General
-
Target
22A92A568FC21BEB4EDE99712FB38C80.exe
-
Size
288KB
-
Sample
210506-pw1244dq4s
-
MD5
22a92a568fc21beb4ede99712fb38c80
-
SHA1
b64ab3f50c337b0de0df01c388889fd4d6065fdc
-
SHA256
80f4e35d825fcd2816deb95b0a2694203238b769cbf6267dcca8d10d6e1394c4
-
SHA512
ecd189abd64ab5a0b7a8285a1b3a9ae4b6e89b6b33581c83a54897eb6fb58532699a597aedb5240cf5d7f7e648dcc1af26ce853fdf536bf5c0781df08c1efcca
Static task
static1
Behavioral task
behavioral1
Sample
22A92A568FC21BEB4EDE99712FB38C80.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
22A92A568FC21BEB4EDE99712FB38C80.exe
Resource
win10v20210408
Malware Config
Extracted
fickerstealer
truzen.site:80
Extracted
cryptbot
eoslyp42.top
morlrq04.top
Targets
-
-
Target
22A92A568FC21BEB4EDE99712FB38C80.exe
-
Size
288KB
-
MD5
22a92a568fc21beb4ede99712fb38c80
-
SHA1
b64ab3f50c337b0de0df01c388889fd4d6065fdc
-
SHA256
80f4e35d825fcd2816deb95b0a2694203238b769cbf6267dcca8d10d6e1394c4
-
SHA512
ecd189abd64ab5a0b7a8285a1b3a9ae4b6e89b6b33581c83a54897eb6fb58532699a597aedb5240cf5d7f7e648dcc1af26ce853fdf536bf5c0781df08c1efcca
-
CryptBot Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-