Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe
- Size 2.6MB
- Sample241108-ywp5mayfpn
- SHA256 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63
- MD5 5d8c0153a69d13c654051f0f395cdd80
- SHA1 a4375e2d984b8581e710d1224b6902adb420ce2b
- SHA512 464724b0e1808ac7423a724c4608a397bb4ecf6d5e5a8c4a975cf4192312d07fbfea4ef4ac855bc1d9c3b8562b0ec6347566b3391ef11f5c47797f0c20322ee5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bS:sxX7QnxrloE5dpUpXb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe - Executes dropped EXE 2 IoCs
pid Process 3100 sysdevbod.exe 4076 xoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesLL\\xoptisys.exe" a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid7I\\optidevec.exe" a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptisys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevbod.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe 3100 sysdevbod.exe 3100 sysdevbod.exe 4076 xoptisys.exe 4076 xoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 320 wrote to memory of 3100 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 87 PID 320 wrote to memory of 3100 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 87 PID 320 wrote to memory of 3100 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 87 PID 320 wrote to memory of 4076 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 88 PID 320 wrote to memory of 4076 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 88 PID 320 wrote to memory of 4076 320 a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe"C:\Users\Admin\AppData\Local\Temp\a588f9f0394db2a3e2d0246fd026d83ddd507cc713de65e2a66d64880fc0ae63N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
-
C:\FilesLL\xoptisys.exeC:\FilesLL\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesLL\xoptisys.exe
- Size 68KB
- SHA256 01214b0e0db7416edfdb710f5fda30c958ff443ca96d769b1b8176d7ca52943d
- MD5 5787f471d77dedba531ccbc0fb8ada69
- SHA1 d8ea6336f3ee68e80064ac895a501e9c5e95bac3
- SHA512 729ae8cb31d08d3d1674bccbc7ceaf6834dab827028fa4ca287c8aa0508ecd4e5f4d9b5d6bc4f9135213a4ef8e5dc409fd9ea2207fc6e5d0cffb4bfdbc2edef2
- SSDEEP 1536:ABalOBo1TKFO3n0KkZHqX7+g2lWXQmMc0pg:6uOByTKI3n0dZHm7+zsMcSg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\FilesLL\xoptisys.exe
- Size 2.6MB
- SHA256 2db3c07487ca1d55a319655fc3f55d6ed3f579c6334759d0251aacd3720583ad
- MD5 6021fad9d9236583d6dcee6cb0bd90a8
- SHA1 7e76025026904a6c83270572315cc5152bde4c2a
- SHA512 fe61cb9712c9a19d8386ec721a5d0d6923f9d67f2d5644fb81150de1d793d6b46a83279d2785b3ad38efad60d95831544e78060c323f5adac79ac50024262a42
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bS:sxX7QnxrloE5dpUpAb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 5cca0c9f74cf3e6787753d8414d7c9ca2c3504798971ccfa58f1c8f2300b39f0
- MD5 6ef809ad6285007fd331d283207603bb
- SHA1 568137f425e456de0d7d5559e841302b31ae0d22
- SHA512 2e5065f0a28ec81d22679858fc93e22d930aaf0ea63df23ca1a1d4f67d0f0e6f4b2a84ad38e22e4b49a76b34ca26c4b65d41dd4d0766b508ee67ee981345b481
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 1fd0a33856103347398af0a8b3edb4afae664378c1a153001762b37415d48ac0
- MD5 ddab588476db71f63510ab421445093e
- SHA1 a586377b6145ceb58628c5a38dd465927b4fb675
- SHA512 b122e380ca8ab48fe1952b8780cd38eb7538eeee5342c551a1c34b5d8f1bebb26b3939609ba490dc4488556a3d69d0d35d58319bdb611cd73684791b2ef048b0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe
- Size 2.6MB
- SHA256 62f8bac3c4c07c218d6fd2de8252f8cb5166e76eac231f4a7c0c29c03d120594
- MD5 eed3a4a9b33d9b24ada20cde211ebc0a
- SHA1 a907e5ffd9a5ff7affa67c7c939a729529c47fe4
- SHA512 44c7632ce6650a33a79ab48bd2b5a77c6eec3f7131e76342aa2ba3aff7d14df1ad391baf3da03c5fb03ea25c3f1ed0ba8c6c001f6e26b3af8f514ed62192c8ba
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bS:sxX7QnxrloE5dpUpqb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid7I\optidevec.exe
- Size 2.6MB
- SHA256 9b4669c8671fd4bda748f56949494ea1b4c1af91ed069d5fd15f0eb86440fdb2
- MD5 69ed45ed1eab9c915e4b449e7adbfba1
- SHA1 6e1b7576f0c82777703a0fcc9efd7c89a1b407fd
- SHA512 1a5d5aec52da4a151cf51891794258cc4d1704d3b798aac4fe4035678cf2d9a987af76e53b4614c407eafacee0dab6cccc6601ce232eda0246e731b2f3ee3bf9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bS:sxX7QnxrloE5dpUpYb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid7I\optidevec.exe
- Size 2.6MB
- SHA256 4f80710e4e4dd107210d47450bd286fd7595aab54440b8af2900348cadfd9570
- MD5 f44ef16c5403a84fd5be01044a7dccd0
- SHA1 c48a012edd7db21fe0ef30f281addece75226b12
- SHA512 57935b7af71fe3ce20ee85905f9b8396e1afe230565171b229bab7997ab641bf4ec8ee1e09ec0ae37976fbe7a6dd74f648f24eb5931c62ce6684402ab05ba298
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBaB/bS:sxX7QnxrloE5dpUpJb
- MD5 SHA1 SHA512 SSDEEP