Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11/05/2021, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
a5c463db805e356cb6e73e5676b397eab265e061c6797.exe
Resource
win7v20210408
General
-
Target
a5c463db805e356cb6e73e5676b397eab265e061c6797.exe
-
Size
740KB
-
MD5
e458dc2ba9e161ea08ff8bebea2a469e
-
SHA1
33c3d82ad1a6ae6025f3c6d7230b7182da4b0765
-
SHA256
a5c463db805e356cb6e73e5676b397eab265e061c6797e27b626b8b4aee892a3
-
SHA512
f798ec39f39ecff88ed5092751e4500f4f7542e74d4b4c118b1dd85c390186d00b543aa9f26d6baf1317993bd7ee360177eb32b5c698d0356be3bbf1cb7d9eb1
Malware Config
Extracted
cryptbot
remdvz22.top
morjgs02.top
-
payload_url
http://sulsxq03.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
resource yara_rule behavioral2/memory/1892-114-0x00000000021D0000-0x00000000022B1000-memory.dmp family_cryptbot behavioral2/memory/1892-115-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 780 XXHRNrl.exe 1532 SmartClock.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk XXHRNrl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a5c463db805e356cb6e73e5676b397eab265e061c6797.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 64 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1532 SmartClock.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1892 wrote to memory of 4080 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe 79 PID 1892 wrote to memory of 4080 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe 79 PID 1892 wrote to memory of 4080 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe 79 PID 4080 wrote to memory of 780 4080 cmd.exe 81 PID 4080 wrote to memory of 780 4080 cmd.exe 81 PID 4080 wrote to memory of 780 4080 cmd.exe 81 PID 1892 wrote to memory of 3928 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe 82 PID 1892 wrote to memory of 3928 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe 82 PID 1892 wrote to memory of 3928 1892 a5c463db805e356cb6e73e5676b397eab265e061c6797.exe 82 PID 3928 wrote to memory of 64 3928 cmd.exe 84 PID 3928 wrote to memory of 64 3928 cmd.exe 84 PID 3928 wrote to memory of 64 3928 cmd.exe 84 PID 780 wrote to memory of 1532 780 XXHRNrl.exe 85 PID 780 wrote to memory of 1532 780 XXHRNrl.exe 85 PID 780 wrote to memory of 1532 780 XXHRNrl.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5c463db805e356cb6e73e5676b397eab265e061c6797.exe"C:\Users\Admin\AppData\Local\Temp\a5c463db805e356cb6e73e5676b397eab265e061c6797.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\XXHRNrl.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\XXHRNrl.exe"C:\Users\Admin\AppData\Local\Temp\XXHRNrl.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1532
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\nwHaAkJsKo & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a5c463db805e356cb6e73e5676b397eab265e061c6797.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:64
-
-