Analysis
- max time kernel
119s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe
- Size 2.6MB
- Sample241109-wxdrwazblb
- SHA256 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00
- MD5 81dd0e31eadfaa34fe4e4c3beb0e8290
- SHA1 d687a66f1ee5b50481d2175e8d85c430d9f8b8b8
- SHA512 145322a50b5a79a046fa8dccdf02f5431cfe2940b81751c750ad291938640e96ddebaea74771a8d09fb5288f632da398572f7596b1f098a9ebb94e2fc741f969
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bS:sxX7QnxrloE5dpUpsb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe - Executes dropped EXE 2 IoCs
pid Process 2944 ecadob.exe 1048 xoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxEX\\optidevloc.exe" 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesZJ\\xoptisys.exe" 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe 2944 ecadob.exe 2944 ecadob.exe 1048 xoptisys.exe 1048 xoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1220 wrote to memory of 2944 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 88 PID 1220 wrote to memory of 2944 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 88 PID 1220 wrote to memory of 2944 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 88 PID 1220 wrote to memory of 1048 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 92 PID 1220 wrote to memory of 1048 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 92 PID 1220 wrote to memory of 1048 1220 21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe"C:\Users\Admin\AppData\Local\Temp\21ecd50863b90dbc2117da9454925b6a1984d2523075e8d09a535f1a23310f00N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
C:\FilesZJ\xoptisys.exeC:\FilesZJ\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesZJ\xoptisys.exe
- Size 2.6MB
- SHA256 80cdfc15a6036a1e2fc1a017119855155f9c6c78d1cbb25ef07c0c0d225e8425
- MD5 e0aedaae6151a82ee1622677d9da6097
- SHA1 aa6d15e61672e53586d9af4666d97c762683bda0
- SHA512 86bf0c282fa52648c8cbb3e03e996401aedd59c5353e4f78f91fbb94565daad9215b3f2716e51c51dc6c4303a1d0f230cdea8a97f5877652ddf8028a5aadedec
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBWB/bS:sxX7QnxrloE5dpUpFb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxEX\optidevloc.exe
- Size 1KB
- SHA256 1b17bb743b1a2dfc12895dffa0a7b9b5daf090d66b71008fe29879bad1786322
- MD5 81306907a8898717e74eee7fe3ec9748
- SHA1 6871f1f920d712de6120473f387e1497841b3829
- SHA512 205b7de43c582a32ad49cb599becf76511d0269af1df1adea82987826d020f7e62e8b53e8f82da5c2f44154cdac459eaa4fb29ea6b720b0cf9d5e5148fb62730
- MD5 SHA1 SHA512
- Path C:\GalaxEX\optidevloc.exe
- Size 2.6MB
- SHA256 327cb249f35f6091b2dcd32c6762ca06ecdcf4d93853c0d28a10f697cdae6b28
- MD5 51977db190ac16f91a3f3f96b130d881
- SHA1 0a402e0b9c295ef12daf86f0bd0421b46c409653
- SHA512 85ef39f48f9043f6854df4cde49ff214a473df61f842351ac13000db7a0e76d97521076064cbab92544b3d1993a4bc7dd2ca4d984baeee394b2fec1deebb24ff
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bS:sxX7QnxrloE5dpUp8b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 14ff64f5097d82c4301c92d3104ac2bbf25c5f64db72f68fa729fb17b546a1cc
- MD5 0a0bf6a4036a448d4227fe38c7d2a7ab
- SHA1 e07493b81886e22f18a44e874c860b687f87726a
- SHA512 20c42eccdd49e4aa8fcb56bd358ffe946e19ad71bf3296e92af0fd06d6177deba6e34abdbf70a0246c1fc97ce8410f40ecd6181d2b5c9023faacaa9206dd3369
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 4e155448e58fab65082eb4c7fd181382bb05774d03ecbfee4fde8d32f5f16b9a
- MD5 abf51dbdcf36d39d446bcf6b998da44a
- SHA1 72408373567724ebce5377bb1ab8decbe6792ba7
- SHA512 6b2d9cc637e1e526d8610deb671621070bc0cfa35e263ddf91aa83cfac8a7886bbe69a796407150b78df13930744bc90d561b61e78b3fd7f4f9f4ba83300c776
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 2.6MB
- SHA256 5baf8c6d4fb2e28cb1533948a7395db228688b951ec369a0c05f2adc3aa9634d
- MD5 df9f0ab7bcae17cd17927e9df4a81547
- SHA1 c03c6625c28cee57a4e9d546c70bc89ef1bb00f2
- SHA512 cf1eedda011d924fc3d248f191b34f63bc081ed7ce57778a50ebdc041d50c233bcd53aca0fdc67f728f88918229a4c518739b405205d14f5374f04399f003245
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bS:sxX7QnxrloE5dpUpKb
- MD5 SHA1 SHA512 SSDEEP