Analysis
-
max time kernel
33s -
max time network
39s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14/05/2021, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe
Resource
win7v20210408
General
-
Target
305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe
-
Size
716KB
-
MD5
3edf30cca0e969d2ba512ffc73d77eb4
-
SHA1
f6cc5083820a4897fbfb2890568691b12400fb59
-
SHA256
305df52e17cf7e129ece5188cd9bf51102fda9ac812d597c3e29314b06e8b3b8
-
SHA512
e50bbe973b796c802a789d0463bad04274d5f81a10e327b731b2c8730d779fb4266a782e59b88d1e590f75038b297873a4ec112097a5873dde3e1e1dd006755e
Malware Config
Extracted
cryptbot
remeze52.top
morhza05.top
-
payload_url
http://suleqs07.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
resource yara_rule behavioral2/memory/740-114-0x0000000002280000-0x0000000002361000-memory.dmp family_cryptbot behavioral2/memory/740-115-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2812 timeout.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 740 305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe 740 305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 740 wrote to memory of 744 740 305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe 78 PID 740 wrote to memory of 744 740 305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe 78 PID 740 wrote to memory of 744 740 305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe 78 PID 744 wrote to memory of 2812 744 cmd.exe 80 PID 744 wrote to memory of 2812 744 cmd.exe 80 PID 744 wrote to memory of 2812 744 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe"C:\Users\Admin\AppData\Local\Temp\305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\wCCQNDkqYw & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\305df52e17cf7e129ece5188cd9bf51102fda9ac812d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2812
-
-