Analysis
- max time kernel
120s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe
- Size 2.6MB
- Sample241111-xdck5stekr
- SHA256 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4
- MD5 a1d767effd471af83153dcb5d9743ae4
- SHA1 37755637b1837a4561aea43dbbf5ba8783e6cfa9
- SHA512 f0166dabd58ea353c4c84dab5d6d0ddb13ee81eadd6f09568a8e4efb5e0f1abe803b66be64cabf8b3915fbabbaeb8f82607afd17fcd62f51a067bd2720ddb426
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bSo:sxX7QnxrloE5dpUpzbj
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe - Executes dropped EXE 2 IoCs
pid Process 4612 locdevbod.exe 4796 xoptiloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotWP\\xoptiloc.exe" 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid8O\\dobaloc.exe" 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevbod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptiloc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe 4612 locdevbod.exe 4612 locdevbod.exe 4796 xoptiloc.exe 4796 xoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1092 wrote to memory of 4612 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 87 PID 1092 wrote to memory of 4612 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 87 PID 1092 wrote to memory of 4612 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 87 PID 1092 wrote to memory of 4796 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 89 PID 1092 wrote to memory of 4796 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 89 PID 1092 wrote to memory of 4796 1092 5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe"C:\Users\Admin\AppData\Local\Temp\5ac1019d8c7c795c552956e499746134d1825212a665d9c9905fd817f3df85b4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4612
-
-
C:\UserDotWP\xoptiloc.exeC:\UserDotWP\xoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDotWP\xoptiloc.exe
- Size 74KB
- SHA256 69ccf86db3dad9028db8622f6c4947225c161bf74fc5ca4bc81c2966ae0ee9c6
- MD5 aa61513f4689eb80551b08e454d38588
- SHA1 24fba699d6fd3fe5efd8ca3ef8158405fad63366
- SHA512 5c39be125957c303ce96ca11317c7ff7647a2635ca36632248c87368be156d6937ef1113012866d8343cb57cd933223c80cd413097def164ca424a20cd7a8fcd
- SSDEEP 1536:ABalOBo1TKFO3n0KkZHqX7+g2lWXQmMc0pgUXwi:6uOByTKI3n0dZHm7+zsMcSgUXw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotWP\xoptiloc.exe
- Size 2.6MB
- SHA256 20fc0ddeeb049a05c30fbf1561ce6eefa7d9cc654ff22be0844bbca0dd1d3a09
- MD5 94c9925459a9eb1de52afd40b4a88ff8
- SHA1 b23bb16de5b5d2c3a78fc3cf766c7924aae0bdf5
- SHA512 d9aabcde293760eb7a0bbf620c9d98b3de458ed30c4df805defc217421a13d01372da70b1bf234b1c08a2643b3da8ce04ec7f7d31b6225750ed26ed2c7948fd8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bS:sxX7QnxrloE5dpUpWb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 a769cf240cdd9afe5e920d72f7bdc0a8fee8bb74613f5872ed1d60a58c55f62b
- MD5 6215d6e198f2414c9bc3cc19f96889a4
- SHA1 a986ec1fde82af4abf4327b0c787127e20881ef4
- SHA512 e3f110c31a926b2a8678a7849b63232f7a0e85040924ef3be0f28ed59e10fd0b9d4bb2e9cd81c18c49d55a5e9a617aaccd586e4b2b395cdb1f9e1c164cf3b4d8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 27c2bcdf315a0ac85eebd9cbf3a7a04c7fa6d32d3a52853f06cd21a57b70b4e9
- MD5 c7ed76f4a4446a86f5b95468dea9772b
- SHA1 4588a67412f12732299d758a81d73c0400da4a90
- SHA512 4512c4cc4c9189f9224dbeaebd82e9c6de71c9ce3efd53174ac34e4f5701b3b67da4957742c5d4eafec7db76276c320f726bebf42f84e2b714739e8e21be8fb5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevbod.exe
- Size 2.6MB
- SHA256 6a8af9dfc17ec9dd6caf8c45eec35bff08019b276826aeefe646f248bf3b8a13
- MD5 4ac5a056b30a81ac42277248ab146d48
- SHA1 d8fbaef9b7114eef23059238f23d512abb04644f
- SHA512 09bec30e90bd7cd45b785f9d3398d8ba8ccfea0c1f9e490c99cafaa985ecb45323bb9c4f79d721555e1f269ff9ea262e696800e767b91880e98b3b92a04dfcab
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bS:sxX7QnxrloE5dpUplb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid8O\dobaloc.exe
- Size 47KB
- SHA256 84d6d0817ce5c493adf72097a099f376c388f65827262367b6baf6c85cd6c5b1
- MD5 cbb3bec55ce90b6e28b47fd7f2cdaede
- SHA1 6ff6a31de3b71aa94154a87e9fe1c8b3a96f4e97
- SHA512 ec12efb466d2b6ac63b222298b91f741e7ec3ec824e4aee5006c2b98bf258012643dbc75c745ac42352fee93a7241eeb7d3254f8bba17a582d7f25d95a1a604d
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkfK:ABalOBo1TKFO3n0KkZHqX7+g2lB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid8O\dobaloc.exe
- Size 2.6MB
- SHA256 f8d3fc8ec2fb976dfa23cf9ab2be051c709a5d1e47e31df37ebe3e59d002fde6
- MD5 dcdcac876704a6fb43e82bfecdc8c00c
- SHA1 d6d27b91e9d0789cf4a7068707e576755def96af
- SHA512 ee0acf03da62b77f1caa7e27089e424b48ba34fbb6b1218b3a7a5b79a40d8023170a3d69efc0a54ca164e8414bf1905b6092474a73e788704d5c3f165964169f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bS:sxX7QnxrloE5dpUpnb
- MD5 SHA1 SHA512 SSDEEP