Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 08:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe
- Size 2.6MB
- Sample241109-kddf8azqa1
- SHA256 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87
- MD5 ea0934e751ae4f47bab1e163e60afc20
- SHA1 f528063dcde9f85b485517378ec614d6c00397ac
- SHA512 4f0407ca78327d35dce746319ca808df0301141932ecb704ece5543bd703eda85e867e06e23b9be69e2337cf3bb15c1824565cae11ac5109d416cccb754df777
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bS:sxX7QnxrloE5dpUpMb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe - Executes dropped EXE 2 IoCs
pid Process 4828 sysabod.exe 2116 xoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeDJ\\xoptisys.exe" e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintC4\\bodaloc.exe" e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptisys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysabod.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe 4828 sysabod.exe 4828 sysabod.exe 2116 xoptisys.exe 2116 xoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2360 wrote to memory of 4828 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 87 PID 2360 wrote to memory of 4828 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 87 PID 2360 wrote to memory of 4828 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 87 PID 2360 wrote to memory of 2116 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 88 PID 2360 wrote to memory of 2116 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 88 PID 2360 wrote to memory of 2116 2360 e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe"C:\Users\Admin\AppData\Local\Temp\e9b5c0ce50abcc8d6fc7e517c849d0c6eb1a08384bbd18ba2294014e99c54c87N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
-
C:\AdobeDJ\xoptisys.exeC:\AdobeDJ\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeDJ\xoptisys.exe
- Size 2.6MB
- SHA256 2a71eee0fd85db1c1937ff526aa91ab0dd7586f443f50c6a6941862aa98e13a8
- MD5 62edadffcd7dd06fa0a9938be9cf9989
- SHA1 8a5ee7b88eb605198bc3cb4833f9830713dabfc1
- SHA512 590b215dc105d890634f798b55043104a69303dfbe0bc958aa73e6ea7f989db6c2694900a6f8a80b6a120e7ad6db21564e5d7178a7059aaec423250567e2bb96
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bS:sxX7QnxrloE5dpUphb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintC4\bodaloc.exe
- Size 960KB
- SHA256 08a4b5f32aa7bfca330b8a9dbeefdbff368334634d17d9ef0acc05c18bdce375
- MD5 b2adb8506844c0a82940d0ccb0443216
- SHA1 58dbecb6a186081889c237c026b398732a3d3ba8
- SHA512 bb116cb0a44910f0cc8932813f4bcf0d6fdaeb81796d37958f36a7ce2b53acd72baf5236083ca308d27705165343653c182666b4e2366b9cd9128e7e43bcb79e
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxf:sxX7665YxRVplZzSKntY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintC4\bodaloc.exe
- Size 2.6MB
- SHA256 a7c8652bde4413a25b4a20f7289c17fbc9ce67328a60283ff3e563e90327d0b6
- MD5 d73ec5ec2eb63bd49909cbd44ddd8218
- SHA1 945bec4cac0aa5e4f8397aa7ede01e2151367c67
- SHA512 f446fca83a63662ebdc284cb243e4fe840c3ed9d580b5d4b5159d5e5e80bb6c345aa7299949bf70ae144605fd5298f195736dd90ae92bc59c480ed0d5c50da77
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBhB/bS:sxX7QnxrloE5dpUpmb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 2b6883df7d4a4c9d05afe649e0f8d566970c51810a0bfc3f4443ba357301f419
- MD5 4153bb5313cfca0c122daf30b56fad7a
- SHA1 fd1ffbedeb5e22f8c1f72d3a5512f2f853bb589e
- SHA512 0297a289166500a5dd2553e02d3590eedb67ca700991cb562a05ba43f333fc91cd73b4f489afcc424c00b3d02ca76a30683030de37bb5c42cb180a7ef8674b1a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 d6eee3577bcd8c1bc029627920b6bd71871807e07e347d07128b41cf8516856a
- MD5 6b791c9954512a79cd4105fda33ec62f
- SHA1 024f9911529668a1535fe4adeb4ef76679846616
- SHA512 376e8a10708ae1ed5693d4b59b29d9f49ee5be56c0eb49e68ca0d181286d079561929ac5da89bdccac25936e77d1ae4ef5253fcd5004be5eebaac77d8729767f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysabod.exe
- Size 2.6MB
- SHA256 23e7f9ff862f3e07cbcbb1ab3f07448992bbc27fcb292070250e3700d66dea23
- MD5 3d8cf55a8577682a44eff7b1ff167a34
- SHA1 95cbf6fbf6d3631274f8cc51b9b38844d37eb183
- SHA512 e854a517c78d352120653848856f62fc5e7eadd4aec50319f01bfbc0915dba0ae3750890bd14dcd2083cfc3c25822b086649d93713f232d632325b6a4111aa89
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bS:sxX7QnxrloE5dpUpGb
- MD5 SHA1 SHA512 SSDEEP