHA512 cd8e78cb0e68f3fada906b3f0dd03f06a890e44e91d3b4d44a967cfc3128ffa16e17e863b8c1f58784d324c5fa66cc03c67af70854244b266a298d4b4da4f76e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBTB/bS:sxX7QnxrloE5dpUpgb
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 2.6MB
- SHA256 0c9077f2f7dcf790c5d1b8d9c1fcec8505c492c4ee58a45c10f9f8e40728888f
- MD5 e516838f0e00564cd4f0595fd7213b9c
- SHA1 766e028dab9bb37b4db0b68b4296bed89ea2d809
- SHA512 954c5bce09fdd56ce0bf3f22db89f1e624f2adf839705229e871a09bfbf31b1a592817da81b13f29ef0e4981634693c48618cb3a4c9ea34b77036330b1633b0e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bS:sxX7QnxrloE5dpUpOb
- MD5 SHA1 SHA512 SSDEEP