cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe
Size

2.6MB
MD5

c9f80197f3507d09e177ff32845328e1
SHA1

9e61ab9553bfc040bfa9ac02bb88d66a08558ea0
SHA256

cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695
SHA512

fabb0b6e8e95fc1a6c534569c764957f4be1b89483b8e940d7d8ab748fcee606e91162f80cb659a907990aee58e6ae3bdcd20b2c0af6470551d87e4da6044d03
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSG:sxX7QnxrloE5dpUp5bP

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe

Executes dropped EXE 2 IoCs

pid	Process
2760	ecxbod.exe
2800	xoptisys.exe

Loads dropped DLL 2 IoCs

pid	Process
2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe
2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv39\\xoptisys.exe"	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid5U\\boddevsys.exe"	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxbod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xoptisys.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe
2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe
2760	ecxbod.exe
2800	xoptisys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2760	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	30
PID 2644 wrote to memory of 2760	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	30
PID 2644 wrote to memory of 2760	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	30
PID 2644 wrote to memory of 2760	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	30
PID 2644 wrote to memory of 2800	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	31
PID 2644 wrote to memory of 2800	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	31
PID 2644 wrote to memory of 2800	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	31
PID 2644 wrote to memory of 2800	2644	cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe	31

C:\Users\Admin\AppData\Local\Temp\cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe
"C:\Users\Admin\AppData\Local\Temp\cd2270f14c1614c3c7c44e7cb6b0101b5fbe859ca432ec60858c85879305c695.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\SysDrv39\xoptisys.exe
  C:\SysDrv39\xoptisys.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\SysDrv39\xoptisys.exe

Filesize
179KB

MD5
bf71ccff1edb7ebe7864719a59242753

SHA1
414fbca2dae2f26f15e5f25177e9b85ce2ffdda8

SHA256
3d3072d4afe057ce10151ad8b3992a79747277d4684a9ea4822514ab17665479

SHA512
d648674f41d48d4b110d4cc743eef9026ea990dc4b5f5b63d0507bd3e6257e5a44ed758794700f7bf03c546f7cb4f0523a3c50b27d9b8ef6591f3be16c66bcee

Download Submit
C:\SysDrv39\xoptisys.exe

Filesize
2.6MB

MD5
a3d6506d126de31e24997b36a154e289

SHA1
b8ecf7edf79a7c130e0a84f26ee839b4a734e7b5

SHA256
f4fff71ffbff9427ece30841445557e3915887fadaeb96059953b5f85e07ad4e

SHA512
aca14790ddcce743e1242c8e3b9149b45fccc42da56b924df7677cde0e57b94aa975ba1ae509b45b1caa3f1d33de99e95e88b74f195ec74e4670acadad304021

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
170B

MD5
924489dd4df222f5340c5aa916c1c2b1

SHA1
13dc1b15463070998c3770c9bb8abd8b87e27a99

SHA256
7bf53936c8e9d379595298371704b1a4d9f2196e05e43158074a62ed9fa61556

SHA512
4bec075a8adddea30f3c5b67aa1a8c9e80dab6c5863ab8a349419feeec8f6c51a1b87b2f40ed6a4167d395e7ce1a40a55e8658f0bfe07328ab277bee1e819f58

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
202B

MD5
c27d99cf8aff4719125de3a6ccf0688e

SHA1
0cb676299a70cb3e853c4ac3dc7cdf2a297ef43d

SHA256
3cbe168a9966d8cff362f8d36a4b6ae84e1fa9ab7f5543ce3b111d8b3315e766

SHA512
c2d4bdedc0f44f2b50f2ffa6d3db5ab20469454229b15d2bd64b584571cec4f08d1066b03f9f11a994b29427390db2c6b24f5fd0b1ca5a8e42b6dfa6c723bef9

Download Submit
C:\Vid5U\boddevsys.exe

Filesize
1.7MB

MD5
179685f2f5ea80e06ac3f32b807744a3

SHA1
b0d28184c290dcb1b688a5cfc415b4e6634e0f47

SHA256
eae9f70d952a7b9d33f68c5a45aa45e982ff5a99f16247050b5615fd7a34b5e8

SHA512
6a44949f408d25281858cb724541f5e597fc6266d4a69cbd3bab5ac97796d7faf8a20b97c700e4383e24ceeaafa69e1689da0320b65de3740531f0f1811ddb9e

Download Submit
C:\Vid5U\boddevsys.exe

Filesize
2.6MB

MD5
00fb28eefcffaed6af259483c94f8402

SHA1
df954df7407dabcec904b54ed3221608aef89dbf

SHA256
a94d451439ce44a0feb90213db4a735096243c1a2a3354cbcfe7fbb1ab8921fb

SHA512
24a6372769454db2fb1f35f7167d9ff3f9d41dd6d82fbdf11940f205e0845cb81ea43cb120409239dccb42046bca37c8f52bb8822072dd03489ab72e14d7c770

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe

Filesize
2.6MB

MD5
ef7cc2a7eb55d13ff3a567da93f9a497

SHA1
99113b4aa6a816cdb73c1047cf11e40fb03ce739

SHA256
616ace40b658639829ffbfd926053cac8a163be6fb06d39c22be38eefa3a57f7

SHA512
428b6a88b7d2cd9b85997aa9d1a3101963f0f26f8cd3d76f5dd4bd8b8007b03cbd9c383065ab8308ab66191e587a2331af14b2f85702bffc1b1d2bf386fbe249

Download Submit