Analysis
- max time kernel
119s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 18:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe
- Size 2.6MB
- Sample241111-w3k35ssmes
- SHA256 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612
- MD5 94e67c10efa656f8a352407eeaefd480
- SHA1 71df2342658d48b3cbe936cf0f7a0a1c15e15798
- SHA512 171af7fd6184d28d2f79cdf3a0d087bd275b15d35cedf2e7397c8713b85de10263931dec95c97bcfe3f876590dfa2eefee18dd0faaa3d750af992a41977bf33a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBWB/bS:sxX7QnxrloE5dpUpJb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe - Executes dropped EXE 2 IoCs
pid Process 2232 ecxdob.exe 4008 aoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvCU\\aoptisys.exe" 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintJ1\\dobxsys.exe" 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecxdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe 2232 ecxdob.exe 2232 ecxdob.exe 4008 aoptisys.exe 4008 aoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2232 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 90 PID 4920 wrote to memory of 2232 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 90 PID 4920 wrote to memory of 2232 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 90 PID 4920 wrote to memory of 4008 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 92 PID 4920 wrote to memory of 4008 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 92 PID 4920 wrote to memory of 4008 4920 9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe"C:\Users\Admin\AppData\Local\Temp\9ee9359622cfe0f1a2533cefc5d99ba24f5ef483fe64ae023fa1655936030612N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\SysDrvCU\aoptisys.exeC:\SysDrvCU\aoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintJ1\dobxsys.exe
- Size 2.6MB
- SHA256 c5af869f1c962e7fa382fc66c5bdf91f7a1ef02f7594239e26ea0e9dda9dd493
- MD5 1b7433f23d5522cba1d51735ca110db6
- SHA1 d23d5ea5eb4c371ef09585cdd139da066237a2eb
- SHA512 a15b566e4a98dd2a727ca96fd7c5c1b2b091cba39beba98fb0449191955c3b7e1f9ddd08fceeae12ee6e87a8e10575e22fabd41641e848da752a35af640be816
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bS:sxX7QnxrloE5dpUpKb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintJ1\dobxsys.exe
- Size 17KB
- SHA256 0ce0efd3c2aeed662f19833d3c79744b8359494af12b382b3e7777d0c7994675
- MD5 b368be22b6f3efa4cb1810b4e2cb27d5
- SHA1 96d9349871e2237380f6a6a964652272f27904cf
- SHA512 af2f2195302b6a944a5992be11177f07c76f88b892b66482c2c157ae316974d20fe28185e8aebe84e480ad1d768f3116cf63f72f7876477c9534741de1d0a0c9
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKYLJSl:04ezXTIk/IxT/ES70S7TqOODVtLi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvCU\aoptisys.exe
- Size 1.3MB
- SHA256 321d6fdcf3f7430aac0ebd334030babb07ee04e02c0450247b81571cd937d753
- MD5 9eefa76c26dd86b7826d5271ad4c06a6
- SHA1 5efe674c69239738e0916ab9b6b1712b283e3cc3
- SHA512 d89d1b252c9b2c287cae7c273a2a47a91bc1334f5bdae8a18783895b04bbbfed32691e3ec0f07b921594b7027b0dc753a992f099d0e1b89c486229558e7819b5
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDv:sxX7665YxRVplZzSKntlGIiz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvCU\aoptisys.exe
- Size 2.6MB
- SHA256 bd4e3871021d3ea80ec6bc8866cfd298bdedaa227bc2d8b703224f609551201b
- MD5 fc8b39f1e469a2822a9e8e7c6892bb16
- SHA1 46ad18055782b9b5970351d8ce10e53a6469bf63
- SHA512 e135327173e830b0c8f3dd735a77dcab4ab5ea27fdcab1bc78ec250e4da1d4f1855158d890ec21e83a328440bc506e69df38fb66092e2fcc0ef14f728df5744f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bS:sxX7QnxrloE5dpUpEb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 2bb42cf35778f62d94f410f2b2654b8f8db76e01c19125d84957e66514683743
- MD5 51dd93d36e2abc71acf8beb29232fb8c
- SHA1 6e20e155e458de709ec37fccb4315b6b01f4bbfd
- SHA512 1c3b164eff8a9796779d99fc07c85ec8c38586ae7c5fd37b3e6e3792ddf2f4ec9fa258e77ae94e5769a11a69296892a1d766b8ec004b8ebeef9637c08ffc5fef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 ed9f90c386429e14bde8cdc5d8bbca31a7d2e7c504033f2edbb7db5a8337fb4d
- MD5 53e56e4f27850a6085701506beb21197
- SHA1 690210f49f79a04f0d8e2ee14e0551fe8df7af13
- SHA512 2a77a8e59916a6541958646b7ae6095af29845c00666bd3fc2a2cec79eafb8496b92dcff82284988b09d07568f65e845c778bac099a442af75174427348b669c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe
- Size 2.6MB
- SHA256 c8e4ba5ba613350c10fff254e646447d250da7997e40289c5b99bea3940212a3
- MD5 88edd757f551a8f052af3b024e21dede
- SHA1 61b58d143a197b85ad1d2024feb6059bfe26eafd
- SHA512 70ac855f37396d1aa61320eaa05ef119c1655fecdcc81fd4f07c4d460eb07e43beb882d2da7ed79b263937c97e73f461fe510e0e9d7c651384696da339cf1b35
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bS:sxX7QnxrloE5dpUpQb
- MD5 SHA1 SHA512 SSDEEP