Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe
- Size 2.6MB
- Sample241111-xdreasspd1
- SHA256 545be6faf7f728eff440d04b7d1ee255a34ec00db8107247263e5595c82f5abb
- MD5 cb7ce04d4e757f1a97e32b17997185d9
- SHA1 2f234b7469cd9ba465a2007577de34223f20f7ca
- SHA512 d7c05552e962ebf90f31f6a6f7c217dba95afed094d1ab55369551b49b99ecdb570bb8e0b3903248b5361b2565c713a25efc5919c79a9f9e1c04cff8cf0eaa7a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bSq9:sxX7QnxrloE5dpUpAbV9
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe - Executes dropped EXE 2 IoCs
pid Process 1728 ecabod.exe 5096 aoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeFA\\aoptisys.exe" bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB80\\optidevsys.exe" bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecabod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe 1728 ecabod.exe 1728 ecabod.exe 5096 aoptisys.exe 5096 aoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3888 wrote to memory of 1728 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 87 PID 3888 wrote to memory of 1728 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 87 PID 3888 wrote to memory of 1728 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 87 PID 3888 wrote to memory of 5096 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 88 PID 3888 wrote to memory of 5096 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 88 PID 3888 wrote to memory of 5096 3888 bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe"C:\Users\Admin\AppData\Local\Temp\bc61ded733a7c067277c9e03c1750fdacfe421072da6fb8d847ac49aa6dfbd70N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1728
-
-
C:\AdobeFA\aoptisys.exeC:\AdobeFA\aoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeFA\aoptisys.exe
- Size 2.6MB
- SHA256 0f2878ebe5f873840fd281b3b32c44081a508ee505de90f470a5a029ecc02f52
- MD5 2a2840105efbf33ee36350377d001109
- SHA1 473f215d59d636e3667549abc6a3a87aeec00104
- SHA512 f77a5ce6e7778c0f7280d002d1dc26859bdda5d9c1db784a7c1af29a9402e4022da2c65ebb0ebc072cd9939157fb5ae7edc31c4ede9d46cbd1aca4004fc2967d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bSq:sxX7QnxrloE5dpUpcbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB80\optidevsys.exe
- Size 2.6MB
- SHA256 c110f507c523bad07e3f2c8678704ba46d8636c05d913ce648e1c69a35d47f26
- MD5 e4c03aacb0dc084e9496a1dab35f8ee4
- SHA1 762aa279cdbf80c025bbe4e2ac0c4a8f18f082a9
- SHA512 a1db43b95803fe79c16539e9ca3f7397c2ada6c3ea7c3c1d3d9c88d4374ee2265848517998d8e25cd0ca40175445dfe86839fc36a27b9c0ba186c9c942e51a17
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBZB/bSq:sxX7QnxrloE5dpUp+bV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB80\optidevsys.exe
- Size 2.6MB
- SHA256 e59c8ffa34c83603809f471603ab3fe45b28e158feb7b37cdca54eef60563f40
- MD5 cfcf700f36edacac878db1e3a28408a6
- SHA1 90fc0a4b04420177541f08dcdda62d9419a3b7d3
- SHA512 031e83336105bf6290b057ad619e815bf849408793a537dee74ef194578212c435927e20befeeca68078f624254f3a22c5fd6de1e6eedd581fef5cff44998784
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bSq:sxX7QnxrloE5dpUptbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 4a76543ca2503aad517f187944df8e194e2473af71eaa8ef0eed093f63648c5a
- MD5 949e3a096b8aa8a8dd8d7354bb908e4e
- SHA1 1d2b31a4b31e1d5c44ff27a5db41ed57e8e8632f
- SHA512 b402f824dd11c4513e878dd412ed71c25590b4d5c05b58cc399b97b39cd931df3aa54974fd1565b293706a1c7eca03aed0abafcc2244b50974c57254d6916d85
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 2374a9eb45a46e4a1eaa6ab9ff55f89670e6f873a372257db3a0670b75958c3a
- MD5 4165bc31a24d049bc1e3525993635554
- SHA1 f401565da3d727433c4eaf198c828eac0dee815e
- SHA512 9760df46493afb6f487013d3650fc373abf4e26b3a84c1c4610e25a6f0bc32926d385043d26f6e59d34a519b84a704a2e9f4814920864a2535512ba18e170be2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.6MB
- SHA256 0a857e6ce825c5a9655eef6ce085f9d8e592c51707b21c79951a097e8c776222
- MD5 73ea7d5e7e64d6589cb3c95beb691b71
- SHA1 f2fecd5479c8164955292d2f404884f8a5ad8dd1
- SHA512 065e987cfe5fce47c2b2143f84920b9d24c09bc5d1cf449987fe7ff1ece4b947c2f9518996829c183e6727cd5f321795edf4b10536b60151f1503e6deb13d770
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSq:sxX7QnxrloE5dpUpPbV
- MD5 SHA1 SHA512 SSDEEP