Analysis
-
max time kernel
119s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe
Resource
win10v2004-20241007-en
General
-
Target
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe
-
Size
2.6MB
-
MD5
f3b41a7c2f796c16919a93e2fce98790
-
SHA1
b4d93dd38d255dc20f209a20e87814bc6121a151
-
SHA256
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550
-
SHA512
efb2351ab78d032e4baf49560ead450800e33cae803cfcdce6c7a1260b8624cdf0579752969d722a3dc2fb5122a04bf914da76a1fcf4d63b15c138c8d25e2864
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bS:sxX7QnxrloE5dpUpyb
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe -
Executes dropped EXE 2 IoCs
Processes:
locxbod.exexoptisys.exepid Process 1396 locxbod.exe 2920 xoptisys.exe -
Loads dropped DLL 2 IoCs
Processes:
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exepid Process 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocJQ\\xoptisys.exe" 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxVX\\optiasys.exe" 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exelocxbod.exexoptisys.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locxbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptisys.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exelocxbod.exexoptisys.exepid Process 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 1396 locxbod.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe 2920 xoptisys.exe 1396 locxbod.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exedescription pid Process procid_target PID 2900 wrote to memory of 1396 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 30 PID 2900 wrote to memory of 1396 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 30 PID 2900 wrote to memory of 1396 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 30 PID 2900 wrote to memory of 1396 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 30 PID 2900 wrote to memory of 2920 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 31 PID 2900 wrote to memory of 2920 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 31 PID 2900 wrote to memory of 2920 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 31 PID 2900 wrote to memory of 2920 2900 595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe"C:\Users\Admin\AppData\Local\Temp\595bf5726e74f537f4bc87c53fcd27e34eb901ccfced1c9dd4baf1949470c550N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1396
-
-
C:\IntelprocJQ\xoptisys.exeC:\IntelprocJQ\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD539725a9263bf972f3003b9eebaf3e95b
SHA169ba165f37663bdbd048b022c3be345ddf91cf90
SHA256eb5d0e283d9548a9a4c76dbdbcb3dc5a6c454f97c1a653a40e5b2378ead9a223
SHA512d83ba7f963c4dfa124b535d0dc2c776a2d5109ee971f50577d40b2baa7a58b779f5f84d2d0ebaab8fe1f24a20861e2afc920adaa92099926638c247062904fe1
-
Filesize
2.6MB
MD59e1a42c50a00e8df390d92e7b61fdff9
SHA16c9341d8481de37320a31f4388721143011c37d9
SHA256e59fd9f02f0154ddf51160745374d1e7e9ecb4bed2aacd88314d38fde3f44c42
SHA5127a057748f36145ea318b1444e9659901ebaeb74e4e77d408f19e62c4605eb56909999ede21c8c1b622e620c772a90f0afb9226fe30d017c4300ab59e4ed9dc72
-
Filesize
2.6MB
MD519c41762a5587df5806ca20e08ff4777
SHA19585d6ceb1beede888d7fbd14aee518fd60cef89
SHA25683ef22d1856e37923ebbee5228f8b0471f36bb507cd0380284701b73267e55b6
SHA51214298c598c9b01840d0f6d3490026b3c14a3c94cbbe6606afdac4ade47f98d1cba87bbe79c5bbd7f56bb2133fbcd0336bc58bf7f71c3ac0cf33303684d04722b
-
Filesize
175B
MD5d525108202ce982ba5ea97abe16fdcbe
SHA1b9847cd8e6512ca2d3d1b21e00cba33f316ff5d6
SHA256ab6611473f3d1ccc44d4bb6465b0998f315bfffb9778ed481a72e94a36ed3473
SHA512f4293ab2dd325b6a5a11ee921001a15170738febbf56ae7572b43d6d9480cc3f556477732a4f40a17db33ac34c5cf9fb34b6a6ba2bf6826ac1e739a8c6008106
-
Filesize
207B
MD5013ff852ee117ee4b855c6019b400e1d
SHA1676026d223e3635b8b9acbf304c7ebcdbf039be8
SHA2568a5fce468db46743c57b7039ea4db06a2ea18b3752bbbfa17ed48935905257ec
SHA5128edf2063194c0119adfb772d884810f1e7b1e09bdafc235636f0b32f4f44b57702ba2a02db12365779edc02f02ba27bb5d62c14e32a8b8abcdf60c1482c67761
-
Filesize
2.6MB
MD5193eea43aaf1bcdecaa4401c2c621203
SHA17123bb4173b8217b9741d0e4f7a5d55117283c73
SHA256c953f4f52477080af5b98c6daab6687ad240d19de5a3cc66d14873fe6774f83f
SHA5123b19ffd2b72c03c5cd3e6a68ed89dcf70bedeec12eccf036b21ebf72304ecafc6788469fc9fc9af75c95b8d9fdd59e2b5495a9029e472b6a5e25b995fbf673e2