Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/11/2024, 16:53
General
-
Target
2c4422ab9edc28e0ce041eeebbf4da97aa9584f9ca16cf43b6eba5df6cdd0ff2N.exe
-
Size
2.6MB
-
MD5
1cf67ddbe607d3a6fc6103d158486730
-
SHA1
630968a03725682ac15ff58d0319d382f9e781cc
-
SHA256
2c4422ab9edc28e0ce041eeebbf4da97aa9584f9ca16cf43b6eba5df6cdd0ff2
-
SHA512
bc03e3a24a6b0a90001047d6418edb42c4b7194f8bafe6b10522219d6c680ed7caa04501af0be44c9af067170cec6ed1d7c6203a66e2a6dc3a119685ccaba390
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bS:sxX7QnxrloE5dpUpeb
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c4422ab9edc28e0ce041eeebbf4da97aa9584f9ca16cf43b6eba5df6cdd0ff2N.exe"C:\Users\Admin\AppData\Local\Temp\2c4422ab9edc28e0ce041eeebbf4da97aa9584f9ca16cf43b6eba5df6cdd0ff2N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\FilesGV\xoptisys.exeC:\FilesGV\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5d2550389545a4f5ab7b937da8a263363
SHA1c1773d54238d56eed8679d883973c65f734567b7
SHA25676b3b71fcaee0074b3ee4ae9735167d168de631c9d78552990f65c168da2d77c
SHA5125a30f2947fb18eae72c6992deacc6d178eae77f4048d3e3293c7853ba3984b81b82e385b6f424e26869ef620b6f8ad7e42e68a1280078c2b22b64315be999c2d
-
Filesize
2.6MB
MD57914968c7d4db631ea5242c73f59644a
SHA19150f87fbc937f0a6fbe75923fe586d477fca615
SHA25656586e7d992f2d03f2df679f5f5d9731ae0fc3ce0e4cdb71d5f39bef870200b1
SHA5124d6c1a7a1cd09d8798b2d7bb7004787effff74a0ecee07fa76892157fcebe309d521bcd8f346235659c6d35b65e2fa17f98d7ab83d96fa3cb232a2c2d7e8a136
-
Filesize
2.6MB
MD53ebb4278c798d7cfc283b62e71d30516
SHA1ab323ccf049ffb1af40ba7e73e1e984a404f8ed6
SHA256b080084677815a19bd57dc7c77de79ed4c6d0c460affeb407a72a1a94dfc3f0d
SHA512614d3af9fcbd78f9eaca1df14cf7f94e82b937432874e716fad61d680f2e3c1d07932c58abf0b0991def23289612bc4f408c8a0cf9175791d7624a77b63c14db
-
Filesize
169B
MD5e2d9822d032b333903868ca665664980
SHA1575936674f09b9ec8996595541e49c2a087bdf34
SHA256af4feabc17f27b21e338ae71a9d8de2529476c289989aab4892949776427a687
SHA512c9ad1df2c31e0afc2a1fc11b7b4ee7682dc264705cb440d2ae69c618e8079200462609e56c419f242f731bd40228c021f94dee652fd780e4d9ce8530359199b9
-
Filesize
201B
MD5f67737604263f7436b162c14d97f543c
SHA166377429b0d083211a2b5f2650277b42ce211491
SHA2560712bf72cfbdf7f9a6b4f380b3c4556378b8104f20555e8d3037c1a191f18f48
SHA5124657b21561ec4cb92dcef5a1636541f479f41682f9d890c16d6d59e7277453ae7cb822f15d9bc7119a3fc2316ab403a2e49ef64b4bada8d68e6cb1bfd13fdf44
-
Filesize
2.6MB
MD54ebeb22f991b9d381c1f080623678a04
SHA1349a1d8351adecdb33f3159bee4c0e69cba8f96f
SHA2564427d5f8c8203dd3da1d483ce75aa683b4db548aed7c00b2190b96a5f546bb9f
SHA512f9ec30954d105bacafb14f3facac799e253c90a9b0b570aa0d8496b0f947c20cc965e6a7d67604030ab5187f0895fe8d67435bc258668d3c35119f2e03b9b36f