Analysis
-
max time kernel
36s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13/05/2021, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe
Resource
win7v20210408
General
-
Target
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe
-
Size
731KB
-
MD5
105f97e06f45250a6448035b94f2ef2b
-
SHA1
3819346f3b8c05add77c89205a58533dabbc7249
-
SHA256
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd0623c0df2fe62bd99986b
-
SHA512
9a57ebc3835d2abedb966a501bfb7c2d15769a8f3a95320c00dc91e892710d182fffd4f1971dda989c5129da493cb64ce329cb9b8a2aa1177167ecadd07cc3d7
Malware Config
Extracted
cryptbot
remdny42.top
morpgr04.top
-
payload_url
http://sulnom06.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
resource yara_rule behavioral2/memory/800-114-0x0000000002260000-0x0000000002341000-memory.dmp family_cryptbot behavioral2/memory/800-115-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2076 timeout.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 800 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe 800 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 800 wrote to memory of 1472 800 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe 78 PID 800 wrote to memory of 1472 800 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe 78 PID 800 wrote to memory of 1472 800 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe 78 PID 1472 wrote to memory of 2076 1472 cmd.exe 80 PID 1472 wrote to memory of 2076 1472 cmd.exe 80 PID 1472 wrote to memory of 2076 1472 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe"C:\Users\Admin\AppData\Local\Temp\2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\rPQsVWrlNvv & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2076
-
-