Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    05-12-2021 10:58

General

  • Target

    efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe

  • Size

    392KB

  • MD5

    571f12f948ea19e6ed5eec7f3b973344

  • SHA1

    3241f91728f2cae3f372ece53c71307329d93de5

  • SHA256

    efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc

  • SHA512

    dce066b28be786225e50707fe8c8cac1b755c32e0779331e4f1b7676181c4a5ff2db77770675f0ff224dea2df69c34a3c380aa8f17264af9aeb3e0ef3df471be

Malware Config

Extracted

Family

cryptbot

C2

unic14m.top

unic14e.top

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe
    "C:\Users\Admin\AppData\Local\Temp\efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\wmyEtWbip & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Windows\SysWOW64\timeout.exe
        timeout 4
        3⤵
        • Delays execution with timeout.exe
        PID:3996

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\HYKJSI~1.ZIP
    MD5

    e57d4681a2cead3fc8184984e3f0dc99

    SHA1

    4c1e09998971dc8873d8255776e183a7477cc45c

    SHA256

    a4b530bdfef5f557a82c183880298f5137793c387370ec909df582925ee115f7

    SHA512

    ea9d785ec7bcb3a4aec2783531691289d264c02fcd8b5cca1f567811396c50ea055a09d4ebdf068e4fd36593d1f1f12c18eafb1a91f9848574830965cf880ff1

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\SIDVOM~1.ZIP
    MD5

    7cb947a8bbd352620f90498e7ff4cbae

    SHA1

    68d9109fd049f5268ab69df42e2fc25b3174193c

    SHA256

    cc1a528cb612ff110088b059ad8f7c29a4324172d9b8901b601176aaa95f36c6

    SHA512

    917082301fa823f45401493855c0045c7d70c320c085ab3083e27994e9bbeac18484275d5544bcaf0b1f0035d47101f07d4a6ed492a65f17d1ab183336c5da95

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~1.BIN
    MD5

    b963abf9a7967b3a22da64c9193fc932

    SHA1

    0831556392b56c00b07f04deb5474c4202c545e8

    SHA256

    6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

    SHA512

    64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~1.DB
    MD5

    b608d407fc15adea97c26936bc6f03f6

    SHA1

    953e7420801c76393902c0d6bb56148947e41571

    SHA256

    b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

    SHA512

    cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~2.DB
    MD5

    055c8c5c47424f3c2e7a6fc2ee904032

    SHA1

    5952781d22cff35d94861fac25d89a39af6d0a87

    SHA256

    531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

    SHA512

    c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~3.DB
    MD5

    8ee018331e95a610680a789192a9d362

    SHA1

    e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

    SHA256

    94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

    SHA512

    4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_INFOR~1.TXT
    MD5

    bfca6baaa9c355c562cdc65a3f1e310f

    SHA1

    b6b2bfd2cc4aa131670715fe51edf212424feedc

    SHA256

    496bdcf1381cc1150627c8d7415bec06ea9438d83221c5c787536b87b526f8bc

    SHA512

    38074e4ca3e38889973b180ab72946fe2a88ccdf62aff74431b66a8702b6a57bc8b8ca5a1567a752b2f5af6b7100cd9cfd40cebdb89922ba13b8061579588826

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_SCREE~1.JPE
    MD5

    e57aeea98b5034068cd4784f5c34a6be

    SHA1

    3ef3de4ee894a1d8858af1c9199bcebaceb6b380

    SHA256

    5eb333818a37acc7c1477548a57a5fedfc31dd995865c1ed07d6b4be2f0200e7

    SHA512

    f85b0eac9fad857b2d2c31b4114001bba5f34dfe29bb4c4adc13be573eda41bc056f35d01d1d0a5477786a6ba47d1a6dd4a14dc01f26323ce7d733b8d83e701c

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\SCREEN~1.JPG
    MD5

    e57aeea98b5034068cd4784f5c34a6be

    SHA1

    3ef3de4ee894a1d8858af1c9199bcebaceb6b380

    SHA256

    5eb333818a37acc7c1477548a57a5fedfc31dd995865c1ed07d6b4be2f0200e7

    SHA512

    f85b0eac9fad857b2d2c31b4114001bba5f34dfe29bb4c4adc13be573eda41bc056f35d01d1d0a5477786a6ba47d1a6dd4a14dc01f26323ce7d733b8d83e701c

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\SYSTEM~1.TXT
    MD5

    bfca6baaa9c355c562cdc65a3f1e310f

    SHA1

    b6b2bfd2cc4aa131670715fe51edf212424feedc

    SHA256

    496bdcf1381cc1150627c8d7415bec06ea9438d83221c5c787536b87b526f8bc

    SHA512

    38074e4ca3e38889973b180ab72946fe2a88ccdf62aff74431b66a8702b6a57bc8b8ca5a1567a752b2f5af6b7100cd9cfd40cebdb89922ba13b8061579588826

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~1.BIN
    MD5

    b963abf9a7967b3a22da64c9193fc932

    SHA1

    0831556392b56c00b07f04deb5474c4202c545e8

    SHA256

    6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

    SHA512

    64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~1.DB
    MD5

    b608d407fc15adea97c26936bc6f03f6

    SHA1

    953e7420801c76393902c0d6bb56148947e41571

    SHA256

    b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

    SHA512

    cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~2.DB
    MD5

    055c8c5c47424f3c2e7a6fc2ee904032

    SHA1

    5952781d22cff35d94861fac25d89a39af6d0a87

    SHA256

    531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

    SHA512

    c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

  • C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~3.DB
    MD5

    8ee018331e95a610680a789192a9d362

    SHA1

    e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

    SHA256

    94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

    SHA512

    4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

  • memory/1260-121-0x0000000000000000-mapping.dmp
  • memory/2672-118-0x0000000000629000-0x000000000064F000-memory.dmp
    Filesize

    152KB

  • memory/2672-120-0x0000000000400000-0x0000000000469000-memory.dmp
    Filesize

    420KB

  • memory/2672-119-0x00000000021B0000-0x00000000021F7000-memory.dmp
    Filesize

    284KB

  • memory/3996-136-0x0000000000000000-mapping.dmp