Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe
- Size 2.6MB
- Sample241112-ye4lpazdnj
- SHA256 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f
- MD5 002490aa41ce1589e1c8cce7af7a4446
- SHA1 f18d93098bf20d00111b582bb96f17f9afee20d9
- SHA512 69a976b0b36b5e1dbe5a8f0c9b34ee601824329180aeeeb9e3bdbcfc1ef3c136eb4ad1ed56074d2e331322ce42439bc037bd57f8dcbe91d588c38f20d487c76a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSm:sxX7QnxrloE5dpUpsb3
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe - Executes dropped EXE 2 IoCs
pid Process 856 sysaopti.exe 3508 xbodloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files1S\\xbodloc.exe" 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBOQ\\optiaec.exe" 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysaopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbodloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe 856 sysaopti.exe 856 sysaopti.exe 3508 xbodloc.exe 3508 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4660 wrote to memory of 856 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 87 PID 4660 wrote to memory of 856 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 87 PID 4660 wrote to memory of 856 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 87 PID 4660 wrote to memory of 3508 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 88 PID 4660 wrote to memory of 3508 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 88 PID 4660 wrote to memory of 3508 4660 2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe"C:\Users\Admin\AppData\Local\Temp\2117eb230392cb920aa2d6302448189a185257624f3361636d0dd5dda78eed2f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
C:\Files1S\xbodloc.exeC:\Files1S\xbodloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Files1S\xbodloc.exe
- Size 2.6MB
- SHA256 842b41b41ca9e1a6dbccb73ff6136046883376e67e947501c02acd770749e177
- MD5 02564d6792541391e374e5900edec78f
- SHA1 e0583f94d6770515149269c9992331f4102d6e43
- SHA512 7a3597be9491fb2f4eb079cade8ed339ade5368146b15f4111c3392442b472067d3fb3367222d426829c03af4db22fb3f1d6de4e7ff40ab777852f122ebd38c9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bS:sxX7QnxrloE5dpUpQb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBOQ\optiaec.exe
- Size 2.6MB
- SHA256 582a45b6354166dc011eaaa4ac96b76c1111af2a08b6de3e21f6eef2746665bf
- MD5 ef9111b550e5f60f74c7d39247922975
- SHA1 d2e75517025c84c439bf9f922bae04e8d4e07506
- SHA512 3f51ad1362ed53c4c7c072f1f83d12e569ae5e90f289b70c1c9cd7f9d033c53f3bda4381c7da30884a43c0f302b6cdc61bd816ba489d247f65e7cb0ae3e3d5c2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bS:sxX7QnxrloE5dpUpbb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBOQ\optiaec.exe
- Size 1.7MB
- SHA256 008b5a5a353ad07cde74aeaa19d7aa265fd2468ba633dd27cea2db4788df1f38
- MD5 1a68804b39fff14c67d52cfa5c25ec5a
- SHA1 7db430f96106ee5a5de2e9d69d19d2efedeb91c5
- SHA512 b9147e87cb92a683969c85f05ff32974f5e87ae3dd73f0d66518b9aaff05f6ac282b6511b3f383e9543dc96c2b6d822e609409bdb1ea0da9dcd9cb8b912ba40d
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDg:sxX7665YxRVplZzSKntlGIiT+HvRdpcG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 40da32f78a992be999daa600bd51685178b79f968c5a170f4cd5b90825cc3df3
- MD5 b2f7d5c0f9ce10cadf6f8273903220a8
- SHA1 4248a149860367004ad6017a93aef54a9b7dc5a5
- SHA512 cd4173132302e09a2f83391bbed64955f9384ce3be0da258c9fb9b7af5455df9c09d4f7a6c81924efd1ae3ad7435189c68dc795e5723c11c050b0b54326401fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 b8fc3eea296c2bacd35667b83fec10a4096b7870d1a9bc5c98472912ece39010
- MD5 b50ad40c11403182bdd3e63fd2f51911
- SHA1 c9debdced362fd3d73342c98095711c8e7618aab
- SHA512 5907498aea9387584b07cd26398a0b6eddab56db2f80dd98833002ef20fc6611ee873eeee8e9a7fb517917a4c61e838286647d7c2808b3f929679c3309edea4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe
- Size 2.6MB
- SHA256 35531855a6346780b67e453cb668b8bce24e8db6e00920a3565999be529c1a3d
- MD5 28162ab4d40cc668037547e9767d6e8a
- SHA1 f54e56390cf3b0db3517ab0df2b656b2d98f2207
- SHA512 17e15bda75e0568cb5758de94fdf486e793cd189b064b7c4736d28732239dc4d2fd902b406efe5db36d29ec876d7ced2315b649699a47482b6066c14d19f36d4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bS:sxX7QnxrloE5dpUpxb
- MD5 SHA1 SHA512 SSDEEP