Analysis
-
max time kernel
110s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
05-12-2021 11:00
Static task
static1
General
-
Target
7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe
-
Size
393KB
-
MD5
b6aebbb102bb26e4c0558205bd656d99
-
SHA1
1428c1abc805e0cb7f3fce79caca068b22eb9324
-
SHA256
7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad
-
SHA512
9b1efe64c6fe992e1ae3b17ff9eb2ec4e819eb75ae47e0d712cee6ca1753905a2648c91534b04eb522c9aa093bddcc106bc2f2fc59860b40aa0e442dddaf341a
Malware Config
Extracted
cryptbot
unic11m.top
unic11e.top
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 640 timeout.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.execmd.exedescription pid process target process PID 4300 wrote to memory of 4492 4300 7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe cmd.exe PID 4300 wrote to memory of 4492 4300 7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe cmd.exe PID 4300 wrote to memory of 4492 4300 7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe cmd.exe PID 4492 wrote to memory of 640 4492 cmd.exe timeout.exe PID 4492 wrote to memory of 640 4492 cmd.exe timeout.exe PID 4492 wrote to memory of 640 4492 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe"C:\Users\Admin\AppData\Local\Temp\7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7566cafb19648f4bd31318201df9eaf8a47ce0633d7c76de92bca0a9867bc2ad.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\CMNNUA~1.ZIPMD5
db6eac12b7c0d6b8a8993f049cd9f78b
SHA1278da98b60ee90cdef150447bd629823e6b678bd
SHA2567d01dc2b984510dacb65fcb4b98f9be3106a76dd3e18ba62696db52c52c155fe
SHA512eb2dd39720e193a579392f0a0df651cb451b5ae4ff5d4e6315ca1954c4210f4ef086e786b386d1cee5c182ad646b28b51ad6190a2d3778311c4ea6f18fe0fe0e
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\LTYNEL~1.ZIPMD5
2a96f3df2664e3b50ac8b0783d803a85
SHA186122901ea03504662d864a7ddeef073d75874b5
SHA256645b7380a0b331fe79fec602487f38bdbec0222ffd385cd40ba02f020fbffaff
SHA512adfdc0fb35a47b39bf93c333db524903033331857052bceaa428d7db141e8ac65300ad26f507152c8c3e3782166e8f6acf33ae9ea79b0ccdd83f55a6eab95c06
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\_Files\_Chrome\DEFAUL~1.BINMD5
d4026455697acb78d4f621b54352b4f0
SHA1f32214a2fa38ee0eadb6b38b0cd444dc34ebc2c9
SHA2562e28af610200cae02bd440c87bee8508a08c65510e83916acf94f96faf6d7624
SHA512efb97c89babef3239063c4bb4230f5458474b4141dc128e84a4fe0e4067bc3e8a5ba6e2f6fc87568619af12c05731d121ccf73acbcd9ba06afd5fe92f65a2f76
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\_Files\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\_Files\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\_Files\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\_Files\_INFOR~1.TXTMD5
56412bf7a1ad29b568b42e0fa95b68f9
SHA1e338126b77ae34664ec58c7236477ec8309b0484
SHA25662c089eada798c09361edf1aeb1a7d57613a3eca734c26c323d07fee4226bc48
SHA512ea76557d109b2e4034a99b462909dd7b27440a91f2c0397699cc63c8b58ffc6c641f022e710dfacaff71ba756164bc21ac295ebb52917acbe9ee1d6d531298f7
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\_Files\_SCREE~1.JPEMD5
3e7f1ee39611bec4a91f519b5d8eed2a
SHA1f96269e800c8c1144a0fb8728a404f7596982275
SHA256b8fdcd561dfeaec0e412f2a693b0ad259646b9870ab13ef2abdc7784cb16b782
SHA512f8c946ca665a76adbac3e8721f4337162affae71b5515b5cffe2c0886bee1e9e82bb12dc15cae78cffe13e7bf096098e717c93a9863efb5ff7e11d7531fc86f4
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\files_\SCREEN~1.JPGMD5
3e7f1ee39611bec4a91f519b5d8eed2a
SHA1f96269e800c8c1144a0fb8728a404f7596982275
SHA256b8fdcd561dfeaec0e412f2a693b0ad259646b9870ab13ef2abdc7784cb16b782
SHA512f8c946ca665a76adbac3e8721f4337162affae71b5515b5cffe2c0886bee1e9e82bb12dc15cae78cffe13e7bf096098e717c93a9863efb5ff7e11d7531fc86f4
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\files_\SYSTEM~1.TXTMD5
56412bf7a1ad29b568b42e0fa95b68f9
SHA1e338126b77ae34664ec58c7236477ec8309b0484
SHA25662c089eada798c09361edf1aeb1a7d57613a3eca734c26c323d07fee4226bc48
SHA512ea76557d109b2e4034a99b462909dd7b27440a91f2c0397699cc63c8b58ffc6c641f022e710dfacaff71ba756164bc21ac295ebb52917acbe9ee1d6d531298f7
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\files_\_Chrome\DEFAUL~1.BINMD5
d4026455697acb78d4f621b54352b4f0
SHA1f32214a2fa38ee0eadb6b38b0cd444dc34ebc2c9
SHA2562e28af610200cae02bd440c87bee8508a08c65510e83916acf94f96faf6d7624
SHA512efb97c89babef3239063c4bb4230f5458474b4141dc128e84a4fe0e4067bc3e8a5ba6e2f6fc87568619af12c05731d121ccf73acbcd9ba06afd5fe92f65a2f76
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\files_\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\files_\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\uwcIUAenXCfV\files_\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
memory/640-133-0x0000000000000000-mapping.dmp
-
memory/4300-116-0x00000000004D0000-0x000000000057E000-memory.dmpFilesize
696KB
-
memory/4300-117-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4492-118-0x0000000000000000-mapping.dmp