Analysis
- max time kernel
119s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe
- Size 2.6MB
- Sample241111-xaqctstdnq
- SHA256 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256
- MD5 b5414342781808e15bd275757ee2a20b
- SHA1 88adcac3cf967e8bd070cb5503fd200415d18a18
- SHA512 9a96c34a7492234f1a438fa85b80e219c7714b179d15c06a35c804eb9b81aad91dfa3f67961ebe346a3d6b937f5f85971b482c98ed2de2594481d8dfb786fcec
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bS2:sxX7QnxrloE5dpUpHbj
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe - Executes dropped EXE 2 IoCs
pid Process 3332 locadob.exe 4876 xoptiec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc2X\\xoptiec.exe" c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB1G\\optixloc.exe" c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptiec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe 3332 locadob.exe 3332 locadob.exe 4876 xoptiec.exe 4876 xoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3364 wrote to memory of 3332 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 87 PID 3364 wrote to memory of 3332 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 87 PID 3364 wrote to memory of 3332 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 87 PID 3364 wrote to memory of 4876 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 88 PID 3364 wrote to memory of 4876 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 88 PID 3364 wrote to memory of 4876 3364 c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe"C:\Users\Admin\AppData\Local\Temp\c31be430b3edbc9ab00fe107ac03d5d5bcac27e1b30bb0ad252886f1a6e2f256.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3332
-
-
C:\Intelproc2X\xoptiec.exeC:\Intelproc2X\xoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Intelproc2X\xoptiec.exe
- Size 34KB
- SHA256 88a7aaa6ca2d12bd6b9fc937f66ce4f4d6f76af821f435fec86539f35643c860
- MD5 d1662fd033f4bf52b818412c6603c618
- SHA1 c0e64e8dde424f62ada571d47e60f3d2a2af11b4
- SHA512 cd9b810be3862479b5b9c47c543e12f2378cd0da8dbee2ba9d769e47dfe8fc6d9f82226e848d72b6a4548e090c54dd3650e3b6c7524330e28555cd85c2bc1d66
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6d:ABalOBo1TKFO3n0KkZHqXI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Intelproc2X\xoptiec.exe
- Size 2.6MB
- SHA256 6366dbe411a6116181500516bb32e151777ea35f9c2567055be9109ad5ad4da3
- MD5 6aa9742730b84251f024494e13c4c7f7
- SHA1 e621dea7a7e48ce52099f6b9f0f998cbc32e1041
- SHA512 0a7b2e85128a18f5efad79b4d4ba6e7d4e33c420af9726b82090eda878325723cf5cb5b23a52490bac509da5747255a108e05474b374bb746a07829130a05fe1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUprb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB1G\optixloc.exe
- Size 2.6MB
- SHA256 99ad0d313f6954e20b254832d1a56746774913d46999f2511758e12efbd6fb8a
- MD5 a47275ab4fe3c79244814f4c32d3dc94
- SHA1 6ced1fdc9d7a8e172f9e14dd86dfc957fb83cda3
- SHA512 78b63ed1ebe8d1878460e841d1c607145c148c0dc3a7361c6df224a1390986615c1307d3d2a92ed81d7568ca7376bc3b59827e3aea5b63796d4bb995199cf1b5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bS:sxX7QnxrloE5dpUpbb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB1G\optixloc.exe
- Size 15KB
- SHA256 e437e0733cdde421f32dedbcb49fb69873f23116dc2523e2a45b18e005fd1559
- MD5 10e6df3619bbbd1a2464d5000a56fbb5
- SHA1 9080f324c059847c04fbc434d62d8ab2e06140a9
- SHA512 9cf956066c20f94e36fc21e8c536ef7625e51e279c3c9794d5029cac42d155db5a2e79ccfe4010364e50c34b0675745a5fc121a112892a31b331ab14427ac6ff
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKYB:04ezXTIk/IxT/ES70S7TqOODVtB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 94934d550483b485f0b07a4400b6a2ecc3c493a4e52c2c2551886feac831df89
- MD5 f16e74ce96e06a1c39f8fa2e2744fb57
- SHA1 abf1ae74d6b43023603fead419cafa4dc9f6894b
- SHA512 b83a5f4635b8bc66246e5774d039f2f81de938ed5b57c2cab981143e32fc9506cc0e4e7505f0855d7cb505c6ecafaa4a80c54954f7f22efe77f0f19c19687d8c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 90e1513e276dbec3aec524986d93c0d209f2c733bb59f93ca72ba00a32e64023
- MD5 edace9cf9516dafc82901c18ab6e57e8
- SHA1 9e9f17e42c6a7f5a92c2e2c77254c3a069267c91
- SHA512 24ac028992d109cd3931b8effe92d7db3b32aa3a5ff08718b8d9318dc66d1ac30b800cee4cea92f50a7aec6c877c63e28486bbf6961ec6e2ef80ef55e6f292f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe
- Size 2.6MB
- SHA256 617ece4b3cf4fbfa5ff81d3341570a1911fc7e3c29e897545cfee7761c72ccdb
- MD5 bcbda1d07468ea26f4060d4800bdd7b1
- SHA1 6418571a74337dab60936e729f36c84d6ca073eb
- SHA512 68c21493130074063befb92ac8661f1d8315a5d83887b1dddd6324ca565f821aab0a10a186e74a439aabb918b525b37196b145b855c0f7d790f348b64a4c2842
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bS:sxX7QnxrloE5dpUpgb
- MD5 SHA1 SHA512 SSDEEP