Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
19/01/2025, 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe
- Size 2.6MB
- Sample250119-yxpkgstmct
- SHA256 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55ea
- MD5 a3176a8db518e0ff5d88dcdbcc1d8cd0
- SHA1 e2409f2d66ca21062cffd7c7b6750ea60898aaa8
- SHA512 ea4f6746c0f4f8cea4a8e86f670d1a6368260b4861ef7eed5f75952a92dc68100656e0d415e67463191531bcdd83868312020b108f669ab4273b0eeb5d70cb89
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bSq:sxX7QnxrloE5dpUpSbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe - Executes dropped EXE 2 IoCs
pid Process 4844 sysdevdob.exe 4152 xoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotF7\\xoptisys.exe" 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint7X\\bodxsys.exe" 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevdob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xoptisys.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe 4844 sysdevdob.exe 4844 sysdevdob.exe 4152 xoptisys.exe 4152 xoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 844 wrote to memory of 4844 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 83 PID 844 wrote to memory of 4844 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 83 PID 844 wrote to memory of 4844 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 83 PID 844 wrote to memory of 4152 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 84 PID 844 wrote to memory of 4152 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 84 PID 844 wrote to memory of 4152 844 69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe"C:\Users\Admin\AppData\Local\Temp\69e81eb9d402dadbb0859698ecd6a64e66ced6ee2e4151426f17965e9b9d55eaN.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
-
C:\UserDotF7\xoptisys.exeC:\UserDotF7\xoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Mint7X\bodxsys.exe
- Size 1.9MB
- SHA256 df761fa2a90d15fdc5b2fe5db31d87325aa9ff03f18eea3376402b6c5a5247e7
- MD5 e0198d1c4f2585a3d6f3fdb2b0df7cb7
- SHA1 7317e87fb6bc4dc2ec7539238801972bd2b4b1b2
- SHA512 4e6edcb3a564279b8282b974f717b4e01f4968760f016f385fbd959bce622623908873d4b81c994475dc49c746ec285cbd1498d5e1bf83484ad0fc75924fac06
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3i:sxX7QnxrloE5dpUpl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint7X\bodxsys.exe
- Size 2.6MB
- SHA256 3ef1a17a9b339222961e131172a0f3d17cf931c028225026d7c2fb6c1b6d8e5a
- MD5 32ace642d0afc674cf16ca14ca2aca8b
- SHA1 190a64e2894b22103bc5168ca07eac42d54b8909
- SHA512 28b20e426eaea1f71914515aaef373c3d0331057c0bff10045cd5e193f9615d8f49ee4c02c6d576e643dde5c43f5dc9300f1fa7c737b1b52d3e191fa2fd215f7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bSq:sxX7QnxrloE5dpUpDbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotF7\xoptisys.exe
- Size 2.6MB
- SHA256 04d0ce726718a74348df13a16d51e279a4e8aaf4306594ea7cea976e3c3550f7
- MD5 a14afe10c3337b6259406f75584ff116
- SHA1 85cfb93cf818e151a2f403bfcd5cb459b74bd7a3
- SHA512 be51965fcc841ac2c80f61e4b6fc9aeb196fdb460f83d5ae4932c84c36518fab3c49f3b6c1b5a5de1ed8e8d89aa4d553a49fe730a6cb29f4931b1ad981222f55
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bSq:sxX7QnxrloE5dpUpybV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 83d5ada59f1f5b4e92bae790f75e83a2ec35b85760684af718b71af633e517fa
- MD5 310f2409735bb66162a900226575d97e
- SHA1 d1b32980a3d9ac0f8ddc2b5d817a017707324d31
- SHA512 57d4926a468804efcfb0f665f402150a1a783dc9063bb6dfd2f51171cf45520ebc4bab7cb8e01ded3ca899c05fba82c81bec45a0f00479cc55212d83f83454f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 8e081c3fa53ab719f330e33f244ea24ea6921a3299d7049b2ba34f3f8081ac89
- MD5 6d1697ca03d911f7fc51b771470eeda1
- SHA1 c2dcabfab89056e82738232a6c5f409db8c9445e
- SHA512 6392630c7b0ee77c36bfd3dab6247ff99d14eb4c3cac20661f38d7686a8e8f8242c9fae0e65e4d72e8b8f6eaa009307840190d631a2496b8700226015c353746
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 2.6MB
- SHA256 9ac7de68a98c591e039651cb4bfd566e2cc66052a98eebf0619ef2fb41374b6e
- MD5 00dd1e41423fe07baf225b6b489b9176
- SHA1 db166bd1cf4ac2fdcbd8556300a6d5a028e0248f
- SHA512 5620470eb32690c40dad7609b7d3401ac98e9e3b347370a1ea6c847fcf51979b1b4d33a0997b4e40f3f174465be850272fd1e21215ba22691ad329a134892c85
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bSq:sxX7QnxrloE5dpUpQbV
- MD5 SHA1 SHA512 SSDEEP