Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/11/2024, 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe
- Size 2.6MB
- Sample241112-ymemjasrgp
- SHA256 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9
- MD5 97f2da0cdb281caedd15eb8539a02360
- SHA1 31320ef66227f80dc5f236dbc2693601070f6159
- SHA512 c52938940d51174997da031179b2f6f5d1cf194b292871e70216311d577656e33c92678a5a17352955dfe7efba517f08489eb55e79141656a150118435840896
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bS:sxX7QnxrloE5dpUpnb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe - Executes dropped EXE 2 IoCs
pid Process 3956 sysadob.exe 2608 xdobloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvI6\\xdobloc.exe" 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintX4\\optiaec.exe" 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysadob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdobloc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe 3956 sysadob.exe 3956 sysadob.exe 2608 xdobloc.exe 2608 xdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4560 wrote to memory of 3956 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 86 PID 4560 wrote to memory of 3956 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 86 PID 4560 wrote to memory of 3956 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 86 PID 4560 wrote to memory of 2608 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 89 PID 4560 wrote to memory of 2608 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 89 PID 4560 wrote to memory of 2608 4560 12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe"C:\Users\Admin\AppData\Local\Temp\12673573c90cf08a0c1018b07afcb6d46f8d4d91f099e326d026389bbefee9a9N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3956
-
-
C:\SysDrvI6\xdobloc.exeC:\SysDrvI6\xdobloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintX4\optiaec.exe
- Size 1.8MB
- SHA256 3e9372c04293775034fd66b9ae1a329c388bc5a8a0024322ef1bfaa2d418dd67
- MD5 39d57eac43606ce862d46b582a1cdc1d
- SHA1 bbf479f3bf697199b658ffe9af670bbbd54f5cde
- SHA512 24f18b3180a1567d3eb6b4023a7ff7497259237bdb92b90c4f8379b611a3198c09f4d857b30851bf7aedb3f9997546319605e4b7ed18e35829a69e16cec034c6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSK:sxX7QnxrloE5dpD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintX4\optiaec.exe
- Size 2.6MB
- SHA256 eba15029c3e947b179d7b032dd660d998f18d52e0d9dfd6be5a4b61ee1407a6f
- MD5 a69defd8638924e647760c6cf94ce64b
- SHA1 a773b7dba82107cb3815607a3e0d26c0c81fb521
- SHA512 3da6f00b49ee7273c9cbf04e11d65df2f21041bb1246902b7850d7aeb8c38273d17b224b791662fd4029643acb1f7f6a518240f1f2da3a007bbc0118144c749a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bS:sxX7QnxrloE5dpUpcb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvI6\xdobloc.exe
- Size 2.6MB
- SHA256 88552d0827b676ee8dca262aa9587466605eeb65759a5423ebffc641c6309da8
- MD5 86fa26683ee6b051f2ef7fc55417256f
- SHA1 59fda9771693595d780a0ae45870cd9a24f7871b
- SHA512 b0360a78ead744be89319a6450fc670f4edd53718caffb8e5da7cbd96458ac75c59fa3bb6c570aeee1f9a937ed3af9ad34fa187bca73ca547da3b08426578cde
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bS:sxX7QnxrloE5dpUpKb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 32f551e258afb0f21f3fe25be8dab70eb5bee7d5baf44ea14061b37e4d023437
- MD5 b7a17337d693c47c9150767275f15b7d
- SHA1 9ac4170174df9e2b73b065f7200adc33fe1c7d50
- SHA512 94f8bd8e0fb853783d0a2ae5a224d0766af5cfc1176dae7875c936a8c81b95ce0ad3f44bb37520e0bfa8852ece783fe745078786b706b509cc6fbc5ad0bfe1a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 778fadb294625d94a2ef2c79b284ce46f0b8aec5c41830070f0a6430b5f1ec2b
- MD5 396e73b7ae2f6de8a8ac35750c2e8dd7
- SHA1 1b4981db941612599314ed83795cd6be3baeea3e
- SHA512 a7c8e1e71f4a01a0553f64f5379ab05f74d0794bfd6d6ede79a6156f2827fd4243ceaaf3d8de4f17cf5f95cf412f04770fa6dc24b426b53927da48e588df0683
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe
- Size 2.6MB
- SHA256 1b147e82ffb82e984724940c280c3cd9b90c4900bc9ec687fb485d1d2c7a4632
- MD5 44220b0a2b55b567a052a13b9a54e138
- SHA1 70b3950b4073ec0bde0398f30c92ecf820aaa8e4
- SHA512 687f183d59c2498dba40830ca9d384f597394d16240179ba97e25bbd39df03799f95fa41a528e229a36d24a4fabcde292b645f56c750fc10fdd029ec37e56183
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bS:sxX7QnxrloE5dpUptb
- MD5 SHA1 SHA512 SSDEEP