Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe
- Size 2.6MB
- Sample241109-db3vrswcjd
- SHA256 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cb
- MD5 3c94769036f74a4bbcffea19d0949010
- SHA1 a5af387fd6e3501bcf49f79fcabcc6ab2c33e5c8
- SHA512 cc07cf7d977dc43fa484ad53dfd3cc23e6481ad2a6b63334ea9e1eed91f9ab05870ab5328942144bb0091700d507b8086e913f3b2fcdb27a14555e67254351f1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bS:sxX7QnxrloE5dpUpJb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe - Executes dropped EXE 2 IoCs
pid Process 3192 locxopti.exe 3284 devoptiec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeBH\\devoptiec.exe" 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZNA\\dobxsys.exe" 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devoptiec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe 3192 locxopti.exe 3192 locxopti.exe 3284 devoptiec.exe 3284 devoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3192 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 87 PID 1920 wrote to memory of 3192 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 87 PID 1920 wrote to memory of 3192 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 87 PID 1920 wrote to memory of 3284 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 88 PID 1920 wrote to memory of 3284 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 88 PID 1920 wrote to memory of 3284 1920 79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe"C:\Users\Admin\AppData\Local\Temp\79e01ef1672b59908065e62015afaf2dca4b5b348a38b1eca1679e0e5c03f2cbN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3192
-
-
C:\AdobeBH\devoptiec.exeC:\AdobeBH\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeBH\devoptiec.exe
- Size 2.6MB
- SHA256 e83d36ed1ca111bef5b0aded497a88f66a9414e27083f7a780f2b61de32846f3
- MD5 4a675ae2aa22e2ee3d6bd4800a6c3b4f
- SHA1 0ae7b4a241728aedf4b30d01d4e0a521fc3f5564
- SHA512 b788c5127c1c8f23c20cdb518298d17e64364880d5c85d8b5b4dbe17408f8f4de4c0f841f0d70ec5c93b46877db7ab79ace3fe3a8ba494fd0e7b16f649d807db
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bS:sxX7QnxrloE5dpUp4b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZNA\dobxsys.exe
- Size 2.6MB
- SHA256 ee2fde02e20a8dcfcb899e10f0032b79b7858c5fe11dc4395c154560077ea4b2
- MD5 5a5a4cb8cb10eb81c489044d4fa6e4e0
- SHA1 2905091639d2a508aa217e79de61a6aa0c2ef002
- SHA512 c8121191c6ebf1c5adab1204727194ac9852bb042e47bcb34d34711d759bc8cbe0102d9c6e7b6ffa3721f8e31779daedcf70b41704313ed3171a1e5cf818792b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bS:sxX7QnxrloE5dpUpEb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZNA\dobxsys.exe
- Size 2.6MB
- SHA256 2367b89dc7853d1ee90ab6dfbe3ed3e6a60f5ccba252a028f8f989e626ab4875
- MD5 5a25f975680b11246e55199aeeaa04d4
- SHA1 f2ff085c2ddc9a28f2b0f9554f8d596124185227
- SHA512 613171853f248a76f20dc0ccd34259bfe4c48f1671206a76a7284c01229a0a40e2afa812df615c6054c4e25b85bbf57edf95a4faada6dae342d4edc7f86b5e01
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bS:sxX7QnxrloE5dpUpTb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 5d8629a14ebd7b4319309d39edc4df6604d13f1fd933798da97d8ba3b70548a8
- MD5 46def1d66eb28d58c71cc9d8a2b9c8d3
- SHA1 ea7a80fbe34a64ea9f3bd9c8924f0a1fd5a13731
- SHA512 df5ca29ccc9850059edf6704a9139eee0b47654c9fbdc42ae779dc9a767b8c58f2d896a2989e2080aa3908bd4484ab6a54c8212c8b25d8907f81f77c6cf15633
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 96c579ad06a41715bd77591f96db251bcd0c37d0b54fcfbd949ba4e34ea3caa1
- MD5 fc684036e64edad79117f5fade0c2231
- SHA1 70e8efeea960a5de9e490b6a4fcfa035b734cf5b
- SHA512 344e0cd73831fe5f64bd0c22c60847a59daa5db60265728e94c86778d6464a056656027059a560868ae2464cb7c81eca167c2085a10f35b258c523cb079bd540
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
- Size 2.6MB
- SHA256 15f0e6e95044d13170c8afed119df062a90224e693aa978cf4b82115a80b796f
- MD5 e3edc7f74ae3fe4975cda71008fca9de
- SHA1 ed143fd67b32a3ffc58b5bd2d4393607fc0cd902
- SHA512 bc8bb5c982159959dc473edafa6ba9d7d3242e2df148ba74a9c9d337acb40f8fc71bfbff157f2a7adae2781b8db469ea572ff7e06b2b78993f4adbf0dddb7d7c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bS:sxX7QnxrloE5dpUpNb
- MD5 SHA1 SHA512 SSDEEP