Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe
- Size 2.6MB
- Sample241110-jd68vsvrer
- SHA256 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72f
- MD5 1101f8b16cd9dd69d1a9a2fb4bf19410
- SHA1 25160918ca2ec81f5bd3db023d8df86044b85402
- SHA512 2461b56c13a640db68e54e11fb92aa23244a1e5287656eb13af04a4e88f643cc16143b055701f6e46e1aa4efea7dea7d24edad05f232c49f86c6ba94daf1dbfc
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bS:sxX7QnxrloE5dpUpab
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe - Executes dropped EXE 2 IoCs
pid Process 3576 locdevdob.exe 1580 xbodsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvXM\\xbodsys.exe" aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZIL\\optiasys.exe" aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe 3576 locdevdob.exe 3576 locdevdob.exe 1580 xbodsys.exe 1580 xbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2452 wrote to memory of 3576 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 87 PID 2452 wrote to memory of 3576 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 87 PID 2452 wrote to memory of 3576 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 87 PID 2452 wrote to memory of 1580 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 88 PID 2452 wrote to memory of 1580 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 88 PID 2452 wrote to memory of 1580 2452 aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe"C:\Users\Admin\AppData\Local\Temp\aa4728aeb9f2feb096640e62415a4639988346ce19ccd0c41d893d25f74ac72fN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3576
-
-
C:\SysDrvXM\xbodsys.exeC:\SysDrvXM\xbodsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZIL\optiasys.exe
- Size 2.6MB
- SHA256 49de870b2ac2f683c760ee92f364b9ab3515b300410a60114eff7d3814692c3b
- MD5 437f9937060a42e94a48e552382265aa
- SHA1 152146d035b930a56a7ea2f27bcebc39c89674f3
- SHA512 2279a3756462dd35b2e2415156e9acfbda36b9ace69550e2421aca4baea2d5fbcadfe566d7adb82fb215514db0aa967e946035d9e34a4793d8dfe98611cedbcb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bS:sxX7QnxrloE5dpUpFb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZIL\optiasys.exe
- Size 2.6MB
- SHA256 352fb41a60c94d9e6c3c454bdbb013f5a74cbcbe888836b0fdf34e7bb5f9608f
- MD5 1154bc9826d27624c7c70d456c527525
- SHA1 5ea59c82c294f435eb591f119971d97e37ecfb61
- SHA512 ac35f08a8b41d725884203917d1fe722bf558dea5baaa7f27cb9bbc0c7ff99aee2b689ca3b0e60c7e7f2863eb6a8012adb0ba8380844d240177438ba2c061ba3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bS:sxX7QnxrloE5dpUpeb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvXM\xbodsys.exe
- Size 2.6MB
- SHA256 f7205ec7c3a3e30f8d3e8247d400236df40190bb7abf1bb3614b9a0980c3cfac
- MD5 408656f990e40c8aa08926ca94507fce
- SHA1 b26bacb75494c7e29876652dba75327e1c43c365
- SHA512 80a7f888af9bac2df40ed4948ea3098325d9daa02a3b9afc43bc3c592309dd114b91d6be1941f6fbd90ecfb93633783f994fa84addc4feae91517e720bfcddad
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bS:sxX7QnxrloE5dpUpIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 6c8fa8d3200c336d100355f058d9661d7541faf238369b005c1029a1e83b9fd1
- MD5 cde90bd588790b30d09e33664ff4b0e6
- SHA1 2a40cd7eabc0464150cb2f32d88ad11ee0a15a53
- SHA512 c0b1b7c57bd332c6fae7d19741a7efbd24f83e37907f6f0f8fb24e1e757e5e1663f842c6c7a81abd541868dec687fa27283dfc82414069be9874487ef65ba0b7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 660bc9235a70169750f01cddde8bdfcbdd459e32cd37a94b3c549956e22cbea3
- MD5 75f1ebfa072ac1785b0b4c4f4916486c
- SHA1 1168ef96f59f63d76d0eb1085c40a16b82d8a07d
- SHA512 a8db19392556c35adbaeea07bfcbc55b620b5f8888c8045827ea879929f52213ba8a5a811295ce82bd364f8788500a7e7074c21c89c8f14458574c5645a76aee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe
- Size 2.6MB
- SHA256 0a962f8f60a93efeb61fe36d90ac55095191d5a6acd81cf08db30a9206282db8
- MD5 755b2a36f7356e70f1f989617b6a6565
- SHA1 4894ab830447a28bde1774a327ee4707c06caf38
- SHA512 915143212552d1d2981978c0e08b1525df8ac9d73c95b260abf158ac55b286716c1803309aebbc1f07644ebe8a1d656df60983a42e196b5ac182a994ed415005
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBhB/bS:sxX7QnxrloE5dpUpCb
- MD5 SHA1 SHA512 SSDEEP