Analysis
- max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe
- Size 2.6MB
- Sample241109-3jf4eavbnj
- SHA256 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a
- MD5 cc3f8b7a08292d99f4e656da2d1885bf
- SHA1 b4d0d7b7eb65cf8274af3f960af4c39bd34a13c1
- SHA512 61748c8b192db98fe2b0d8c2eb35fa4531be9a4efcc99bc67b97705cdce7eeea9940d324ecc7cc09e399c365cf9d9b839b09fcfaeb7a3ec66ed4afe6802707fa
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bS:sxX7QnxrloE5dpUp6b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe - Executes dropped EXE 2 IoCs
pid Process 3248 sysadob.exe 656 aoptiec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocEO\\aoptiec.exe" 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidR0\\bodaloc.exe" 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptiec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe 3248 sysadob.exe 3248 sysadob.exe 656 aoptiec.exe 656 aoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1320 wrote to memory of 3248 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 89 PID 1320 wrote to memory of 3248 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 89 PID 1320 wrote to memory of 3248 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 89 PID 1320 wrote to memory of 656 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 90 PID 1320 wrote to memory of 656 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 90 PID 1320 wrote to memory of 656 1320 76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe"C:\Users\Admin\AppData\Local\Temp\76bb5f57b27a0bfc104b7f0ef5aaf078a4813c4c3f218d693a09f02d3eb2371a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3248
-
-
C:\IntelprocEO\aoptiec.exeC:\IntelprocEO\aoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocEO\aoptiec.exe
- Size 193KB
- SHA256 c4dd6fa8c83752b41e3824298fc1fb5276f66b0823f46e577902a13457915003
- MD5 f6affab26ba769e79bbccd1268ef831a
- SHA1 018e254bd6eca17c92e756cfbd8618f7625c5252
- SHA512 66d693ff53bb1dbe701d6ee4207f059395c705a90854af0bb0708861d87db84fb1cde30c26eb1a4ab56481c568d3928050d129963003a850275e2b1e9b9e8634
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vfGm+7s+ndOPtiT7gVnZtq1+QYP:6nyJ3n0Dm7+zm6wr6YEjAumIann66
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocEO\aoptiec.exe
- Size 2.6MB
- SHA256 4cfade01ee9442fbd0ef7697843e0380573a2a52121eb6f30daad8f74ea83e6b
- MD5 6f6218902fee7406898e0bacff9a5958
- SHA1 861f080d26881db2ea942ba361645a501aadbece
- SHA512 306e5c077dfa754bc0f01ea6074723154bd1792603c7a9adc25b612146593ba50f97191f2df7415889130a65e16544889b58af59f061981037d01119da19e801
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUp/b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 1e28fbdae9405765d611a311c9b491f591256a245e062e401ba2abed6e5f6ac5
- MD5 c1613dea6b42b88fa54d1db6e7a50a31
- SHA1 f5db89ab9f3168dc6630e16e523dde738bf48b4d
- SHA512 ebe743b30df05a4928e42d2e01bd0981b121eec4e743fdef531fc32b9cb370beb1e2b1a869778cfae71dfcae8e0cedf6dd36d09e5d8788eefe01362cf0eb5cf4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 27b4d1977ae0dabd01b4ff34871cc939819e019d0a23fc8f1f39d7d3453a3cfd
- MD5 54b3f6e9cca19a5852516703391596b6
- SHA1 c815af9a7af8799cef3e7e92c5a25b3c7b019056
- SHA512 68e356dd620b3efef0f69ec0438cde28193358eee04ece30bccbbe2a0f454d50d3a91448bec5596bd43cdf0b6662ed70afa4274850a770f707542db09c6b8659
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe
- Size 2.6MB
- SHA256 36a8127e6be6c0e4af142eed1a924053d7e36ee890c9859f05c5348511c9475a
- MD5 b9777aa1da36d77d1e784de5467ff02d
- SHA1 0ac4a862db56c4fbf984bd164c87f114e194b5ce
- SHA512 b37684f5b1588400c05c81bb2853fbc224ccbe0500cd04c1886d0fe43d612eed3a321cb5815f70bb28176510763017102a6c7f559c8b247bbce102ffebdca19b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bS:sxX7QnxrloE5dpUp9b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidR0\bodaloc.exe
- Size 2.6MB
- SHA256 e2141ba8064b9641aaaf5db6230a7c55d23db6e5b5b02e7392b0ae580308e377
- MD5 30844ecc93dbd7ee660510e1d9fa6730
- SHA1 adfde6ae7362ff9c894b86584166afd5673af653
- SHA512 10f27d4b77b23818ed90f7f73c2f0618bc0d89f030de483b2c080171c78979b9a2d633771c17abacb8db37900c99607650f6aaa1070f48f9eeb738ba9f64b012
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bS:sxX7QnxrloE5dpUpqb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidR0\bodaloc.exe
- Size 2.6MB
- SHA256 12c4af907830008299620e0542e90a3877cc4ef777d4c96fcffb840fcb847d32
- MD5 aeaec106d67b3b375727eb8196e9ff2e
- SHA1 55894a1fd85a9d2cf03d397d1ab098879ad4fdf8
- SHA512 2c3fc4c46737de95628afb7643adf9ce1ae0efc4b5809dda80b54b90dabae37734129f216abacb309dc10fb1fd0940b392de14156fb931ee18cd9ba83c6b711f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bS:sxX7QnxrloE5dpUpOb
- MD5 SHA1 SHA512 SSDEEP