Analysis
- max time kernel
119s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
20/01/2025, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe
- Size 2.6MB
- Sample250120-mcaeaavkal
- SHA256 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26
- MD5 42852e089e771cded2b54fc4e62b91fc
- SHA1 6e9338f98e22726606e1bb91a537f1a046f19b6c
- SHA512 fedb2a3c8c78b8b4bea51335cad4ceb63dc21d2bf6f2080d0df63704b67df54bba1c5387b2e80686e61e1af0f4c81b66a9cc119e734c76ae70296b9040da41f5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqC:sxX7QnxrloE5dpUpEbVC
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe - Executes dropped EXE 2 IoCs
pid Process 4552 sysdevdob.exe 5084 aoptisys.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotKP\\aoptisys.exe" 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxUK\\dobasys.exe" 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoptisys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdevdob.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe 4552 sysdevdob.exe 4552 sysdevdob.exe 5084 aoptisys.exe 5084 aoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3056 wrote to memory of 4552 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 83 PID 3056 wrote to memory of 4552 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 83 PID 3056 wrote to memory of 4552 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 83 PID 3056 wrote to memory of 5084 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 84 PID 3056 wrote to memory of 5084 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 84 PID 3056 wrote to memory of 5084 3056 3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe"C:\Users\Admin\AppData\Local\Temp\3fbbd1fc1b7eb32aa7223cf066f01c050d7802dd327cf9d42f8c25e547b7dd26.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
-
C:\UserDotKP\aoptisys.exeC:\UserDotKP\aoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxUK\dobasys.exe
- Size 29KB
- SHA256 73310f0dab90499fcda3b7fc967815f59418fd9a16eb2c5fdae380da74753d78
- MD5 8dc4d9694c17621720c320e82829dbd9
- SHA1 a9ac9ea870162fc6dc14d43c98824d48c29ec74c
- SHA512 bc76ddbcf70495f591f732f5a318f0de053184a7f9a94a2200be2db198ca084994c595437e721fa7d00df285a550501c22df2af8f77fd72840210ccca0fc8b3b
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/7TJRKahcO8oRZjqOs7e67CK4DQx:xezkk/DUj7TlODVED17nKFO3nq/Kjsx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxUK\dobasys.exe
- Size 2.6MB
- SHA256 ba150295d4d8d7b07a1a5c5984367db40129b88f86a1607a0b4b11577457f0f1
- MD5 9c63f5746c2472b364b1e712ce2f1adb
- SHA1 b3fa5587014d9496bdb74e72b349e7907a6eccaf
- SHA512 8a85bd5ac5d4dcd357027f7e2eaebbbda594faf11c1514c52f7612bb4f1925bdccd3b423286e4e971420493b1e0d1984cb83420004ac0e1476a2251d42e369b6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBTB/bSq:sxX7QnxrloE5dpUpkbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotKP\aoptisys.exe
- Size 2.6MB
- SHA256 4aa9721da8b3409f129042f2766588150abe61e1e67446243b844449372bcbf4
- MD5 5b0a0b4dac935788584dc11644af3212
- SHA1 2f7927d7e77d2fd9ed4f6223892c680b48ec8da4
- SHA512 d80badc15b26da419f3a74c23216e31392b9dbc37f137ae173a1cbc7ce60ae000a81ff9295dbaf58efdf26edd3554c00b13ab18f2a91667d815e68be35121a5f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bSq:sxX7QnxrloE5dpUpHbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 69773f1f9334bdfa3b32cdfb0720a6dabbceab4c6c8b33e3076347900d0c082d
- MD5 46587953f2df41ebbb629c4d7b6234aa
- SHA1 dccde4f30742cd8f5ab40e1dc888535c3094301d
- SHA512 26957bcdd588dd7cad8e638c6ca095e49eb4b170c4e12e7a03ae37afb8147e82b27a79fd2d25402cdc6ac156a18eb13ac31347ca05097fb4fc8caa40d5ff4982
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 174B
- SHA256 6a99c4ad78c7fb706a7304fc6659474e68179f6b62035c4041c477369ebe8f29
- MD5 229d5851db953095ad27ca20eeb8962f
- SHA1 66dda7096a946a664f9def5dbb1f645be96f853c
- SHA512 03f2297d16e8df1ccb9573be452e5fe42c9f23e921e60220ab3a0fc515253072f6c1ed7c11370b8e88f2780ba9a31ee539cdedd60a9c226dbabcc7d0648c4520
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 2.6MB
- SHA256 b8e510cb20f0fc42349c3b99c3ed4ff53b4454f6e2ec3e1fc0d2ed3883669ea2
- MD5 6e0426668bb9fa972702a8e520ff7bdb
- SHA1 6e5d1b61a0d3f596a960c3f336dcea9cce8a1505
- SHA512 f28c5ffd692bdcb0ac1eee4a063a55887355da7c777fb907445b5ae5b98f6e4d87787e3727980f9c1507fe3d77b2ced4cbd88a9469a8da64568fd266543ba596
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQB/bSqG:sxX7QnxrloE5dpUpnbVG
- MD5 SHA1 SHA512 SSDEEP