Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe
- Size 2.6MB
- Sample241112-yeebssymay
- SHA256 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a
- MD5 fa53a8c6f085ea1aa2f9997ae3ea29dc
- SHA1 ad8d8f1069bb902ee4497d06bbd076bdd2bda364
- SHA512 7e4fe99715e1149b74cd9dfa91cf6b74dfed91c4184eb1b8bfdacc07ca5cf84f59eb570a601c14c1d58f83c6c54cb0b264a02c6fe5d1eb75c01042ae3ca51a78
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bS:sxX7QnxrloE5dpUp9b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe - Executes dropped EXE 2 IoCs
pid Process 1660 locxopti.exe 2868 xdobsys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocFD\\xdobsys.exe" 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZYD\\bodxloc.exe" 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locxopti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobsys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe 1660 locxopti.exe 1660 locxopti.exe 2868 xdobsys.exe 2868 xdobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1660 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 87 PID 3008 wrote to memory of 1660 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 87 PID 3008 wrote to memory of 1660 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 87 PID 3008 wrote to memory of 2868 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 91 PID 3008 wrote to memory of 2868 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 91 PID 3008 wrote to memory of 2868 3008 0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe"C:\Users\Admin\AppData\Local\Temp\0f172e02f70fbd7aaec887f0d6cab1f7307d1eb35c90cc535f0be7f3b951ed7a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1660
-
-
C:\IntelprocFD\xdobsys.exeC:\IntelprocFD\xdobsys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocFD\xdobsys.exe
- Size 2.6MB
- SHA256 28b1c852bb497989190bd778d41c1c3db6461e19af6fc3f504be122f6544d727
- MD5 8528a214bec1f5e99ff9f9dcef9e22d3
- SHA1 99a88a1b823a3f61e67534df9c25c075e9001e4d
- SHA512 c9b0174ded53dea8988358c7cb7574f8033bf6b99ce58caa8d1e841db2abd178768d1bf4e072df10ebae0ea47c473d6afccf1a0c3f44655303faa3993a50f984
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bS:sxX7QnxrloE5dpUpXb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZYD\bodxloc.exe
- Size 2.6MB
- SHA256 daf014495fa047173d8d77041157af0f9c8139628793ed6b5a7b3bd852f5b22c
- MD5 b3703a70e44c78080f67c67f6f50133f
- SHA1 184e05cc0ad0caa283165eca3b8b2976b4ecb3e4
- SHA512 4154684439491fea9c7102878afd6bab745c970e4992e51673169561d66a4ad42faa0de743abcd987223ff58fde8910384a612833c1b295a5870d30b5b763c16
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUpTb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZYD\bodxloc.exe
- Size 2.6MB
- SHA256 131726a9343fc8037b30b84a1e01d42c37d00ed8f768ad36d2a85e38ad17a045
- MD5 5d3792d1409e0b0a2519b28d4a34e1df
- SHA1 2b03c057c15127f9463ce63ff39c9f7085dec114
- SHA512 9c26fd6ad8f3d8eba52f0ae383599cdd31f7bc7634975e0f70ed8593b7bdf45df769f66975907ca6f13d5247014216ad51c2e2fdede860ea1db5a2caba71c90a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bS:sxX7QnxrloE5dpUpWb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 7831e9064befc2432d689641969ba63199afe5675b303b50657ec00d6163c09a
- MD5 b755093dd25335f647c3273b7e9c92c7
- SHA1 65d0ce06575369b29b8a9f9ce4ce2856c165d6ae
- SHA512 f0df023608b0a77d3af0674c6e95d232dc3bd4bd24979a840a773d5b2532fb8c0cc7a1ed7e23c691486d6162019592e76cb1c039c163edaefd4c02ea85bd3b6b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 67c0b530f095fccaadd65a52b5debaaaf23f019f0d1e7b8e724c69c8920dbc10
- MD5 f47d8bcaa02fb519aa6bfadc5456fa29
- SHA1 fb760d268644b9e3affe80fd1ec88930fc509b76
- SHA512 63f251ee6d2ab6e3c03ca25b76b6eb2e3526a5742a5fed2b0f505d8550b26d6c139cd3149595d2aec8b3a2adae7c8e39ca78fbf3aafedf12ded4da31d0a0359f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
- Size 2.6MB
- SHA256 f90f88b004f09466ab7fadf0e252ca412e26ca4b2dbeff8c027e8e8e27615685
- MD5 909c4b2de6cb78cdca0e6af3ae20fca4
- SHA1 66dba172a4aa5fe6e6cfb7cec693498f5c2ebe58
- SHA512 c9c913e9166eee290dfaa0bd7db38706f5c950aa459326b31e26319c46fe88a8d1f6dcbb1d2797255b5002a1500dfd6bb1eb78e002f1d0187de6d3f7955a668d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bS:sxX7QnxrloE5dpUp1b
- MD5 SHA1 SHA512 SSDEEP