Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 18:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe
- Size 2.6MB
- Sample241109-wsfqnsylev
- SHA256 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444
- MD5 5cd4e5346fe0c5703d08781aa5e64d60
- SHA1 8e2b3639f6fe017cb446ce093ecb1a8a0da8ec82
- SHA512 e0a8d5c14d8a4653a54c02fcebc5950075af8e073c7fc04f11fa3981c371d50973c7cee9059c3cf6f6555e673ab906242fdb0e00819dbbb34fa7f3027e51bfa3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bS:sxX7QnxrloE5dpUpXb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe - Executes dropped EXE 2 IoCs
pid Process 3716 locaopti.exe 3192 xbodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeL0\\xbodloc.exe" 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZLO\\optiasys.exe" 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locaopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe 3716 locaopti.exe 3716 locaopti.exe 3192 xbodloc.exe 3192 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1080 wrote to memory of 3716 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 89 PID 1080 wrote to memory of 3716 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 89 PID 1080 wrote to memory of 3716 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 89 PID 1080 wrote to memory of 3192 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 91 PID 1080 wrote to memory of 3192 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 91 PID 1080 wrote to memory of 3192 1080 577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe"C:\Users\Admin\AppData\Local\Temp\577b32bc929eda1fca86a224cb986261fa1a92eccc961418bd6fca6b8fae2444N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3716
-
-
C:\AdobeL0\xbodloc.exeC:\AdobeL0\xbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeL0\xbodloc.exe
- Size 2.6MB
- SHA256 0ab50f049d6ff88e216c3eab384a631ff7fa4f0dd1cf497b3cf98bdb8e477fbd
- MD5 e3acbc99c1e747ccc42101ea3e60e7f1
- SHA1 8024f3314ec06d0c6724678049535e9fa4973053
- SHA512 8dd80edc9c7571a936473149d1ef34ad9b7b7eb3140324de0591412cab7bc22bd3fd66493c01dcc2a1b08c38df2e565de3d606acdbc9bbd75cbd7456d46fc516
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUp7b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZLO\optiasys.exe
- Size 449KB
- SHA256 3a4795d72d44f556dd3882e474a4da4afefbad92c114981c63d40766b88b2575
- MD5 756ae9e3e3cbafc68f9b564e7212601b
- SHA1 0a8e76bcb77ba037bc2461e105a551ec11cfc320
- SHA512 af3e90313b82bf1dcd94309c3bdfa6c4f9493abefed30061d53ac8f93451595bb5a5643f5b47639c0e5a39252d3af26c6ee216e599e632084368d310809744e9
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOw:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5Xb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZLO\optiasys.exe
- Size 2.6MB
- SHA256 ce3614faf2313817936644aa8d492b5ff00d26029983c47a9037f91d5c4072c4
- MD5 39e8338ca86f0c9c30b76944ecc5f092
- SHA1 812e89007366b2f3c5125c0b8b27e2caa09c2e24
- SHA512 33829e549a8a5b3eaed71aca171b494bc3f97b1836723c76f6a4440d372f6369b0553560ae23f305ce7453ec18684d2a2e99505a957d303a81af46bc801e987e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bS:sxX7QnxrloE5dpUpCb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 55c7be59b605cb8bdd35a0be8045e90746550a946a19ace681485187d3031f7b
- MD5 6c778afdc5b48cf140b1ad0779e66f44
- SHA1 76cac4c97b720477016508d3206d0d2b67d7ef58
- SHA512 7d6faf2ec9cea988c7f4db9d21cc25f29e4e792670c97413d3f3a619843cc076f46d350b10acac7c168a01193103d8768168875d10eb8d68d0c3be4bc381d2d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 3d71f12dbcba0961072d46d88ffe6b8599586daf7986716cd1d261a8a2bbbfae
- MD5 3b2a3c057c848a9e9ce4a46aed63f980
- SHA1 8b83b39f381601ce6d628703d046551153f2f5b2
- SHA512 adcb5562789304155057239f0e9fe247fe60bb7ebe7bebc6ddcae364112f129f46a7bb7053c25012187b82a076b93c83b2fd1cd0bafa4e95f40bc01d8643c0bf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locaopti.exe
- Size 2.6MB
- SHA256 e474b2e49b192f427f7dcc5445e1c833745ca6ea0f308735cd632df96fcf33cb
- MD5 bd56ded5230668f3a26dd6c6afe8442b
- SHA1 3d49384fda5c839642050b2ab0bea39196ce1fb8
- SHA512 9e3fdcb7c344d47e7dffc87fb5fb50eda8518d63466fd8e6cf36d3565aa08e447a747c8a49646c90f84201133e9fc97cdabbe1a133abb245e3d7f66df50be6b3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUpLb
- MD5 SHA1 SHA512 SSDEEP