Analysis

  • max time kernel
    121s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    12-07-2021 08:52

General

  • Target

    e493d514a5154df3ce530a3dee1d8d07.exe

  • Size

    648KB

  • MD5

    e493d514a5154df3ce530a3dee1d8d07

  • SHA1

    fba1795a04b5d6e932213b85f68239e0bd086c1f

  • SHA256

    1913b57379e19d7d05f7a55160343d7d081fe01c668b0652097311a0e9f57940

  • SHA512

    117f429620d1f2fb268fa9deb0cdcc441e2781ae676121ba28030435e989127fe90a76fd725b4ac99ea5ae2b0fa8769eb93993340a973b6e94b587f93dbeab83

Malware Config

Extracted

Family

cryptbot

C2

aledna72.top

Attributes
  • payload_url

    http://otivzt10.top/download.php?file=lv.exe

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot Payload 2 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e493d514a5154df3ce530a3dee1d8d07.exe
    "C:\Users\Admin\AppData\Local\Temp\e493d514a5154df3ce530a3dee1d8d07.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Local\Temp\rrOmfypkjmhXt.exe
      "C:\Users\Admin\AppData\Local\Temp\rrOmfypkjmhXt.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:3684
      • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
        "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2224
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c cmd < Com.eps
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3704
          • C:\Windows\SysWOW64\cmd.exe
            cmd
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3812
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V /R "^YCOdJJZkdYoAFHrXZiWwDNaLZTdcPBoWBxjekRZaqtWdKMBcgLwJqBdkprsPaDcPQjZlxqMoiDwmQewjaVitmnWZtwSiAlZvJimnMdqhYTBvAQxietbbcdfsdquziEIXEEQICCmwUUuFW$" Una.eps
              6⤵
                PID:3908
              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Vigilanza.exe.com
                Vigilanza.exe.com q
                6⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2980
                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Vigilanza.exe.com
                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Vigilanza.exe.com q
                  7⤵
                  • Executes dropped EXE
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:3064
                  • C:\Users\Admin\AppData\Local\Temp\qiiiltcmwx.exe
                    "C:\Users\Admin\AppData\Local\Temp\qiiiltcmwx.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1164
                    • C:\Windows\SysWOW64\rundll32.exe
                      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\QIIILT~1.DLL,s C:\Users\Admin\AppData\Local\Temp\QIIILT~1.EXE
                      9⤵
                      • Loads dropped DLL
                      PID:3068
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fxhvpkwr.vbs"
                    8⤵
                      PID:1160
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wsemoswutf.vbs"
                      8⤵
                      • Blocklisted process makes network request
                      • Modifies system certificate store
                      PID:1424
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 30
                  6⤵
                  • Runs ping.exe
                  PID:1840
          • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
            "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
            3⤵
            • Executes dropped EXE
            • Drops startup file
            • Suspicious use of WriteProcessMemory
            PID:2196
            • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
              "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: AddClipboardFormatListener
              PID:2152

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Com.eps

        MD5

        f34d4133b3c2b4ec6a91073d87706a36

        SHA1

        c0cee43a57885b9ba82f144b935069ae726ca35c

        SHA256

        eceef24396a8d5be4686404b2c6491b0d94660e51458f1e9ee76cc1ce97471a4

        SHA512

        693fdbbf74c476c5932f7c23f77a83d4f14da9fafd4e448ddbcda8dda43a6db8527a961129593c36fa74959ed8a63b5f67f119513aeb00c2bc27ccc6249343f7

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.eps

        MD5

        49392c73bc9a9014d527d23b47eb912b

        SHA1

        ad6b02c5d7b23e78507f065dfbaa6703e8aad4a7

        SHA256

        69ec34d94795e6c5b9f9990e3a0b213aa3a2530165b3bfa02c6d153bb49ffcf8

        SHA512

        f8f9c0a494c91dc50a8875fa968d3794ed62b3bbe9710f423a81609d0ebb9f40b88a3d3ca66d76913c07e439bf500c65824abde52f98db2dc62b51a8115a544b

