Analysis
- max time kernel
120s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe
- Size 2.6MB
- Sample241112-nsv7cssanp
- SHA256 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705
- MD5 2968c22670700c270970c6024d811823
- SHA1 6ac423ca42ad76dd9322d5fbc4de728748ff4c71
- SHA512 dae93d65b2e21b0b776f3e694cfbbc7a976f4db68893aa75b9e2157df9ef18b3ba76a3122141e163328171f6071dd2ea49991ece23d002243f495df8eb15269a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBWB/bSe:sxX7QnxrloE5dpUpJbR
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe - Executes dropped EXE 2 IoCs
pid Process 3864 sysxopti.exe 4904 xdobloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesDP\\xdobloc.exe" 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidAS\\bodaloc.exe" 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobloc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysxopti.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe 3864 sysxopti.exe 3864 sysxopti.exe 4904 xdobloc.exe 4904 xdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2764 wrote to memory of 3864 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 88 PID 2764 wrote to memory of 3864 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 88 PID 2764 wrote to memory of 3864 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 88 PID 2764 wrote to memory of 4904 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 90 PID 2764 wrote to memory of 4904 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 90 PID 2764 wrote to memory of 4904 2764 57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe"C:\Users\Admin\AppData\Local\Temp\57d6ddb306e42d22778fe4548c3a67be7bb3768fe3d095668f5c6974892ed705.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3864
-
-
C:\FilesDP\xdobloc.exeC:\FilesDP\xdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesDP\xdobloc.exe
- Size 696KB
- SHA256 80b270c34b5182cf5031b038a7debbe8e29b2515219cd73ac605d2b27aa03ef0
- MD5 f9fb21301ed795079ba94b9f25e82fb2
- SHA1 586bfd3f97dda787efc20ff2f1f5b2df672cda2b
- SHA512 bff73373449b8874778ce522e7bfec88f0254cb98a23380c0e639366fc56154528ef9ee355155b4839d78a6e5d0f061c1cbcdaa0ac2d2613e7ec7d5884191e8e
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCchb:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\FilesDP\xdobloc.exe
- Size 2.6MB
- SHA256 a5b2e146647b2e0ee0789c50f8be4ce8dd4d2eae72f828979d32d5330b44ebfe
- MD5 fe2af36413308aba87011e67d590505c
- SHA1 cfcf55e30198a99c3d01a8acef51492fae66ecc8
- SHA512 359eeeb858cfaa312caa7d26342694704d6c9f835f033cec2d466150b64d9199b67788aca294a330f08ef2d3dcd76e7c570823ade5418bc545908f41c3b91b11
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBGB/bS:sxX7QnxrloE5dpUpRb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 200B
- SHA256 1b6af948b504ff71ee95092ab5bb4c33847fbfc739027ab5353e25411d31cad1
- MD5 a4a055558753858a534ea31d9e643634
- SHA1 bd462f4481ba8df8ba2798d321ba4d553e235e96
- SHA512 0e94f0ef01fadcf3ec1520760a134dc9974f5d0ac2f7847aed4ef97b38a52bf5b9a96d3c7f706010ce2d54ec6c4af157c9eaa2294d8372c16858f4a12d89288a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 168B
- SHA256 8fdf58581bda34db4a4a9d2e0d6b43697eaf2f45f611a8e6c2bfb37be640ad23
- MD5 b1a77c3d7de3948a9d8d19af2249cc83
- SHA1 d9a8802216f806e099aedeb733e5a6824f801334
- SHA512 533d2517dd8438f092ef677e8e7423e58fd0dd88ac1a0453dff9438c4abc19019baf25ca16a90f9ec1349293ef489d029ce1a3d14e1ed046d37fbaabd0944778
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe
- Size 2.6MB
- SHA256 107789c242929bacee9abfd7f696db31ebfd1ebe0aaededbe27a4d932d734e0f
- MD5 40604ef6067e5780252714b58e6d072a
- SHA1 63c952a1102dd9ce2a2564e97a49fc3850d762da
- SHA512 96e585f3726a5a45165dff683e6ec93539c7ec25c72557d0abc4e2a210d97cfe03a77767e76c1f192abb21a22857c2301516681e9d8219800043fd322aa3dad6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSu:sxX7QnxrloE5dpUpIbJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidAS\bodaloc.exe
- Size 2.6MB
- SHA256 bdcba39bcb84c8f2b5114502e0b949f1a9a5f05f64dff4782301c0c5980a87ab
- MD5 3ab0f3b6bf8657b4209a3f3782f7bb7e
- SHA1 4f23ce1c4a1592bb7542ae49ef79d2f209519188
- SHA512 4f0fc7741e4d466d4474460226c74d63a660f4c6dba7c7f8b9fa3d8c1616ec65f4595e417124a96c6104cdb39c6cf89a278316948879f4133207ebfb8a701470
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUpob
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidAS\bodaloc.exe
- Size 2.6MB
- SHA256 e59d806629c7f7493ea0c5283269586522e100032c3d826cfe5565c0ca9428e9
- MD5 4086f5872427652452ce37b460b5e03f
- SHA1 f699d337bd6f413af624216a7bea8d34b9f3a45b
- SHA512 105d0da3573d4241da12c6556483608f6a02dd5ed4994d07a791f82c5d8f7ccb8ef8745dae6dad3dac93aeffbfc22d17abc7d05d3157f6f584338248ca230460
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bS:sxX7QnxrloE5dpUp8b
- MD5 SHA1 SHA512 SSDEEP