0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe
Size

2.6MB
MD5

be2d6824f54fa54a3c1f62cc88d73aa7
SHA1

c71f6b2f11295ad632cf83b1da56a3f82ab93fd5
SHA256

0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989
SHA512

2b9f93b966e9114b5fadf964e61cd8c253729965a6552a66f6eb309ce0aeec715486661d1398b1dcbf7c59fee0b636cc37e8aa5eae0732a9d3c1b6b1011f85ae
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBuB/bSq:sxX7QnxrloE5dpUpBbV

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe

Executes dropped EXE 2 IoCs

pid	Process
2648	ecdevbod.exe
2204	aoptiloc.exe

Loads dropped DLL 2 IoCs

pid	Process
2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe
2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocNU\\aoptiloc.exe"	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBUF\\dobdevloc.exe"	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecdevbod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aoptiloc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe
2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe
2648	ecdevbod.exe
2204	aoptiloc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2648	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	31
PID 2308 wrote to memory of 2648	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	31
PID 2308 wrote to memory of 2648	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	31
PID 2308 wrote to memory of 2648	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	31
PID 2308 wrote to memory of 2204	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	32
PID 2308 wrote to memory of 2204	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	32
PID 2308 wrote to memory of 2204	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	32
PID 2308 wrote to memory of 2204	2308	0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe	32

C:\Users\Admin\AppData\Local\Temp\0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe
"C:\Users\Admin\AppData\Local\Temp\0d2bee2138b53d0ba0b7dfb23ebfe873f5fb601bceee412a093034e53da72989.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\IntelprocNU\aoptiloc.exe
  C:\IntelprocNU\aoptiloc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IntelprocNU\aoptiloc.exe

Filesize
6KB

MD5
0860ba7ab87e6dbf893e728aa4621778

SHA1
6296ec6dd59bc3b8a68b647437f788d3632c62db

SHA256
dae0dd40453db7d1814b71e7428dae76ec100c87d90429cfe275f635828912b2

SHA512
6b72d47a2829acfcf1490f689278dd8559279bed5d5c4557d0d0a5168428051f1906438558ebacac45c8aee6d3c2408cb4723e18b3d3bcc087625db5239ebaef

Download Submit
C:\IntelprocNU\aoptiloc.exe

Filesize
2.6MB

MD5
ba12526fa2e2d12fe0f2c08a7be23e51

SHA1
2e98fbe933dd44a7d0e3169641c5fdc68a929a85

SHA256
548bf0044ad2910caa7c24160323042c1721911c4833d0556131f81fe193ec61

SHA512
333013d9ec02784d89510f48a587888e12051b9ebf775dd715eefc3657c72ed33d499b163728db45473590a73e45faac3b84f28d77c4d56988e6fd2ddc3707d6

Download Submit
C:\KaVBUF\dobdevloc.exe

Filesize
1.8MB

MD5
5f56cd14a7959bb3ef7c4ba2068597b0

SHA1
940f6e5f63b389a331d1c601710fbc8630743852

SHA256
afa755b16d2c49b41651d22a1aac301992bcb690b0c6fde777fb7ff7d5e5b580

SHA512
1c82509c99fb08cccf54fbd17787a7e3ff49b848af0d052cabeb64ea6ba3d22aaad3cac701200773fb6e2965622926b70a6ddb6e07f7bf34c2d04b6b905d1fdb

Download Submit
C:\KaVBUF\dobdevloc.exe

Filesize
2.6MB

MD5
6859de4d44cdc7e67a3cc3b2630ba0ee

SHA1
cc8e52a2ea1b648234cef872659a3969f4579666

SHA256
8f52eb16ef51d177ef168e92ebaf10ccf4f25379c059f03244f279293c1395b7

SHA512
d8bd83395af0b264d0e29fd78f782def6e3334b8d7976262004cab5859917e4db484d05db4e1b8d80483cffa5f87001477fe3344754ee82b5c29a422bb645aea

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
176B

MD5
a3055342aaa87838542b44ec0a1f5f9a

SHA1
3b381cc8c3a7d60ce2992984cb79ee31a9ffe35a

SHA256
0720db160efd6360a05a25c1b6f1a39f33938c645a421523530c5a9f94840848

SHA512
0d894e3b8fd7b034ca0ad8ff32f2ababec0b2f5df724ead836f4e9235c8752229bea8d21a809ae4d596b6e4c4d2d408f91ad69c8c83a99fc11e0a57a7d65ec40

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
208B

MD5
c5acd98dfe789240059a1dec31c6fbd1

SHA1
393f8183fb41fe8993529215798a08c96988c24f

SHA256
968083a4384d6448fd8f62c788f42e1050d95761574dbc0220af187229ae05bf

SHA512
3881f03a62291a596ef328c7fd1616106a34e17479c27cb458171b66bbb7f679307fb6553a8145b487caa138c4f240bd6109a5ae2cb45991e2f9b28ab7b9fafc

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe

Filesize
2.6MB

MD5
7ef64185b5e80b2746be216b4ea005c9

SHA1
acb55765294c59a03210fd1682e3816a8fbd50f8

SHA256
00d448419783f0c3433fd3265f2bc054b496aa51df57cb9460ae14b7f42fe2fc

SHA512
b629713d8080a42442d4557b51cdbf4864dfaf52f50be9d100634f5a6d1322894bfc9d27bdac33f94d1aca84ea05cdfd436d6d703e2edd62c22d4d3cd1b8cf09

Download Submit