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Peso.eps

        MD5

        286526d682691b7a4ef5007dfa0a9763

        SHA1

        81368225f85a015ea8f8ec5e0373602e3c395933

        SHA256

        a06dc571e12f546545c4fef42caeffdadc32c8adc4b6388234688e05e83597f5

        SHA512

        ce758c47fd6318ff5fd74c98b40fe3cb9bad11cbde7b9a3a0936402085d2462640d56df2ce4a00181a553ca11ec2d7649424edd51b57dd686b0432e590b2eca4

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Una.eps

        MD5

        7668e9163aaa75340156a4c74f99888f

        SHA1

        b06cefe88c7b983864c2fb9a5042d99b870bf429

        SHA256

        61cf8d01c12e6e60613bf5d18cedab4101e66f54e85af73eb6f9af0ff49efcec

        SHA512

        f246e29783e8d3346b6110edfdc7d02fd908bacd10eafe22e0f8db9962dd8b1dea74c2ed379a9b509b3accf83491e54e0dea6176d31354dea3e2c7aa5ad5c56c

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Vigilanza.exe.com

        MD5

        c56b5f0201a3b3de53e561fe76912bfd

        SHA1

        2a4062e10a5de813f5688221dbeb3f3ff33eb417

        SHA256

        237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

        SHA512

        195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Vigilanza.exe.com

        MD5

        c56b5f0201a3b3de53e561fe76912bfd

        SHA1

        2a4062e10a5de813f5688221dbeb3f3ff33eb417

        SHA256

        237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

        SHA512

        195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Vigilanza.exe.com

        MD5

        c56b5f0201a3b3de53e561fe76912bfd

        SHA1

        2a4062e10a5de813f5688221dbeb3f3ff33eb417

        SHA256

        237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

        SHA512

        195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\q

        MD5

        286526d682691b7a4ef5007dfa0a9763

        SHA1

        81368225f85a015ea8f8ec5e0373602e3c395933

        SHA256

        a06dc571e12f546545c4fef42caeffdadc32c8adc4b6388234688e05e83597f5

        SHA512

        ce758c47fd6318ff5fd74c98b40fe3cb9bad11cbde7b9a3a0936402085d2462640d56df2ce4a00181a553ca11ec2d7649424edd51b57dd686b0432e590b2eca4

      • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe

        MD5

        f8cb22a9c7e9818231198078ce62e430

        SHA1

        009a4e5adfcba959a9f01d7dd1d0ec3e935bfa87

        SHA256

        c30319e98c250048931367fd0b1d68a706b6a38978afac9e01fd981d932fb3fc

        SHA512

        c74ffab663822ae38ea07ed046cd7bccc2662cfe512f418283675df34907012da736e9ab895499695a3e28727ba0449dcc481704990655bd84f8c8c37c435d25

      • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe

        MD5

        f8cb22a9c7e9818231198078ce62e430

        SHA1

        009a4e5adfcba959a9f01d7dd1d0ec3e935bfa87

        SHA256

        c30319e98c250048931367fd0b1d68a706b6a38978afac9e01fd981d932fb3fc

        SHA512

        c74ffab663822ae38ea07ed046cd7bccc2662cfe512f418283675df34907012da736e9ab895499695a3e28727ba0449dcc481704990655bd84f8c8c37c435d25

      • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe

        MD5

        9d55a487e57c1cfdd5574c28749c3c05

        SHA1

        fefa160b77d7444de7c79037a2ddc126632d448b

        SHA256

        ca1b2fa412246aa0fc087752e60e6b3736dad8a6c52811fcc5c0bf6c37e2abf9

        SHA512

        eda9adff411074fe41349c6442fb895405483150395e0be3ed22a7370e2240f163dc3aae19d9a092bd1ad19bd06bfc7af6bd5f385972a17bc906445d9e001891

      • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe

        MD5

        9d55a487e57c1cfdd5574c28749c3c05

        SHA1

        fefa160b77d7444de7c79037a2ddc126632d448b

        SHA256

        ca1b2fa412246aa0fc087752e60e6b3736dad8a6c52811fcc5c0bf6c37e2abf9

        SHA512

        eda9adff411074fe41349c6442fb895405483150395e0be3ed22a7370e2240f163dc3aae19d9a092bd1ad19bd06bfc7af6bd5f385972a17bc906445d9e001891

      • C:\Users\Admin\AppData\Local\Temp\QIIILT~1.DLL

        MD5

        83ef77cbe7f7283e8875db7121fb5ce5

        SHA1

        beae189cd9bc9d717a4f8b6fa4a8c292be46f677

        SHA256

        b82a39a6fcf08d16f2796955efbc35ca8adc0552be0bb1798376fe245a45c452

        SHA512

        fc69bcfcb7969852a9f9e8cea6cafcc1b3c5d8c173062679683a8a82a453f8a675ddbd8b5caa60bc579da72c6e733c3f8bbfdfb5fd395f7224aabb000230adbf

      • C:\Users\Admin\AppData\Local\Temp\fxhvpkwr.vbs

        MD5

        3938c8dae89a992f40eea1b2244062df

        SHA1

        b7c605a2716fb3b8679f0370a76bd7309bbd96c5

        SHA256

        939c43cbb2ac518d28fd7f2289a295daebab8f9b8ab42fad38e9c641a815b64d

        SHA512

        33d53ee505f5a89b5fd414b54072659af369223c4e0dfc245e48be3ad00b9c82b3211a3e5a89f1c07443a3dfae40fea0a53f56b9eeda5d301e64b63a6a5bba08

      • C:\Users\Admin\AppData\Local\Temp\qiiiltcmwx.exe

        MD5

        1323af5b087a2941e31817a98c035269

        SHA1

        65e101144578c32a03614039e2e6b3c04900c98a

        SHA256

        60db5de363585fce685056cde11796f4cadc79c861e39475ebd9bb2b9c6e8117

        SHA512

        2b7172a93ebaf6cce4bcde08038dc8666c57d580724dc32e3e586483e345499ced915a76ddd435c7a3be858ea77a314033a30bf1bd6e57942cdab877290e81c1

      • C:\Users\Admin\AppData\Local\Temp\qiiiltcmwx.exe

        MD5

        1323af5b087a2941e31817a98c035269

        SHA1

        65e101144578c32a03614039e2e6b3c04900c98a

        SHA256

        60db5de363585fce685056cde11796f4cadc79c861e39475ebd9bb2b9c6e8117

        SHA512

        2b7172a93ebaf6cce4bcde08038dc8666c57d580724dc32e3e586483e345499ced915a76ddd435c7a3be858ea77a314033a30bf1bd6e57942cdab877290e81c1

      • C:\Users\Admin\AppData\Local\Temp\rrOmfypkjmhXt.exe

        MD5

        50dad4adf51cd79103eb8f3e7c51793c

        SHA1

        5c14c17b4bbdce38b51669c0b1ae69d23fc453c1

        SHA256

        93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62

        SHA512

        44cf49a6819b13e77afa4a15187d928ec6d173142163867b3c05dc10815f364dd9ca9d4a93ae8eb30e40158249f6046199a733277f141cb9537a320e29b8fd79

      • C:\Users\Admin\AppData\Local\Temp\rrOmfypkjmhXt.exe

        MD5

        50dad4adf51cd79103eb8f3e7c51793c

        SHA1

        5c14c17b4bbdce38b51669c0b1ae69d23fc453c1

        SHA256

        93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62

        SHA512

        44cf49a6819b13e77afa4a15187d928ec6d173142163867b3c05dc10815f364dd9ca9d4a93ae8eb30e40158249f6046199a733277f141cb9537a320e29b8fd79

      • C:\Users\Admin\AppData\Local\Temp\wsemoswutf.vbs

        MD5

        d416559f49bbe2527e7f12e7b07798b1

        SHA1

        de232a09016753ec659c148b3f631c815392d3f9

        SHA256

        141284f769415a51a40e44b8295806d1550509f185bc620f3d546f18d39235d0

        SHA512

        08b09452748454fa5a4507cd9e8dcc786fd9640a9c647738a0f6edcadac04422d36906f87677e5a04ddc6174e7a391f4f7b318fd890b23fcfd581576c21eb456

      • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe

        MD5

        f8cb22a9c7e9818231198078ce62e430

        SHA1

        009a4e5adfcba959a9f01d7dd1d0ec3e935bfa87

        SHA256

        c30319e98c250048931367fd0b1d68a706b6a38978afac9e01fd981d932fb3fc

        SHA512

        c74ffab663822ae38ea07ed046cd7bccc2662cfe512f418283675df34907012da736e9ab895499695a3e28727ba0449dcc481704990655bd84f8c8c37c435d25

      • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe

        MD5

        f8cb22a9c7e9818231198078ce62e430

        SHA1

        009a4e5adfcba959a9f01d7dd1d0ec3e935bfa87

        SHA256

        c30319e98c250048931367fd0b1d68a706b6a38978afac9e01fd981d932fb3fc

        SHA512

        c74ffab663822ae38ea07ed046cd7bccc2662cfe512f418283675df34907012da736e9ab895499695a3e28727ba0449dcc481704990655bd84f8c8c37c435d25

      • \Users\Admin\AppData\Local\Temp\QIIILT~1.DLL

        MD5

        83ef77cbe7f7283e8875db7121fb5ce5

        SHA1

        beae189cd9bc9d717a4f8b6fa4a8c292be46f677

        SHA256

        b82a39a6fcf08d16f2796955efbc35ca8adc0552be0bb1798376fe245a45c452

        SHA512

        fc69bcfcb7969852a9f9e8cea6cafcc1b3c5d8c173062679683a8a82a453f8a675ddbd8b5caa60bc579da72c6e733c3f8bbfdfb5fd395f7224aabb000230adbf

      • \Users\Admin\AppData\Local\Temp\nsaC7BB.tmp\UAC.dll

        MD5

        adb29e6b186daa765dc750128649b63d

        SHA1

        160cbdc4cb0ac2c142d361df138c537aa7e708c9

        SHA256

        2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

        SHA512

        b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

      • memory/628-115-0x0000000000400000-0x0000000002C65000-memory.dmp

        Filesize

        40.4MB

      • memory/628-114-0x0000000002ED0000-0x0000000002F9C000-memory.dmp

        Filesize

        816KB

      • memory/1160-150-0x0000000000000000-mapping.dmp

      • memory/1164-153-0x0000000000400000-0x0000000000ADD000-memory.dmp

        Filesize

        6.9MB

      • memory/1164-152-0x0000000001140000-0x000000000132A000-memory.dmp

        Filesize

        1.9MB

      • memory/1164-147-0x0000000000000000-mapping.dmp

      • memory/1424-154-0x0000000000000000-mapping.dmp

      • memory/1840-135-0x0000000000000000-mapping.dmp

      • memory/2152-140-0x0000000000000000-mapping.dmp

      • memory/2152-144-0x0000000000400000-0x0000000002BFE000-memory.dmp

        Filesize

        40.0MB

      • memory/2196-134-0x00000000001C0000-0x00000000001E6000-memory.dmp

        Filesize

        152KB

      • memory/2196-143-0x0000000000400000-0x0000000002BFE000-memory.dmp

        Filesize

        40.0MB

      • memory/2196-123-0x0000000000000000-mapping.dmp

      • memory/2224-120-0x0000000000000000-mapping.dmp

      • memory/2980-132-0x0000000000000000-mapping.dmp

      • memory/3064-145-0x0000000000A20000-0x0000000000A21000-memory.dmp

        Filesize

        4KB

      • memory/3064-137-0x0000000000000000-mapping.dmp

      • memory/3068-156-0x0000000000000000-mapping.dmp

      • memory/3684-116-0x0000000000000000-mapping.dmp

      • memory/3704-126-0x0000000000000000-mapping.dmp

      • memory/3812-128-0x0000000000000000-mapping.dmp

      • memory/3908-129-0x0000000000000000-mapping.dmp