Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 19:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe
- Size 2.6MB
- Sample241112-yk8gtssreq
- SHA256 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811
- MD5 663af33d5c65934d8013f7d1898addec
- SHA1 bfb6099f77d3cb23823f05999efe63677246b179
- SHA512 1991555483541468ac908e08d517a4aa3de91dfcbef3d4ba7d8f7e6fe80b327cd561680d999e1b05e3b808a2f00f6e832eb6cfec5bdb00d2c194ee4f609cf552
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bSq:sxX7QnxrloE5dpUpObV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe - Executes dropped EXE 2 IoCs
pid Process 2284 locdevdob.exe 1936 devoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB2I\\optidevec.exe" 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvLK\\devoptisys.exe" 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language devoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe 2284 locdevdob.exe 2284 locdevdob.exe 1936 devoptisys.exe 1936 devoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2284 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 89 PID 2800 wrote to memory of 2284 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 89 PID 2800 wrote to memory of 2284 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 89 PID 2800 wrote to memory of 1936 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 92 PID 2800 wrote to memory of 1936 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 92 PID 2800 wrote to memory of 1936 2800 1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe"C:\Users\Admin\AppData\Local\Temp\1445a48738c5b218733af1529329d9840445bb8031f80d49189c942fcb4de811.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
C:\SysDrvLK\devoptisys.exeC:\SysDrvLK\devoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVB2I\optidevec.exe
- Size 2.6MB
- SHA256 4bc03d6b7292118efc6cb429dc28d9536b579c27c55d09d37bce94d625ad24df
- MD5 0d8f531e29bb1342834aa9602c117f7d
- SHA1 a99e33d83fe30ddd0118696f07e95292f3d279e8
- SHA512 e9e1afd620d3a9330dcc63847a4d268d10bd0e6ffee5c5ca64b70f767f9153b5b4c230a478c007b07b33752b349b015de098e358183e3a7d56618df832fb9abe
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBGB/bSq:sxX7QnxrloE5dpUp5bV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB2I\optidevec.exe
- Size 2.6MB
- SHA256 dc85e9e31c90ac85ec4c2891097b0ddc4a85c9fbe18ccde10f95493f6fdd3fe9
- MD5 1c0ddde88297700f3d4adf5f2d220590
- SHA1 4e80ab499bcaa8ff6802b70fe24b842cf2479878
- SHA512 78d9c3e3c71cd840fece1803b58834a04814280dfe37429e62f5b8d04a1adc08ecadc0319e1eb5522db410fd20933e6fd6e2a8e8d96cb798c0fbb48ded5874ca
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bSq:sxX7QnxrloE5dpUpwbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvLK\devoptisys.exe
- Size 2.6MB
- SHA256 5f8310a9275a0e41125585c833c9d9b09eaa868446b3b891aedfa0bc555dad91
- MD5 ba7aa949efcfee26f9b4778c322f44aa
- SHA1 9c4bc2faae59dfb91b2a47d33125c731095eaa3a
- SHA512 b17851a8170a58f26a206131ebc763921a60e70962752ead9ecb7a4a205e94be21971ffa06997b6da12064ac0e7d97def323a186be5cc0370ca5235f6ba1d153
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bSq:sxX7QnxrloE5dpUpObV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 208B
- SHA256 570856df237cbceac68bafc02ea6b8c06bf6491471fcc98e36d7894daf64734f
- MD5 aa9039d06d012d054a8ff79781680746
- SHA1 41ae01f53cb0a9a3042a3bcabf8a66bb2179afdb
- SHA512 e3de74c3098ae959106ff02b23142c8d4be378298e2fc6072de2b0753b054df35554031b13be2bed94764b515e96ebc338ab77627a723a2b28400a8a3d5a4eaa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 176B
- SHA256 9d4358df4c1101f06703eb6bef418bcee45cbb1ff25f94209b1507e0730c61aa
- MD5 f0224344c4fade5eef28d83a3a6ce2bb
- SHA1 a391ada393d44c4dfd271a112cbe5d9270451f6b
- SHA512 11705e06560e4e68c826b30c14526c2b9e4bec5a944f6776b53b3ddbb46f4cef14e8fa488913f17b315dc16ce6c22e0ab32e73cfac23104f37ebc2d26386244a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe
- Size 2.6MB
- SHA256 e85e17a80cd8bced560acdce5e8933d8bc9603226ec27c409fbec807e22b7a8d
- MD5 24c66580fb533eff26a3ea8bf0e2d904
- SHA1 3d3b81903dde2d561bed862c3b542107eb48003d
- SHA512 5d4a012474af6da12a34b3528b70edb6b440de4d29648646f29dc3235042f42fbc500637a265554edd4bc0cf423fcd08f399c11d524a1de88c8a595bb99df134
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bSq:sxX7QnxrloE5dpUpMbV
- MD5 SHA1 SHA512 SSDEEP