Analysis
- max time kernel
118s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe
- Size 3.2MB
- Sample241113-w75ckswpdt
- SHA256 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422
- MD5 f26f8716a32ea23a5e0dfdcd09642910
- SHA1 68a4bae13472edfe3aa257dbf0faa61194f6926c
- SHA512 f28d86ed490a3dfcf658146b3ce097f22276e7a9f5cba911cced674df26d796ac5dfdc425505211d09bdb1cf23f5694e93cd62db422833bed43226336d7f651c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBZB/bSqz:sxX7QnxrloE5dpUp+bVz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe - Executes dropped EXE 2 IoCs
pid Process 1224 sysdevdob.exe 4744 xoptiec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvAV\\xoptiec.exe" d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidU6\\boddevloc.exe" d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptiec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe 1224 sysdevdob.exe 1224 sysdevdob.exe 4744 xoptiec.exe 4744 xoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1036 wrote to memory of 1224 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 88 PID 1036 wrote to memory of 1224 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 88 PID 1036 wrote to memory of 1224 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 88 PID 1036 wrote to memory of 4744 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 90 PID 1036 wrote to memory of 4744 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 90 PID 1036 wrote to memory of 4744 1036 d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe"C:\Users\Admin\AppData\Local\Temp\d4e68f1387658ec4863c9f596ae27d371d2b880da48e286a03e2d08327c8b422N.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1224
-
-
C:\SysDrvAV\xoptiec.exeC:\SysDrvAV\xoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvAV\xoptiec.exe
- Size 1.6MB
- SHA256 8f7779ecac5e316687f319dcc611ba3053877293a404b054047db6ec62cdc9e8
- MD5 fc44999c7913d00b2d57122b9bec9879
- SHA1 a794987530634ab878a904e1aa1d741246d5616c
- SHA512 765f762cdf4813280afd598df691f713b7b4be886815adf264e97f9539df5a0318f0e44e1609556198058ec1aa880e123c079b9ea7cfc45aa4d52c9119b37e9a
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDD:sxX7665YxRVplZzSKntlGIiT+HvRdpc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvAV\xoptiec.exe
- Size 3.2MB
- SHA256 70e27b28e7537a8508fa0149791d6807b6f900d999bac8384e57ec7cf375652f
- MD5 e161123cdafc8ad5155b612eac2c4ec0
- SHA1 8470d680a620aebec694341cf7e8fabcf5addd09
- SHA512 310c27d368e4563bcf197f8764068c75d03b8dfdf17755b2a3a086d202934e3154c9b41fd19308d19e88e755b9d207a0c3239185e50e4673c6a2194731898197
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bSqz:sxX7QnxrloE5dpUpobVz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 41f17a299d9ea129d6be4c49f18b69b4d44b5ad8e3c5195a6549fa72460c9cdb
- MD5 52b64c72d32100255a62c444932f4f13
- SHA1 ca56ce87ab3c419ebe2d19f2a5532cea53322e82
- SHA512 ae513f066efaf31910cad7144f9c4a6938bed448a199fed8bd64d566060c5e1bd4d83d55d402f181b3336293e8ef7b02d5ecce0727e5797be3c90f7ef01c99e9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 188eb78c6d9cfa351e8d2eb2ea05fc3e86c370043f49630e95c31a390d627753
- MD5 09dd9d18e4215c78852869e6eb26887f
- SHA1 2375f93875f177ff1948d4194860762dd8983e6c
- SHA512 c075ab98608466a9477003ff3446659955765c151e54a5f3332fff63c59e167fc930aa69ef5ef887cc14a13b052a0d67c49d74a06208eb21659e5e05789d3b41
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 3.2MB
- SHA256 07c0a617edb936d167ab14ec1404a403c304741238a43676ea9e39e5d95265b3
- MD5 ba8daa442eb1bce1359b30f3325e4d31
- SHA1 19c1b0e962a13a749ad3fc962c1bca099eab410a
- SHA512 fcf404654420f0dd70284fe555f4f973471b118270853a9b72fc9ee9128abad0ea6c213cde90ba1be8a7314aaa32f3cbaae86d53e2760bf1c19fb9550003d733
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bSqz:sxX7QnxrloE5dpUpCbVz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidU6\boddevloc.exe
- Size 419KB
- SHA256 99e6f396eaeea6357fabc09012e62dcaed868ac2271c2cc48af661c24d2f06ad
- MD5 3f1cbfd790b7610a5a9d1f4445d8a2b4
- SHA1 f3258ff359ef2860948cf4e0a1caa4d291505864
- SHA512 5ef7a37f401f5218ce2be3a47f11dee59f59688b8d6a58e69c51147df4fbc4521c79a8f98c2571ee3011dce553c487de2b7927fc64a41ac3653d5a109fe1200b
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL8:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidU6\boddevloc.exe
- Size 3.2MB
- SHA256 2ae7beeaf1562b5bf9cc7e545867372cba6d36462e0a79a98fd932c707164bf6
- MD5 da3042fa29eb7adc792d962cc3f5a374
- SHA1 2182016ae780b12967e1720ae8977836f6ceede5
- SHA512 db0534c054670f8395977114a14528fdd647c3acb913b0a3b8ec7c0fd245194cc724fd4c74b1f0c338470b32db472d29b13ca720469d9db0321437363cb694e4
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBFB/bSqz:sxX7QnxrloE5dpUpebVz
- MD5 SHA1 SHA512 SSDEEP