Analysis
- max time kernel
120s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe
- Size 2.6MB
- Sample241109-bdpptaterc
- SHA256 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3
- MD5 bf0997705ae462fb6f0fd63f29e187c0
- SHA1 92a95fbcd2aec7ce4ee617ee3164037f37862d12
- SHA512 917d7791e2d2854fb1cbf5d7dda9ac6517a9f9ff77f08cec66ca0c1e3105438a30b082b40fd233d284bec5718e30139bda9971a02a1cc930cd6c61d80030b941
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQB/bS:sxX7QnxrloE5dpUpnb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe - Executes dropped EXE 2 IoCs
pid Process 1908 ecxopti.exe 5064 xoptiec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesK5\\xoptiec.exe" 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxW7\\dobdevloc.exe" 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptiec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe 1908 ecxopti.exe 1908 ecxopti.exe 5064 xoptiec.exe 5064 xoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3368 wrote to memory of 1908 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 86 PID 3368 wrote to memory of 1908 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 86 PID 3368 wrote to memory of 1908 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 86 PID 3368 wrote to memory of 5064 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 89 PID 3368 wrote to memory of 5064 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 89 PID 3368 wrote to memory of 5064 3368 470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe"C:\Users\Admin\AppData\Local\Temp\470d972455ac310b3d9d670ee169ea97c1a7fdd6d064030a37d9393bfecb00d3N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
-
C:\FilesK5\xoptiec.exeC:\FilesK5\xoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesK5\xoptiec.exe
- Size 2.6MB
- SHA256 29f8b29f019ae72ec7a34113562c7fc2c75cab34d2e854b410e96ec786bebe58
- MD5 866e1ccdf3d30987df1012905c494872
- SHA1 f824f57d4fa16e33218e3c6a458b1968bf900b2a
- SHA512 b410c3446a6de3305b27f310938195d045c3b1e43f4f8ed8ea6a286e289aed623a0adf1e8eb145cae2577918cff030048771e7ecd0fa010d0fd73591f1a90b1d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBYB/bS:sxX7QnxrloE5dpUpzb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxW7\dobdevloc.exe
- Size 1.5MB
- SHA256 ead4b3332010f73c51249e439ac79fa9062f060d1aa941729c0155a2a804896d
- MD5 7d0b2e8907a6ba321455c9e60f7d349a
- SHA1 959f323085aad4ab5dffb906298668fcc155b4b6
- SHA512 5740d848ea834132c08c6893dbbb8611fe451572509da5bf8484ad0c88e649df60a7d1de310ab7b5cd0eded467c821031098a22cb819855e309956b4c14a1276
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDi:sxX7665YxRVplZzSKntlGIiT+HvRdp1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxW7\dobdevloc.exe
- Size 2.6MB
- SHA256 eb3f8ca2c5d8b2c7be5b4d8e2d9564480a05a7eda1dd05503ade12e17ed37aab
- MD5 2127e5bde716dd70d05481f89886ff42
- SHA1 ace1388549bc05a14ef0e21e8edf4d4a3a3dc7fc
- SHA512 b5ab00a88d64c8722be870c7e547d14cd2ed7d88efa3ed28f4f1dd14aed7a9872b10df5244d92df490028cac51258e950cd1588d8147a8b62384dc9ca1ab1810
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bS:sxX7QnxrloE5dpUpwb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 64ad49cb61702173485975b2adc78f8f25d782ad930c6b71be16342d23ec378a
- MD5 ade1294290373f7ccc21047fe19bd81f
- SHA1 0b6e49aa89cbed2bf64c6bc6af1261fe5680efe5
- SHA512 4d4b4ec67c6ab677723b1d8bcd80c57c0cbc5b604269eaff7a2f7831b9ef93ddc6e47c0f01a2912916ff19b4051b22690f1ce5b9cee3e1eb8a4fe21053525334
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 6ec52caf8872b79974f52a6e3cc4fa954c2b69ab7d3465a77c3b236da23119fc
- MD5 a96e9fc442e505bcc2aa89346f892f69
- SHA1 38e564d8d5574b2023f6624ea300519e75d8e37c
- SHA512 6223214883efd27ebba73769e10410849b941d87fe38832a97d32a0a330dc32bf529dd765f1b0f20609981877655ac6baa16399e5781d15e1cc1a1b638199bd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxopti.exe
- Size 2.6MB
- SHA256 7035af2c7de2071d1c6d142c2d301da197cb1fc6ee717751889eb8995d67aac9
- MD5 c5a2aec4c5594ef36bfa25bf86c26059
- SHA1 1d44c64e1e9fb35473ebda03e7ddb236143fec2c
- SHA512 987ba0ee44a0475400c405c96e7dfd68339a737e8b6c86fe3c78243b1fe8ced4be8bac256b7f16a7ba246f4705250404d3a933ff09e0b3b0d15b5d6cd3bf04b8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bS:sxX7QnxrloE5dpUpMb
- MD5 SHA1 SHA512 SSDEEP