Analysis

  • max time kernel
    136s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    14/05/2021, 20:21

General

  • Target

    66D7C25E25D943FF9972AD4E2821A586.exe

  • Size

    1.9MB

  • MD5

    66d7c25e25d943ff9972ad4e2821a586

  • SHA1

    1c2f71afa6f6e13dd5939f4cad875aad33902627

  • SHA256

    41f2e8b68fe406f818f0ab48067d967cc0a3430a9ddb97a191b3fca163b756ab

  • SHA512

    18d40773115c4bf9a80c1b91c04b0a58eeb69f8c9b25da68dcfcb92e3d532ba09d2aa6a278d6e0891e19e3e572ba1c77efe422189bd9b752ce770609904ac76f

Malware Config

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe
    "C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c IDrlwJfYJMXmiwvMLejGiwpEbzAYBNQCCBNmtKWnUyoSIhlcKugZfCLGzmNHpdbWWxXGgWHqyOLwSsWpoyhxmQjZPuuFXggDIjVhdDuOnhTBQJNeCEmtrebuoXQoQeeRmiz
      2⤵
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c cJSEYmWkWKpyarezPlAGPOtzNYXvleeIdiGTLUuDuklbOKPNZJefHMQGEmRZBmqUIAPkvpHUtXADEHEeplvBZMwDdZgjeuwGk
        2⤵
          PID:3992
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c PhVEdQeikKjheXUPQsrmUVmkUvUcSXVTagSsuFUGnRBssrXsshdK
          2⤵
            PID:188
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c LcTNKJTWHfhOaVNyDIlvbqezoURnCrEGldGTYDvVqJRCgCYoljOEygyLamFQRczDKHEegTuZkfvNoAyFVJgfgZBW
            2⤵
              PID:2876
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c UAnYGtFfgRHYVTsuOzQRaCSxZUiirgLuHRzaHwF
              2⤵
                PID:3616
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c QbUJnHqQWpAGKtSaItYMWnjZuBdtmYnNNFqVIpV
                2⤵
                  PID:1604
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c rhCXAMlbIpgvnaQrwtQfFzGEIidtAfAdlUEGulyjCLneKrEtxoszjcVJHXfavyXzJYkEOlWQYEMUVDUECkJa & irPYUYpUNPbOyzMRqdlkAcHIwOrrLQkcEcBUvFUkNWlPfyPpoMBVmuvMcuXuUuoWDwpKSRxxvYnElSzVYUUYgdVnYPndINdHNgkhVyddaimBISBDNwiqklIjuLLrztMIHRQWHyqTDEGiRxP & hVCGGdvDGYipzhXhxQTRwFVHwhvG & AcMWEPbBywscjdIYQAfGzMqAYyHZVFzTPqyDxhObmLfOCcOfhJkNiZlOxjXmonGAIbFjlyDCLRiHbjXCdsMjzGMPQ & oodffqtPytQBtiyIwfSCsogxoQMxueLQvUWcjcCuCIuSMOjEuLEvWhZ & TVungKIrzZyl & KvFMLZJwvIzEihcngToUVBsfrRSZrmNJwzvfYKk & dYbjNUivhEtyWdfotdJTiJYXVKCNQyAEIUEWttCpKcLnxHNL & glHqsuGqmseazGitmbwLat & OApLYmCgWQJCVSDsNYWENmQsPExUlLqMllSAicIAXruCKrjkWyhMcmjfJSWzyHrlPWaKZepadcHKahGMsoYtnhdKYCRfngcfZVMNKCkTVVvqSBXckleWJZMBGILbkTTeqsKbBSwPWypCRdSvFctgk & FqokieQOHwwzqARmUaphqDPpJfQfRQPFQBLKgfLYYobiBbdsFyALyYnelZBRjBXRjvDnOukEHlgS & IIjZnJLftmRrJAgOTMblGVtUR & mUWtVKGWBdfSORjCoWLctGWQObRHmNDaiUlRzqEivNYYnqYFYtNiovnSXyfbSYvONXKTHcpoaEYdHYsNmjJxqcpLv & ThKugndplBdyXDVFPDnolYNCYGfeOsNYbfBVbjfAZnNQvxgumcGGjhuVA & oIogcTOsHIwqiDgYoMlWyEapCaKiLppG & frGsLeUetMGtmhrsgyzKDeDdYMeoHFnncFSmHGbKdUqSMyryHPbrPWQjAdaYZLxnh & JTcDKIIJzJeLDTIXBRocJmOFZdhnL & mBEEcpJryOxuCilOMndwlDfSbltQEzxlXPpAiYbngbMzqCWHckDOoJxWkMikyTmLxloNYKGNqRNNQWRUhbxzPFwgcjgx & jzxYwZPxpILEPOdVGufUjYInyVPpTaMcjWObaOPWeArOJPqRKaOyYmFhLWSypGARWfsTZTDSdaSLVTOdVXnBDGbMdBMcWKMcZkSxbuSRPWPFHTsRiCpjoZgfRFDbuiW & FvMKwxSPyGLHRRybpUgzAAhqXCCRDxLHqoZliHQNJxuChGnqAuhkTCuypLMmRqkLVrHISUfBtAJyxLMsrCsbumObeUqcVdVIo & GpYQiFQMiaSqKnYccfJOEcfpGXUTGNFwWZtDahxMGxsvEwlCbmUGZxQkUOplLWyzMR & KxcroUXiprSFFNaviSZwC & C:\Windows\system32\cmd < Naufrago.vssm
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4084
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1288
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /V /R "^MPJomTHJarWYKrSxnHIhGEIlXeqEtUnnpLOyyJXoCUxrBcBNOGmEhseoimkvSrFbFbPYfMgPJmLMpEIBBjPbcUkSJFYFbBdngXbrGCnesKUNGdZCQKVFhieLkWfJNIs$" Vedi.vssm
                      4⤵
                        PID:2192
                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com
                        Ove.exe.com U
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2108
                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com
                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com U
                          5⤵
                          • Executes dropped EXE
                          • Checks processor information in registry
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:3776
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ysROCbH.exe"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3428
                            • C:\Users\Admin\AppData\Local\Temp\ysROCbH.exe
                              "C:\Users\Admin\AppData\Local\Temp\ysROCbH.exe"
                              7⤵
                              • Executes dropped EXE
                              • Drops startup file
                              • Suspicious use of WriteProcessMemory
                              PID:748
                              • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                8⤵
                                • Executes dropped EXE
                                • Suspicious behavior: AddClipboardFormatListener
                                PID:2388
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\KNVglUKfWRL & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4056
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 3
                              7⤵
                              • Delays execution with timeout.exe
                              PID:4060
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1 -n 30
                        4⤵
                        • Runs ping.exe
                        PID:864

                Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/748-150-0x0000000000980000-0x0000000000ACA000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/748-151-0x0000000000400000-0x000000000085D000-memory.dmp

                        Filesize

                        4.4MB

                      • memory/2388-152-0x0000000000860000-0x000000000090E000-memory.dmp

                        Filesize

                        696KB

                      • memory/2388-153-0x0000000000400000-0x000000000085D000-memory.dmp

                        Filesize

                        4.4MB

                      • memory/3776-134-0x00000000009E0000-0x00000000009E1000-memory.dmp

                        Filesize

                        4KB