Analysis Overview
SHA256
43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14
Threat Level: Shows suspicious behavior
The file 43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Drops startup file
Adds Run key to start application
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-13 14:00
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-13 14:00
Reported
2024-11-13 14:02
Platform
win7-20240903-en
Max time kernel
119s
Max time network
16s
Command Line
Signatures
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe | N/A |
| N/A | N/A | C:\Files2I\xoptisys.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files2I\\xoptisys.exe" | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidBC\\dobdevsys.exe" | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Files2I\xoptisys.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe
"C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe"
C:\Files2I\xoptisys.exe
C:\Files2I\xoptisys.exe
Network
Files
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxdob.exe
| MD5 | a809e68a0e54621481b294441d9b6e01 |
| SHA1 | b77ba6a0594881ca662982c70ae3683574f48493 |
| SHA256 | aa1e8d7756526b7487373af4d29213199fc083f553d80bf56cda5e0aa36331a2 |
| SHA512 | 6db37f60cb5f4da31ea0643450d8c92d0e5fa302abaf34a42665dc8d4f79f2d4eb6ffc964d969ee071760dd8caa6f7d122966e1f29ee2b5a26d44896e05db303 |
C:\Files2I\xoptisys.exe
| MD5 | a0a98bb9304b67c96467a709e36fc77f |
| SHA1 | 5371d620ffb883a234ea928036ef4176d873d356 |
| SHA256 | d6081a72c79d40e45f3397ec550f5658d73f97957dcb225468711a177d08d80b |
| SHA512 | 993a27ec142f3d827afd42149ddecd2c8e28eb72af7145f30686e2c6a02cc8d7a0a5e14a3169b3e1a8d915a46cfc89213eb53da88e4eb22477e99e0a510f2ec9 |
C:\Users\Admin\253086396416_6.1_Admin.ini
| MD5 | 4cac32d776425653332ff99ef24a4e12 |
| SHA1 | a8df5b89162984fa68dba14818c194002eb73f2e |
| SHA256 | 79d69d68807fd057385dd4146ea3f7e0b79260af0c4719e11d456d20c449fabd |
| SHA512 | 53a12a95d3b76106cc553479fa3f26aa50efb616834082c079d96ad1c9a79d69831484d9c08b2305d9a2fcce7555a5930a5862afb1e07a93ebd919a3bd8a95ab |
C:\VidBC\dobdevsys.exe
| MD5 | eebec29bc024c59a9e0b86a89985de28 |
| SHA1 | 0ea1c6f81f1503d1595186631778acfdb93fdad2 |
| SHA256 | 01d20d94942821e18b7fa61d2982eda0b4bbf230c906c07584db8f942772ed7c |
| SHA512 | ac3ef0045e90be57d6f13b35510567dc0f529585eeadadf19201182d205872469d0a0b077797533d289588ddad7397aba51ebf00a97cd254d1b8ec85190fb1b3 |
C:\Users\Admin\253086396416_6.1_Admin.ini
| MD5 | 7f10ebe3e31cbfd68cdda1bc204adcea |
| SHA1 | ca0c89b67d120dab1aa3e87b39814e1ca45da08b |
| SHA256 | 65a6b7689897a328b152bbc77339048328d6bbaab90c2eac93ced9a22771a4b6 |
| SHA512 | 270881e73d31eb13197d92abc926ce109e57ee30510e18ffa2c816f33476b9836f2f53c749eabab456328d0cfed020664094e237107d68dfba9ed93da4042d47 |
C:\VidBC\dobdevsys.exe
| MD5 | df5298d42acdf403ace7edd05cf3b949 |
| SHA1 | 3ccecaceff02480f0fa7d46f15f5de2ca1944d79 |
| SHA256 | 6d7fc0373cfb114bc74b3d727d6ec4198dd97a51fff46c87e7ece114bf3b74f4 |
| SHA512 | 39984e6e926f15e5a24e4f23d7c1081ea4531e8fe0630b0a869a00d92431b9ca063580321085d5d5b3efa3d3ab920333cd532c83e24297a5908b0efd026b51d7 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-13 14:00
Reported
