Analysis
-
max time kernel
35s -
max time network
46s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15/05/2021, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe
Resource
win7v20210408
General
-
Target
ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe
-
Size
708KB
-
MD5
7de2d80e181ee60311d729f2b1fafc57
-
SHA1
6579dab44c6619b6af86b57fcd160f9a1ffe7b54
-
SHA256
ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759fd20c9cf44693abf786
-
SHA512
48776b1226081f6892da57fae1437deaed37bc758f677693a258416a27bdf7690deaa3033cc66697fa88941d02673695751de97b23c63b04eee3f9c139f4e366
Malware Config
Extracted
cryptbot
remmzp62.top
mortlk06.top
-
payload_url
http://sullok09.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
resource yara_rule behavioral2/memory/908-114-0x0000000002260000-0x0000000002341000-memory.dmp family_cryptbot behavioral2/memory/908-115-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1340 timeout.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 908 ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe 908 ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 908 wrote to memory of 1996 908 ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe 78 PID 908 wrote to memory of 1996 908 ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe 78 PID 908 wrote to memory of 1996 908 ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe 78 PID 1996 wrote to memory of 1340 1996 cmd.exe 80 PID 1996 wrote to memory of 1340 1996 cmd.exe 80 PID 1996 wrote to memory of 1340 1996 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe"C:\Users\Admin\AppData\Local\Temp\ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\KDBZehTde & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1340
-
-