Analysis
- max time kernel
119s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe
- Size 2.6MB
- Sample241113-zza1jsylcv
- SHA256 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01e
- MD5 1ef6e33c4f7992cc014ecf7aa8cf4d30
- SHA1 d7a9dfabd2c2fc087bebb39bde222e9245deb7f5
- SHA512 dd7969d75830352af747058105d085ce2df0ec004dbffcaa70373087c18bdd2c70baf4a564bc53153a2aa564e7afd00c1e98f14be9e89c139e78a1bdcb04b20a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSq:sxX7QnxrloE5dpUpBbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe - Executes dropped EXE 2 IoCs
pid Process 1268 locdevdob.exe 3032 aoptiloc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesVI\\aoptiloc.exe" 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZOD\\bodaec.exe" 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptiloc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language locdevdob.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe 1268 locdevdob.exe 1268 locdevdob.exe 3032 aoptiloc.exe 3032 aoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4916 wrote to memory of 1268 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 86 PID 4916 wrote to memory of 1268 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 86 PID 4916 wrote to memory of 1268 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 86 PID 4916 wrote to memory of 3032 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 89 PID 4916 wrote to memory of 3032 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 89 PID 4916 wrote to memory of 3032 4916 5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe"C:\Users\Admin\AppData\Local\Temp\5d5dd19343399b175092691bb870dd52820a2476ef7ca9722be03cc8e943a01eN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\FilesVI\aoptiloc.exeC:\FilesVI\aoptiloc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesVI\aoptiloc.exe
- Size 2.6MB
- SHA256 0e878b45df5f8b94a55ce9f3e57073ec502158657867769bed281048b3ddc15d
- MD5 c1344e5bd717688b787a647b17fb2601
- SHA1 7df621160f397aeeab27e6867942f350a10ff573
- SHA512 cf65dd605ed5498b2f3c6cc81afc644a2ce55cc11fea6acbde6b90fc1ec1c5c4ceb69218c1f50e20d591732e53b41402e74c137623af351f9456419ab48d209f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSq:sxX7QnxrloE5dpUp3bV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZOD\bodaec.exe
- Size 2.6MB
- SHA256 9f85a8346ec8574c4eac34812fe7f0087bc686f3f2624774386a01465e6ef722
- MD5 fd24b101f08d2436df45207212d6e02e
- SHA1 e4922bf5c39b6281ed75eb9a6a5e35231d574b15
- SHA512 7f7b83413b39e821cbadf4f226066a60b278dc53c51ccf22d764d357b7b79e6fd16a27cbdf4c32a14d5ea6e03dd0a5709c7caed88c003e2d43926f798559a099
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bSq:sxX7QnxrloE5dpUpDbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZOD\bodaec.exe
- Size 2.6MB
- SHA256 edfa5de97a1ccd418c64151a3cce317166539dec350fcce88ca365d4075e5138
- MD5 e5e8a81054372e2907276d53f491f90f
- SHA1 49c7376bfdc6e02174d2db2585635af630208dd6
- SHA512 04b52108b04d779a83343ac438b60c9266a545c213c144402f0a60383128accce2c76c189fee947f696815edd1596bca3bf8ad9ae16e51db46448f581c4d24a0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBhB/bSq:sxX7QnxrloE5dpUpGbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 16a5b5a5b42ad8739d60f379c45a05fe6558bad4cf9170c28072f96c98c7085b
- MD5 0e1d5420ae6e923d384f6f55e0e91b5f
- SHA1 addc03d78c018b809f19b219a6fff16a16d71061
- SHA512 b2e11e0cc2671f44276c51aa1e185d1bfddc04a43cd5670b67af922d3b541e197d369a4598334f2082f13dde72d6da6704d4af0bec99c24117bcdd31ede1e7ee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 278abbaa75445909cf88df35253a67e25fe9491529600f29000b1c2d0a51b69a
- MD5 12ff9cdc58f343f526fc28aefe7f30fc
- SHA1 af94b060035423230c791e97802adca5ed316cb7
- SHA512 ab1fd7afd85927fabf03e1ef6deb07117b97aed05a4eb7aa5e9d799e815681639eda5f19bda0d3c3df79b3d8b31c18794276694bcc70e9166f4eb5ec5cceaecd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevdob.exe
- Size 2.6MB
- SHA256 01574aba5485f03f50a7d7e89eaa90f5e5b099d529ec616296d9a90ff02a8359
- MD5 94c4d216c72fb72411ad5ce9440ad271
- SHA1 bf3b0ebbe8a80f15d095ea0704e9d5a5a32ed556
- SHA512 1badedd34bc0221a9e7b2ae0565f950757a4227de0cb6aea61bf73b2779ef5ef83ae47ed7c7a52ed272c4f37cdc2caded43197bc723c24219b9b6963dc8c250b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bSq:sxX7QnxrloE5dpUpobV
- MD5 SHA1 SHA512 SSDEEP