2024-11-13 14:02
Platform
win10v2004-20241007-en
Max time kernel
119s
Max time network
53s
Command Line
Signatures
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe | N/A |
| N/A | N/A | C:\AdobeDO\devbodec.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxSM\\optidevloc.exe" | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeDO\\devbodec.exe" | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\AdobeDO\devbodec.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe
"C:\Users\Admin\AppData\Local\Temp\43003b2252701a40d38f131a452391339fe14771b00a810312cd98150a951e14N.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"
C:\AdobeDO\devbodec.exe
C:\AdobeDO\devbodec.exe
Network
Files
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe
| MD5 | 2095f5d3ec4c1dddca144d06bb99f376 |
| SHA1 | 130fb1b56ce2a52f97f447f10f72f4ff6df22cd1 |
| SHA256 | ffb9eb8adfe3dafec8658e4ea384d9f317284da628e34271723d8a9dead5da16 |
| SHA512 | 11b14f795f50ccd3e22482fee827fc68cb07e79624e04bb315f1a8771ab331a0160484abcd4904aede0f88ff2fc8c575d5b8c7823b514ceab985b47c5d5951ee |
C:\Users\Admin\253086396416_10.0_Admin.ini
| MD5 | 384a9b70ce458578ed7dc3201117957d |
| SHA1 | 246268d2aaec1b220d2ca04af171fb09dd67f22b |
| SHA256 | 22d8c2d93af75efb6de5e79b78f0f1df30adf50f961891139916f6a9e49e5bc0 |
| SHA512 | 9f534b79a4615d88c2533cc920f43bf5c91b04ae5b7c8abe108fda722d5f59fe3c3b055b484649c87c368eafac79903ffcbad9d42577a331c2d5862ae2982b45 |
C:\AdobeDO\devbodec.exe
| MD5 | a67608901df8317d8feb584893809d39 |
| SHA1 | 0095f03dc9fe59910ee0ccdc5de8fa5938b95ba6 |
| SHA256 | 02bec78a0ad5d331fb9b1a7cf5670debc725ee154e5b0943d3279b51ae7e9efa |
| SHA512 | a28445d1a34cb592b6da9171f285fa63e91e785ef543bb8c1623535d1b5a088021c0bad62dd39e5d833a8327255edeb2cfc76b63c877cef1e7510e0f0e86af27 |
C:\AdobeDO\devbodec.exe
| MD5 | 9b673cb77f20ce0cbcaf29b690e598a3 |
| SHA1 | b86f9afbdf61316876d184e940d61c10e64ac32b |
| SHA256 | e6c87f1681bf5af3b1d3985a01c56d7f26d9b26dbfc08a746f868713a4f622ae |
| SHA512 | 111a160348f081c04a814107b2890a94386543a71627629c5c74b5accb077208fbc1e00cb28e4f5064a1875c227b77784979cb04d9d099b984f2698f25271b07 |
C:\GalaxSM\optidevloc.exe
| MD5 | ff9d010be3744d9014526adfb0a0bc4e |
| SHA1 | 1d28236f176ac8cc6ce496c66ac12ba565acbbac |
| SHA256 | f791b070fb0f421291a9a7f144ffd37ae47b0f52d2fe33e3774a19ca68a83de7 |
| SHA512 | ce542c4a23d2f196b45b94793d316e114b7a94f682841eb81a285d988724660d543b94603812aa8a5779e3e8a197902aa61b2ec734f12ff650b9ef0ca89aab37 |
C:\Users\Admin\253086396416_10.0_Admin.ini
| MD5 | eb23fb0691d5be39cc1bef1d515d5b34 |
| SHA1 | efd919013290c8cc5433801789c557badac31345 |
| SHA256 | 2ab3431ba546a2ba596d80b9cfa2c9c8aec8fe20499ee563e96fb0c75e68ee7d |
| SHA512 | a7bff44fbd2f9cb1b8c6cda10da2eac91e7e9a5f2628092953c1d49687459615acb83d75702b963902a11819a45bacb6cbc6d4a1b31f70baccd9963ef441afbe |
C:\GalaxSM\optidevloc.exe
| MD5 | 54ab0cafdff90f1336ae6e74591ac434 |
| SHA1 | 4ebd0545d1933df278137483656f791c0a5bd190 |
| SHA256 | 9dfd575e67ba00b56bc7eb0f6299e14e6fa17b7996056f24c0b5951da6420f4d |
| SHA512 | ca14e95f5256f2f852a66dc5ea292100e1a3beaaafa7857c9b83a394e7280f477226a3702e96722a5685e6b25363ba7d3a13e770d7d34b2b486db61ed8eddef4 |