Analysis
-
max time kernel
38s -
max time network
42s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14/05/2021, 09:06
Static task
static1
Behavioral task
behavioral1
Sample
fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe
Resource
win7v20210410
General
-
Target
fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe
-
Size
745KB
-
MD5
4f47f2fa563304efe9fffb13b32427f4
-
SHA1
97cc4db66c9636bd47031cb9e4a667643be9ee89
-
SHA256
fe68a629898384bb2edf90406da4c9d6764fd04e5337514e7edd9c2c608d2242
-
SHA512
a359e40931c6124e6b2dfce44b107fdad8e439d10dc1dba018d4c62c9bbca88f8bb2788249d810c3c91dd542461dd659b0472af746fd79455c246b7e5dddec03
Malware Config
Extracted
cryptbot
remdny42.top
morpgr04.top
-
payload_url
http://sulnom06.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
resource yara_rule behavioral2/memory/740-114-0x0000000002270000-0x0000000002351000-memory.dmp family_cryptbot behavioral2/memory/740-115-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3744 timeout.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 740 fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe 740 fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 740 wrote to memory of 744 740 fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe 78 PID 740 wrote to memory of 744 740 fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe 78 PID 740 wrote to memory of 744 740 fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe 78 PID 744 wrote to memory of 3744 744 cmd.exe 80 PID 744 wrote to memory of 3744 744 cmd.exe 80 PID 744 wrote to memory of 3744 744 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe"C:\Users\Admin\AppData\Local\Temp\fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\OPsmMqiVs & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3744
-
-